atlas-mas

MAS / Guidelines on AI Risk Management

Guidelines from the Monetary Authority of Singapore (MAS) setting out its supervisory expectations for financial institutions managing risks from AI, including Generative AI and AI agents, applied in proportion to the risk materiality of each AI use case. The risk tree covers AI identification, inventory and risk materiality assessment (Section 4) and the AI life cycle controls in Section 5. The guidelines also set expectations for organisational processes that are not modelled as risks here: board and senior management oversight of AI (Section 3); pre-deployment reviews and independent validation, post-deployment monitoring and re-validation, and change management and decommissioning (Sections 5.18 to 5.26, except the technology and cybersecurity reviews in 5.22); and AI capability and capacity, including staff competence and technology infrastructure (Section 6).

Type:

Regulation

Industry:

Finance

Domain:

Accountability & GovernanceBias & FairnessCybersecurityPrivacy & DataTransparencyPerformance & ReliabilitySafety & Reputational Harm

Region:

Singapore

Content:

20 Risks66 Controls

Version: 10/2026

Framework Definition

Risks and controls associated with the framework

Assessment Layer

Concrete evaluations linked to controls to assess pass or fail

No evaluation mapping defined yet.

P.1AI identification, inventory and risk materiality

Identify AI use consistently, keep an accurate AI inventory, and assess the risk materiality of each use case so that controls are applied proportionately.

RISK

Unidentified AI use

AI use, including AI embedded in third-party services and shadow AI, goes unidentified, so governance and controls are not applied to it.

R.1.1

3 Controls

CONTROL

Identify AI consistently across business areas and material third-party services

Ensure that clear AI definitions, criteria and processes are applied consistently across the FI and cover AI embedded in material third-party services, including SaaS features not marketed as AI.

C.1.1.1

CONTROL

Designate a control function as arbiter of AI identification

Ensure that a designated control function owns the identification process, independently oversees how business units apply it, documents the outcomes, and makes the final call on whether a given use constitutes AI.

C.1.1.2

CONTROL

Mitigate residual risks from unidentified and shadow AI use

Ensure that risks from AI that cannot be reliably identified, such as shadow AI or undisclosed AI in vendor services, are assessed and mitigated, for example through staff guidance on permitted tools, network monitoring and data loss prevention.

C.1.1.3

RISK

Inaccurate or incomplete AI inventory

The AI inventory is incomplete, outdated or missing key attributes, which undermines oversight, risk assessment and scope monitoring.

R.1.2

5 Controls

CONTROL

Maintain an accurate AI inventory with a defined update frequency

Ensure that the AI inventory covers use cases, systems and models across the FI and is updated at a defined frequency to reflect new, changed and decommissioned AI.

C.1.2.1

CONTROL

Link the AI inventory to other relevant inventories

Ensure that the AI inventory cross-references other inventories, for example through shared data asset or vendor identifiers that link to data inventories and third-party registers.

C.1.2.2

CONTROL

Capture key attributes for each AI use case, system or model

Ensure that each entry records the attributes needed for oversight, such as purpose, approved scope, model type, data used, dependencies, lifecycle status, risk materiality, review status, owners and documentation links.

C.1.2.3

CONTROL

Review inventory design for newer AI technologies such as AI agents

Ensure that the inventory design is reviewed regularly to capture attributes relevant to newer AI, such as agent identifiers, the tools and systems an agent can access, and its guardrails.

C.1.2.4

CONTROL

Designate a control function to own the AI inventory

Ensure that a designated control function sets inventory policies and independently oversees the business units that maintain it, so the inventory stays accurate and complete.

C.1.2.5

RISK

Inconsistent AI risk materiality assessment

AI use cases are not assessed consistently for risk materiality, so higher-risk AI does not receive more stringent scrutiny and controls.

R.1.3

4 Controls

CONTROL

Apply a consistent risk materiality assessment methodology

Ensure that a documented methodology is applied to every AI use case in the same way, so that higher-risk use cases receive more stringent controls.

C.1.3.1

CONTROL

Assess inherent and residual risk materiality before deployment

Ensure that each AI use case is rated for inherent risk before controls and residual risk after them, that residual risk is within risk appetite before deployment, and that assessments are reviewed regularly.

C.1.3.2

CONTROL

Assess impact, complexity and reliance in risk materiality assessments

Ensure that the assessment covers at least the impact of AI failure on the FI and its customers, the complexity of the technology, data and explainability, and the reliance on and autonomy granted to the AI, including dependencies on other AI.

C.1.3.3

CONTROL

Designate a control function to arbitrate or approve risk materiality

Ensure that a designated control function owns the assessment framework, approves or arbitrates risk materiality ratings, and keeps assessments documented and current.

C.1.3.4

P.2AI life cycle controls and contingency

Plan and implement controls across the entire AI life cycle, proportionate to risk materiality, with tested contingency plans for high-risk AI.

RISK

Incomplete or disproportionate life cycle controls

Controls do not cover the full AI life cycle or are not calibrated to risk materiality, and constraints such as limited vendor disclosure go unmitigated.

R.2.1

2 Controls

CONTROL

Implement controls across the entire AI life cycle with clear roles

Ensure that controls span the AI life cycle from inception to decommissioning, that responsibility for each control is assigned, and that controls are reviewed as newer AI technologies are adopted.

C.2.1.1

CONTROL

Calibrate life cycle controls to risk materiality and mitigate constraints

Ensure that life cycle controls are proportionate to risk materiality, and that where a control cannot be fully applied, such as when a vendor discloses too little, the resulting risks are mitigated, for example by limiting the AI's use.

C.2.1.2

RISK

No fallback for AI failure

High-risk AI has no tested contingency plan, fallback or kill switch to maintain business continuity when the AI fails or behaves unexpectedly.

R.2.2

2 Controls

CONTROL

Develop and regularly test contingency plans for high-risk AI

Ensure that high-risk AI use cases have contingency plans with fallback options, such as alternative systems or manual processes, and that the plans are tested under a range of operating conditions.

C.2.2.1

CONTROL

Define and regularly test kill switch activation protocols

Ensure that AI with a kill switch has clear, regularly tested activation protocols, so it can be deactivated promptly when it exceeds risk tolerances.

C.2.2.2

P.3Data management

Ensure that data used across the AI life cycle is fit for purpose, representative, of high quality, and subject to robust data governance.

RISK

Unsuitable or unrepresentative data

Training and testing data does not suit the intended objective or does not reflect the real-world conditions, including stressed conditions, under which the AI will operate.

R.3.1

2 Controls

CONTROL

Assess data suitability for the intended objective, including fairness

Ensure that the data used suits the AI's intended objective and context, and that its use is assessed against other considerations such as fairness.

C.3.1.1

CONTROL

Use training and testing data that reflect real-world and stressed conditions

Ensure that training and testing data cover the range of real-world conditions, including stressed conditions, under which the AI will operate.

C.3.1.2

RISK

Poor data quality

Data is irrelevant, inaccurate, incomplete or outdated, or develops anomalies, drift or bias that go undetected.

R.3.2

2 Controls

CONTROL

Assess data relevance, accuracy, completeness and recency

Ensure that data used across the AI life cycle is checked for relevance, accuracy, completeness and recency before use.

C.3.2.1

CONTROL

Monitor data quality for anomalies, drift and potential bias

Ensure that data quality is monitored on an ongoing basis, with checks for anomalies, distribution drift and potential bias.

C.3.2.2

RISK

Weak data governance, security and privacy

Data is not classified, secured, handled in line with privacy requirements or documented, which exposes sensitive data and prevents audit.

R.3.3

4 Controls

CONTROL

Classify data by criticality and sensitivity to guide its use in AI

Ensure that data is classified by criticality and sensitivity, and that the classification governs which data may be used in which AI use case.

C.3.3.1

CONTROL

Secure data across its life cycle, including AI inputs and outputs

Ensure that data, model artifacts and outputs are protected throughout their life cycle, with encryption in transit and at rest, secure handling of AI inputs and outputs, and timely destruction when no longer needed.

C.3.3.2

CONTROL

Apply data privacy measures when using personal data to train or run AI

Ensure that personal data used in AI is handled under applicable privacy requirements, such as obtaining consent before using sensitive customer or employee data to train or run models.

C.3.3.3

CONTROL

Document data sourcing, processing, lineage and approvals

Ensure that data sourcing, selection, processing and lineage are documented, along with how the data was judged fit for purpose and representative, and any approvals and remedial actions.

C.3.3.4

P.4Transparency and explainability

Provide transparency and explainability appropriate to the context and risk materiality of each AI use case, so customers and other stakeholders can assess its risks, reliability and limitations.

RISK

Insufficient transparency about AI use

Customers and other stakeholders are not informed that AI is used, how it affects them, or how to seek redress.

R.4.1

2 Controls

CONTROL

Establish controls for an appropriate level of transparency

Ensure that customers, internal users and other stakeholders receive enough information to assess an AI use case's risks, reliability and limitations.

C.4.1.1

CONTROL

Inform customers of AI use, its consequences and redress channels

Ensure that customers are told when AI is used in a way that affects them, what the consequences of AI-driven decisions are, and how to seek redress, in non-technical language suited to the audience.

C.4.1.2

RISK

Insufficient explainability of AI outputs

Users cannot identify the key drivers or basis of AI outputs where the use case and its risk materiality require it, such as credit or underwriting decisions.

R.4.2

2 Controls

CONTROL

Calibrate transparency and explainability to the use case and risk materiality

Ensure that the level of transparency and explainability reflects the use case and its risk materiality, with higher levels for AI relied on in credit decisioning, insurance underwriting, financial advisory or fund management.

C.4.2.1

CONTROL

Enable users to identify the key drivers of AI outputs

Ensure that input features and their justification are documented and that users can identify the key drivers of an output, through built-in or post-hoc explainability methods.

C.4.2.2

P.5Fairness

Define fair outcomes and identify and mitigate harmful bias and discriminatory outcomes across the AI life cycle, with greater attention to areas such as credit decisioning and insurance underwriting.

RISK

Harmful bias and discriminatory outcomes

AI systematically disadvantages specific customer groups, leading to unfair access to, or denial of, financial products and services.

R.5.1

3 Controls

CONTROL

Define what the FI considers fair outcomes

Ensure that the FI defines what it considers fair outcomes for each relevant AI use case, drawing on frameworks such as the FEAT principles.

C.5.1.1

CONTROL

Identify and mitigate harmful bias across the AI life cycle

Ensure that controls identify and mitigate harmful bias in data and outputs across the life cycle, with greater attention to AI that affects access to financial products, such as credit decisioning or insurance underwriting.

C.5.1.2

CONTROL

Conduct fairness assessments using protected attributes and fairness metrics

Ensure that fairness assessments define the relevant protected attributes and their proxies, measure systematic disadvantage to specific groups with suitable fairness metrics, and document the results and any mitigation.

C.5.1.3

P.6Human oversight

Establish and regularly review appropriate human oversight across the AI life cycle, proportionate to risk materiality and accounting for automation bias and decision fatigue.

RISK

Ineffective human oversight

Those overseeing AI lack clear roles, authority or the means to intervene, outputs are not escalated for review when they should be, and oversight decisions are not recorded or reviewed.

R.6.1

5 Controls

CONTROL

Calibrate human oversight to risk materiality and account for automation bias

Ensure that the degree of human involvement, in or over the loop, matches the AI's objective and risk materiality, and that automation bias and decision fatigue are managed as AI use grows in speed and scale.

C.6.1.1

CONTROL

Assign clear roles and escalation paths for human oversight

Ensure that the people responsible for overseeing each AI use case are named, along with how they escalate issues and who makes the final decision.

C.6.1.2

CONTROL

Give oversight personnel the authority and ability to intervene

Ensure that personnel assigned to oversee AI are competent and have both the authority and the practical means to intervene in, override or stop the AI.

C.6.1.3

CONTROL

Design AI to escalate outputs for human review under predefined conditions

Ensure that AI systems are designed from the outset to support human oversight, including mechanisms that route outputs to a human reviewer when predefined conditions, such as reliability or accuracy thresholds, are met.

C.6.1.4

CONTROL

Record logs and regularly review human oversight decisions and interventions

Ensure that logs are kept across development, deployment, operation, monitoring and incident management, and that oversight decisions, interventions, incidents and near misses are reviewed regularly to assess their effectiveness.

C.6.1.5

P.7Third-party AI management

Ensure that onboarding, development and deployment controls for third-party AI match the risk materiality of the use case. The FI retains primary accountability for its use of third-party AI.

RISK

Inadequate onboarding and testing of third-party AI

Third-party AI is deployed without contractual visibility of AI changes or without testing in the context of the FI's own use cases and data.

R.7.1

3 Controls

CONTROL

Secure contractual visibility of the introduction of and changes to third-party AI

Ensure that contracts with third-party providers give the FI risk-appropriate visibility of when AI is introduced into a service and of subsequent changes, so that relevant controls can be applied.

C.7.1.1

CONTROL

Test third-party AI on the FI's own use cases and data, with compensatory testing

Ensure that third-party AI is tested in the context of the FI's own use cases and data before use, with compensatory testing where the provider's disclosures leave gaps.

C.7.1.2

CONTROL

Document how third-party AI was tested and deemed suitable

Ensure that the FI records how it tested each third-party AI and the basis on which it judged it suitable for use.

C.7.1.3

RISK

Unassessed third-party AI risks

Risks from third-party AI, including opacity, supply chain vulnerabilities, concentration, unannounced changes and vendor failure, are not assessed before onboarding.

R.7.2

9 Controls

CONTROL

Keep residual third-party AI risk within appetite, or limit, suspend or replace it

Ensure that the FI, which retains primary accountability for third-party AI, keeps the residual risk of dependent use cases within risk appetite, and otherwise limits, suspends or replaces the service.

C.7.2.1

CONTROL

Assess third-party AI transparency and independent certifications

Ensure that provider disclosures are reviewed for evidence of appropriate life cycle controls, and that gaps are addressed through independent certifications or assessments (not self-attestations), additional testing or greater human oversight.

C.7.2.2

CONTROL

Assess supply chain risk of third-party and open-source models and dependencies

Ensure that key third-party and open-source models, datasets and dependencies undergo supply chain risk assessment, covering model provenance, training data integrity and known vulnerabilities.

C.7.2.3

CONTROL

Assess concentration risk from over-reliance on key AI providers

Ensure that the FI assesses direct and indirect dependence on a few AI providers for material use cases and manages the resulting concentration risk.

C.7.2.4

CONTROL

Receive notifications of, and assess, changes to third-party AI

Ensure that the FI is notified of updates or changes to third-party AI after deployment and assesses their impact before relying on the changed service.

C.7.2.5

CONTROL

Maintain contingency plans for third-party AI failure or discontinued support

Ensure that contingency plans address failure, unexpected behavior or discontinued vendor support of third-party AI, particularly for use cases with high risk materiality.

C.7.2.6

CONTROL

Set clear provider responsibilities in legal agreements

Ensure that provider agreements cover performance guarantees, data protection, the right to audit, notification when AI is introduced or updated, and the FI's consent before AI is incorporated.

C.7.2.7

CONTROL

Ensure staff awareness and capabilities for procuring and using third-party AI

Ensure that staff involved in procuring, developing, deploying and using third-party AI have the awareness and capabilities to assess and manage its risks.

C.7.2.8

CONTROL

Conduct more detailed assessments of complex third-party AI services

Ensure that more complex third-party AI services, such as AI agents the FI has little experience with, receive more detailed evaluation, testing and cybersecurity checks.

C.7.2.9

P.8Selection

Select AI systems, models and features based on the objectives and risks of the AI use case, and document the considerations.

RISK

Unsuitable selection of AI systems, models or features

Complex or less understood AI is selected without weighing performance against complexity, fairness, explainability and risks such as hallucination and security.

R.8.1

3 Controls

CONTROL

Document selection considerations in proportion to risk materiality

Ensure that the choice of systems, models, techniques and features is documented in proportion to risk materiality, weighing performance against complexity, fairness and explainability, particularly when complex options are chosen over simpler ones.

C.8.1.1

CONTROL

Involve domain experts or users in reviewing the selection

Ensure that subject matter experts or users from the relevant business lines review the selection to confirm it fits the context of use.

C.8.1.2

CONTROL

Weigh the benefits of newer, less understood AI against heightened risks

Ensure that the benefits of newer, less understood AI are weighed against heightened risks such as hallucination, opacity and security, and against the FI's ability to mitigate them.

C.8.1.3

P.9Evaluation and testing

Evaluate and test each AI system or model for reliability and safety before deployment, against clear, measurable thresholds and under conditions ranging from real-world scenarios to edge cases.

RISK

Insufficient pre-deployment evaluation

AI is deployed without evaluation measures and thresholds aligned with its objectives, or without testing of its sensitivity, stability and behavior on edge cases.

R.9.1

3 Controls

CONTROL

Define evaluation measures and acceptable performance thresholds

Ensure that evaluation measures aligned with the AI's objectives are defined, with performance thresholds documented and agreed by business owners, developers and reviewers before deployment.

C.9.1.1

CONTROL

Apply sensitivity, stability and stress testing, including edge cases

Ensure that testing on datasets representative of the FI's context includes out-of-sample or out-of-time testing, sensitivity, stability and subpopulation analysis, stress testing with edge cases and adversarial inputs, error analysis and benchmarking against alternatives.

C.9.1.2

CONTROL

Mitigate overfitting, favoring simpler models unless complexity is justified

Ensure that overfitting is mitigated, especially for complex AI, by favoring simpler models unless added complexity delivers a clear performance uplift, and through regularization, feature selection and cross-validation.

C.9.1.3

RISK

Untested failure modes and guardrails of Generative AI and AI agents

Generative AI and AI agents are deployed without testing key failure modes, such as hallucination, harmful content, data leakage, adversarial attacks and unauthorized actions, or the effectiveness of their guardrails.

R.9.2

6 Controls

CONTROL

Put guardrails in place for identified risks and test their effectiveness

Ensure that guardrails are in place before deployment for risks and limitations found during development, and that testing of Generative AI and AI agents verifies they are effective against the system's key failure modes.

C.9.2.1

CONTROL

Test Generative AI for hallucinations

Ensure that Generative AI outputs are tested for content that is unsupported by the provided sources or factually incorrect.

C.9.2.2

CONTROL

Test Generative AI for toxic, harmful or biased content

Ensure that Generative AI is tested for toxic, harmful, biased or otherwise undesirable content in the FI's context of use.

C.9.2.3

CONTROL

Test Generative AI for data leakage and disclosure

Ensure that Generative AI is tested for leakage or disclosure of confidential, customer or system data, including under adversarial prompting.

C.9.2.4

CONTROL

Test Generative AI for vulnerability to adversarial attacks

Ensure that Generative AI is tested against adversarial attacks such as prompt injection and jailbreaks before deployment.

C.9.2.5

CONTROL

Test AI agents for unauthorized or erroneous actions

Ensure that AI agents are tested for unauthorized or erroneous actions, including whether tool access is limited to the task and whether high-impact actions require human approval.

C.9.2.6

P.10Technology and cybersecurity

Ensure that AI systems are secure and well governed, and review them before deployment so they enter production in a controlled manner.

RISK

Insecure AI deployment environment

AI is deployed in insufficiently hardened or segmented environments, with weak access controls or ungoverned third-party components.

R.10.1

3 Controls

CONTROL

Deploy AI in secured, hardened and segmented environments

Ensure that AI is deployed in secured environments with hardened configurations, network segmentation, and technical controls such as input validation, API authentication, encryption and data loss prevention.

C.10.1.1

CONTROL

Control access to AI components with role-based and privileged access management

Ensure that access to AI components and infrastructure is role-based, protected by multi-factor authentication and privileged access management, and that duties such as training and testing are separated.

C.10.1.2

CONTROL

Govern third-party plugins and APIs and restrict their data exposure

Ensure that third-party plugins, APIs and other components used by AI systems are governed, their data access is restricted, and they are monitored for security, compliance and operational issues such as provider outages.

C.10.1.3

RISK

Inadequate pre-deployment security review

AI enters production without review of its architecture and access controls, or without vulnerability assessment, penetration testing and red teaming against adversarial threats.

R.10.2

2 Controls

CONTROL

Review AI architecture for secure design, segregation and least privilege

Ensure that before go-live the AI architecture, including APIs, plugins and third-party services, is reviewed for secure design, environment segregation and least privilege, and that deployment checklists confirm encryption, data loss prevention, firewalls, access controls and logging are operational.

C.10.2.1

CONTROL

Red team AI systems against adversarial threats and implement safeguards

Ensure that AI systems undergo vulnerability assessment, penetration testing and red teaming against threats such as manipulation, evasion and poisoning, and that safeguards such as input validation, throttling and anomaly detection are in place.

C.10.2.2

P.11Reproducibility and auditability

Document the AI development process in enough detail for an independent reviewer or auditor to understand and potentially replicate it.

RISK

Insufficient development documentation

The development, evaluation and testing of AI cannot be reproduced or audited because documentation is missing or too thin for its risk materiality.

R.11.1

1 Control

CONTROL

Document the AI development process to enable reproducibility and auditability

Ensure that documentation of data sources and quality checks, selection rationale, training procedures (code versions, environments, hyperparameters), evaluation results, explainability and fairness analyses, and key assumptions and limitations lets an independent reviewer replicate the work.

C.11.1.1