MAS Consultation Paper P017-2025 — Consultation Paper on Guidelines on Artificial Intelligence Risk Management

Establish what the document is before citing anything from it. MAS published Consultation Paper P017-2025, *Consultation Paper on Guidelines on Artificial Intelligence Risk Management*, in November 2025; the consultation closed on 31 January 2026; the Guidelines are not finalised. MAS’s written reply to a parliamentary question for the sitting of 5 August 2026 says they apply to all AI use cases by financial institutions, agentic AI included, and will be finalised soon. The paper proposes a twelve-month transition following issuance, which is a proposal and not a grant. So the verbs matter: MAS proposes, the draft Guidelines state. There is a second trap in the citation itself. The document carries two numbering schemes — the consultation paper’s own paragraphs, and the draft Guidelines at section 6, which restart at 1 and run through their own numbering to an Annex. A bare "paragraph 4.10" is therefore ambiguous: in the draft Guidelines it is the human-oversight paragraph, while the consultation paper’s 4.7 is the transition proposal. Secondary commentary conflates the two routinely, and a page inheriting that error cites a paragraph saying something else.

There is no agentic chapter, and institutions looking for one conclude that MAS has not addressed agents. The draft Guidelines name them in four places — paragraph 1.3, stating that the expectations apply as institutions deploy AI and AI technologies including generative AI and newer developments such as AI agents; paragraph 1.10; paragraph 4.15, asking that evaluation and testing of newer developments cover their key failure modes; and a footnote to paragraph 4.12 on third-party agents — plus autonomy at paragraph 3.10(c). Only 1.10 is substantive, and it is worth reading as written: an AI agent with access to tools could autonomously execute actions not aligned with an institution’s business objectives or a customer’s best interests, through a divergence between human goals and how the agent translated those goals into actions; and compromised agents with access to internal systems and external tools could exfiltrate sensitive data or execute malicious commands at scale. An institution cannot scope an agentic gap analysis by searching the text for *agent*. The whole of section 4 applies.

The proposal with the most consequence for an agentic deployment sits in none of those paragraphs. Draft Guidelines paragraph 3.10(c) puts *Reliance* into the risk-materiality assessment as a dimension it must minimally cover — the level of autonomy granted to the system or model, the degree of human involvement or oversight in the process it supports, and the availability of alternatives. Risk materiality then drives everything downstream: how intensively lifecycle controls apply, whether formal independent validation is required before deployment, how often re-validation happens, how closely the system is monitored. Under the draft, raising an agent’s autonomy is a change to its supervisory classification. Very few institutions run a materiality methodology in which autonomy is a scored input, and the test is blunt — score a use case, raise its autonomy, and see whether the number moves. Where it does not, the methodology does not implement 3.10(c) whatever the policy says it does.

Two structural proposals are widely read as one rule each when they are two. Validation is tiered. High risk materiality would get formal independent validation before deployment, by people with the necessary expertise and objectivity who are independent of the development and deployment teams and able to provide effective challenge, covering conceptual soundness, data inputs, implementation integrity, evaluation measures and thresholds, explainability and fairness, and assumptions and limitations — the evidence side of which is set out under stress testing agentic systems. Everything else would get documented review of another kind, such as peer review by qualified individuals not involved in development or deployment — and a footnote closes the obvious gap by extending "not involved" to ongoing deployment as well. The proportionality floor is also lower than firms expect: every institution, without qualification, would hold basic policies naming a senior-management responsible person. The Annex examples of AI *integrated as part of business processes* are unglamorous — an internal helpdesk chatbot, document data extraction — and turn on a dependency test rather than a risk one, so a productivity tool nobody governs may cross the line.

Two orientation points close this out. The draft is not framed in provider and deployer terms at all, which is genuine friction with the Union vocabulary rather than something to paper over: it catches an institution for what it is, where the EU regime catches a system for what it does. A credit-scoring agent is inside the high-risk perimeter through Article 6 and Annex III whoever runs it, and would be inside the MAS perimeter because a regulated institution runs it, whatever it does. A firm subject to both is scoping against two gateways over an overlapping population, and the deeming provisions that partly reconcile them are set out on the Article 26 page. Second, the draft points to the IMDA agentic framework, at its own footnote 3 and at paragraph 2.7 of the consultation paper: the two Singapore instruments are meant to be read together, so the envelope work in bounding an agent’s authority is not a separate exercise from this one.