MAS and AI in financial institutions

Most writing about MAS and AI is about a document that has not been issued. The Guidelines on AI Risk Management are a consultation paper: published in November 2025, consultation closed on 31 January 2026, and as things stand no firm owes anything under them. That has produced a strange gap, because a great deal genuinely does apply already — and it applies through instruments that were written for technology risk, outsourcing and conduct rather than for AI, which is exactly why they are easy to overlook.

The distinction that organises these pages is the one MAS itself draws. A Notice is legally binding and issued under a named statutory power; a Guideline sets out supervisory expectations and non-compliance bears on a firm’s risk assessment rather than attracting a penalty directly; an information paper records what MAS observed across the industry and obliges nobody. The FEAT Principles say of themselves that they are not intended to be prescriptive. Reading these pages, the first thing to settle on any page is not what the instrument asks for but what class it belongs to, because the answer changes what happens if you do not do it.

Two traps are worth naming at the outset. The sectoral Notices on technology risk management that most commentary still cites were cancelled in May 2024 and replaced by a sector-segmented series, so a firm working from an older reference is working from an instrument that no longer exists; the same happened to the outsourcing guidelines in December 2024, which became a binding Notice plus a Guideline. And where these pages describe the proposed Guidelines, they say proposed — the draft is genuinely useful as a statement of where supervision is heading, and it is not a duty.