Do you know all the AI tools your organization is using?
MAS Just Started the Clock on AI. Do You Know What You’re Running?
On 7 October, the Monetary Authority of Singapore published its Guidelines on Artificial Intelligence Risk Management. They take effect on 7 October 2027, with governance, identification and inventory expectations first, and full life cycle controls by October 2028.
That sounds like runway. It isn’t. The first thing MAS expects is something most institutions cannot do today: say where all of their AI is.
This is a business problem, not an IT problem
Read the guidelines closely and you’ll notice who they put on the hook. The board approves the AI risk governance approach and the risk appetite. Senior management implements it. The business lines, as the first line of defence, assess the risks of their own AI use cases and apply human oversight.
If your function uses AI, you own part of this risk. A compliance policy filed by someone else won’t discharge it.
Four implications leaders should take seriously
-
1
You can’t govern what you haven’t found.
MAS expects FIs to identify AI use consistently across the organisation, including AI embedded in services from material third-party providers. It also expects residual risk from AI you couldn’t identify, such as shadow AI or undisclosed vendor features, to stay within risk appetite. “We didn’t know” is not a control.
-
2
The board owns AI risk appetite, and it should be measurable.
Risk appetite must explicitly cover AI, with qualitative statements and, where appropriate, quantitative measures. MAS gives examples such as thresholds on AI incidents or the number of material use cases that depend on a single provider. Boards are also expected to understand AI well enough to challenge management. A one-off briefing won’t meet that bar.
-
3
Your vendor’s AI is your accountability.
MAS is blunt that the decision to use third-party AI belongs to the FI, and so does primary accountability for its impact. That means contracts that give visibility over AI introduction and updates, testing the vendor’s AI on your own use cases, concentration risk assessments, and an exit plan. If your vendor quietly switches on an AI feature, that is now your governance event.
-
4
AI agents are in scope, and they change the risk.
The guidelines call out agents with access to tools and systems, which can take unauthorised or erroneous actions at scale. Expect to record what an agent can access, monitor what it does and why, and for high-risk uses, have a tested kill switch and fallback plan.
The proportionality trap
MAS applies the guidelines proportionately. Low-materiality uses can follow a basic governance track, and the examples include AI image generators for marketing materials and AI-drafted customer emails.
Before anyone celebrates, read the conditions. Humans must review outputs. Confidential or client information must stay out of public AI tools. There must be an approved tool list, staff education, regular compliance checks, and periodic review of whether the use still qualifies. Marketing teams using AI at speed will struggle to evidence that unless someone builds it deliberately and owns the journey as well as decisoning.
Where institutions will get caught out
- Policy without proof. A well-written AI policy is not an evidenced control. Supervisors will ask how you know it’s working.
- Group framework complacency. Group frameworks are acceptable if they meet MAS’s expectations, but local senior management remains accountable and must be able to show MAS how they exercise oversight.
- Marking your own homework. Risk materiality should be arbitrated by an independent control function, not by the team that built the use case.
- Inventory as a spreadsheet exercise. The inventory must capture purpose, scope, data, dependencies, risk rating and ownership, and stay current as AI is added, changed and retired.
A practical 12-month path to October 2027
-
Quarter 1
Find it.
Map AI use across the business, including vendor-embedded and shadow AI. Name the control function that owns identification.
-
Quarter 2
Record it.
Build an AI inventory with the attributes MAS describes, linked to your existing data and third-party registers.
-
Quarter 3
Rate it.
Assess each use case on impact, complexity and reliance, both inherent and residual, and identify the high-materiality cases that will need independent validation, monitoring and contingency plans.
-
Quarter 4
Govern it.
Set AI risk appetite with the board, define accountability and escalation, put the basic-track policies in place for lower-risk uses, and train leaders to challenge.
Year two is where the life cycle controls come in for the use cases you rated high: testing, validation, monitoring, change management and fallback.
How Mad About Marketing Consulting can help
We’re a marketing, CX and AI transformation practice, so we start where the guidelines bite hardest: in the business.
- AI discovery sprintFind and catalogue AI use across functions, with particular depth on marketing, customer experience and customer-facing channels, where AI adoption is fastest and least governed.
- Inventory and materiality frameworkDesign the inventory and the impact, complexity and reliance assessment so they work for business owners, not just risk teams.
- Leadership and board readinessBrief and equip executives to set measurable AI risk appetite and ask the right questions.
- Responsible AI use in marketing and CXBuild the approved-tools, human-review and data-handling guardrails that let teams keep their speed and still stand up to scrutiny.
- Change management and capability buildingBecause the hardest part of any regulation is getting people to actually change how they work.
If you want to know where you stand against the October 2027 milestone, start with a readiness check.
Contact us to discuss