MAS finalises its AI Risk Management Guidelines: what fund managers need in place by October 2027

On 7 October 2026, the Monetary Authority of Singapore issued its final Guidelines on Artificial Intelligence Risk Management. It also published its response to the feedback on the November 2025 consultation. The Guidelines apply to all financial institutions, including licensed fund managers, and to all forms of AI.

That last point matters most for smaller firms. "AI" here doesn't only mean a model you built. It includes AI inside the software you buy, the tools your staff use on their own, and the services your vendors run for you.

Two dates to plan around

• 7 October 2027: board and senior management oversight, identifying where AI is used, keeping an AI inventory, and assessing the risk materiality of each use case (Sections 3 and 4).
• 7 October 2028: lifecycle controls, such as testing, monitoring and change management, and the capability and capacity to manage AI risk (Sections 5 and 6).

MAS expects firms to apply appropriate controls to high-risk use cases as soon as possible, rather than waiting for the second date.

You probably use more AI than you think

For a typical boutique manager, the first inventory often includes:

• writing and email assistants built into office software;
• meeting transcription and note-taking tools;
• research summarisation tools used by the investment team;
• AML name screening and onboarding checks run by a vendor;
• AI features added quietly to CRM, portfolio or reporting systems;
• general AI chat tools that staff use without formal approval.

The Guidelines expect firms to look for all of these, including AI embedded in their providers' services.

What changed from the consultation

• Proportionality now depends on impact, not firm size. Basic AI policies and procedures may be enough where poor performance or failure of the AI is unlikely to have a material adverse impact on the firm, its customers or other stakeholders. That test has to be reviewed over time, not decided once.
• No dedicated AI committee is required. Existing governance structures can be used, as long as they give a consolidated view of AI risk.
• A two-stage timeline. The consultation proposed a single 12-month transition. The final Guidelines give 12 months for oversight, inventory and materiality, and 24 months for lifecycle controls and capability.

What a smaller fund manager should do in the next 90 days

1. Name an owner. Decide which function oversees AI risk and acts as the final judge of what counts as AI. In a small firm this is usually compliance or risk. Tell the board.
2. Build the inventory. Ask staff what they use, check vendor contracts and product release notes, and record each use case: what it does, who uses it, what data it touches and who provides it.
3. Rate each use case. The Guidelines use three dimensions: impact, complexity and reliance. Assess each use case before controls (inherent) and after them (residual), and keep your reasoning as evidence.
4. Decide which track applies. If no use case could cause material harm, document why basic policies are enough, and set triggers to review that decision. If one use case could cause material harm, the fuller framework applies.
5. Look hard at vendors. Accountability for third-party AI stays with your firm. Ask for independent assurance, such as audit reports or certifications. Supplier self-attestations are not enough. Seek contract terms that tell you when AI is introduced or changed. Where possible, test vendor tools on your own use cases and data.
6. Write or update your AI policy. The board, or a committee it delegates, approves the approach and the firm's AI risk appetite.

Done well, steps 1 to 6 put most smaller firms in a good position for October 2027. They also make the 2028 work on lifecycle controls easier to plan, because you will know which use cases need it.

Where RegRails.ai fits

RegRails.ai uses AI to extract obligations from MAS instruments and to assess how well a firm's policies cover them. That makes us a third-party AI provider to our customers, and we hold ourselves to the same standard. Every output is anchored to MAS's own wording. A person approves library content before firms see it. Scores are calculated in code from transparent criteria, not by a model's judgement alone. We provide a vendor pack so customers can include RegRails.ai in their own AI inventory and third-party assessments.

We are adding the final Guidelines to the RegRails.ai library as an upcoming instrument, effective 7 October 2027. Firms will be able to check their AI governance policy against them, or draft one, well before the first deadline.

This article is general information, not legal advice. Read the Guidelines and MAS's response to feedback for the full requirements.