From AI Policy to Effective Oversight: How We Are Applying MAS AI Risk-Management Expectations

Responsible AI starts with visible, accountable governance 

Artificial intelligence is increasingly embedded in productivity tools, business applications and third-party services. The governance challenge is therefore no longer limited to approving a small number of specialist models. Organisations must be able to identify where AI is used, understand the associated risks and maintain oversight as technologies and use cases evolve. 

The Monetary Authority of Singapore’s Guidelines on Artificial Intelligence Risk Management for Financial Institutions set out supervisory expectations covering Board and senior-management oversight, AI identification, inventories, risk materiality assessment, lifecycle controls, and the capabilities needed to use AI responsibly. These expectations are intended to be applied proportionately, taking account of the financial institution’s activities, AI usage and risk profile. 

A dual perspective: regulated-entity alignment and enterprise-wide governance 

We approach the Guidelines from two connected perspectives. First, our firm includes a service line regulated by MAS, and our AI governance framework helps align its AI use with applicable supervisory expectations. Second, applying common policies, approval routes, risk assessment, training and monitoring across our organisation promotes consistent internal practice beyond the regulated perimeter. This allows lessons from our implementation to inform both regulatory alignment and practical GRC advisory. 

Our starting point: policy, accountability and practical controls 

We have been strengthening our enterprise-wide AI governance to support responsible, secure and ethical use of AI. This common governance foundation also helps our service line regulated by MAS align its AI practices with relevant MAS expectations. Our implementation experience has included: 

• An Artificial Intelligence Governance, Security and Ethics Policy setting out principles for client trust, accountability, privacy, security, fairness, transparency and regulatory compliance.
• An AI Governance Committee with cross-functional representation and responsibility for risk appetite, approval of higher-risk AI, vendor oversight and escalation of AI incidents or ethical concerns.
• A tiered classification and approval approach that distinguishes low-, medium- and high-risk use cases, with client-data use and agentic AI receiving heightened scrutiny.
• A structured AI risk assessment procedure covering proposal, screening, risk identification, control design, governance review, sandbox validation, deployment and monitoring.
• Employee awareness and foundational training, supported by continuing communications and plans for further scenario-based exercises.
• An initiative to document material AI tools and agents, maintain an AI inventory and assess implementation requests.

These measures were developed for our operating context and are applied as a common internal governance foundation. For our MAS-regulated service line, they support alignment with applicable MAS AI risk-management expectations. Across the wider organisation, they establish consistent expectations for responsible AI use. They also give us practical insight into what it takes to move from policy statements to operating controls. This description is not intended as a certification or independent assurance conclusion. 

Lesson 1: AI identification is harder than it appears 

The first implementation lesson is simple: an organisation cannot govern AI that it cannot see. AI capability may be introduced through approved solutions, embedded features in existing applications, third-party services or employee-led experimentation. The identification process therefore needs clear definitions, ownership, attestation and escalation where it is uncertain whether a use constitutes AI. 

Within the firm, our governance programme includes documenting material AI tools and agents and reviewing requests for new AI implementation. This reflects the MAS expectation for consistent identification across business and functional areas, including internally developed and third-party AI. 

Lesson 2: An inventory must support decisions, not merely record assets 

A useful AI inventory should tell management more than the name of a tool. It should connect the use case to its approved purpose, owner, data, dependencies, lifecycle status, risk classification, review status and supporting records. Those linkages help management understand aggregate exposure, detect use outside approved boundaries and direct attention to higher-risk areas. 

Our internal policy requires approved AI systems to be classified and logged, while the supporting risk assessment procedure records the sponsor, business objective, AI type, data requirements, proposed users and preliminary risk tier. This provides a practical foundation for the broader register and oversight information contemplated by MAS. 

Lesson 3: Risk classification must drive control intensity 

Not all AI use carries the same risk. A general productivity tool operating without client or sensitive organisational data requires a different level of scrutiny from an AI agent that can access systems, process client data or perform actions. Risk assessment should therefore drive the approval route, testing depth, human oversight, monitoring and contingency arrangements. 

MAS identifies impact, complexity and reliance as the minimum dimensions for AI risk materiality assessment, and expects both inherent and residual risk to be considered. Our current tiering approach and likelihood-impact assessment provide a practical base. For organisations aligning more directly with MAS, the next maturity step is to make impact, complexity and reliance explicit in the methodology and to document residual risk acceptance against approved risk appetite. 

Lesson 4: Governance must continue after approval 

Approval is only a point in the lifecycle. Our procedure requires sandbox testing, final sign-off, production deployment through change management, continuous monitoring and periodic reassessment. Our policy also requires reporting of suspected data leakage, policy breaches or abnormal AI behaviour through established incident-management channels. 

This experience reinforces a central MAS message: AI oversight must extend across deployment, monitoring, incidents, changes and eventual retirement. Governance is effective only when it produces evidence, timely escalation and action. 

MAS cross-reference and our implementation examples 

What our experience means for financial institutions 

The practical challenge is not writing another standalone policy. It is connecting AI governance to existing enterprise-risk, technology-risk, cybersecurity, data, privacy, third-party, legal and change-management processes. Financial institutions should be able to show how an AI use case is identified, assessed, approved, recorded, tested, monitored, changed and, where necessary, suspended or retired. 

How we can help 

We bring together Governance, Risk and Controls (GRC) advisory expertise and Technology Consulting capabilities to help organisations establish effective AI governance frameworks, drawing on experience gained across the firm. We can support financial institutions with: 

• MAS AI risk-management readiness and gap assessments
• AI governance frameworks, policies, risk appetite and committee terms of reference
• AI identification processes and inventory design
• Risk materiality methodologies and use-case assessments
• Lifecycle controls, approval gates and evidence requirements
• Third-party AI, technology and cybersecurity risk reviews
• Training for Boards, senior management, control functions and users
• Independent assurance and internal-audit readiness reviews

Our perspective is practical: responsible AI is not achieved by policy alone. It is built through visibility, ownership, proportionate controls and continuous challenge.