Skip to main content
Submit RFP

      The Monetary Authority of Singapore (MAS) has released the final Guidelines on Artificial Intelligence Risk Management (AIRG), establishing supervisory expectations for the governance, risk management and control of AI across financial institutions. The Guidelines provide greater clarity on AI governance, AI risk management systems, AI lifecycle controls, and organisational capabilities required to support the responsible adoption of AI.

      As AI adoption continues to accelerate across the financial sector, including the use of Generative AI and Agentic AI, financial institutions are expected to strengthen their governance frameworks and ensure that appropriate controls are implemented throughout the AI lifecycle.

      Key Areas of Focus Under the Final AIRG

      assured_workload

      Governance and Accountability

      MAS expects financial institutions to establish clear governance structures, roles and responsibilities for AI risk management. This includes Board and Senior Management oversight, AI governance frameworks, accountability mechanisms, and effective coordination across the organisation. The final AIRG also places greater emphasis on local management accountability and oversight.

      task

      AI Identification, Inventory and Risk Materiality Assessment

      Financial institutions are expected to establish processes to identify AI use cases, maintain AI inventories, and perform risk materiality assessments based on considerations such as impact, complexity and reliance. These processes form the foundation for the application of proportionate governance and lifecycle controls.

      tenancy

      AI Lifecycle Controls

      The final AIRG introduces expectations for controls across the AI lifecycle, including:

      • Data Management
      • Transparency and Explainability
      • Fairness
      • Human Oversight
      • Third-Party AI Management
      • Selection
      • Evaluation and Testing
      • Technology and Cybersecurity
      • Reproducibility and Auditability
      • Monitoring and Review
      • Change Management

      These controls are expected to be applied in a manner commensurate with the risk materiality of the AI use case.

      extension

      Third-Party AI Management

      The final AIRG provides greater direction on the management of AI-specific cybersecurity risks as well as the governance of third-party AI solutions. Financial institutions remain accountable for AI services provided by external vendors and are expected to assess and manage risks arising from AI supply chains, model dependencies, security threats, and operational resilience considerations.

      window

      Emerging Technologies and Agentic AI

      The final AIRG explicitly recognises emerging AI technologies, including AI agents and multiagent systems. As the industry explores increasingly autonomous AI capabilities, financial institutions will need to consider how governance, oversight, accountability and control mechanisms can evolve to support these technologies while remaining aligned with their risk appetite and regulatory obligations.

      Learn how KPMG can help your business.

      Contact us

      How KPMG Can Support Your AIRG Journey

      KPMG has been actively supporting financial institutions on AI governance, AI risk management, AI security and emerging technology governance initiatives. Throughout the AIRG consultation period, we engaged with more than 60 financial institutions across Singapore to discuss the proposed AIRG and understand industry perspectives, implementation considerations and emerging challenges.

      Following the release of the final AIRG, we have undertaken a detailed review of the Guidelines and their implications for financial institutions. Drawing on our experience supporting AI governance, cyber security, data governance and emerging technology programmes, we are helping organisations assess how the final AIRG may impact their governance frameworks, operating models, control environments and implementation priorities.

      Whether organisations are at the early stages of understanding the new requirements or are preparing for implementation, it is important to establish a clear view of current-state capabilities, potential gaps, and the practical steps required to align with supervisory expectations.

      We are currently meeting with financial institutions to discuss:

      • Key implications of the final AIRG
      • Emerging industry perspectives and considerations
      • AI security and third-party AI risk considerations
      • GenAI and Agentic AI governance considerations
      • AIRG implementation priorities and next steps

      Contact us to arrange a complimentary AIRG executive briefing, discuss the practical implications of the final AIRG for your organisation and how we can assist in developing a robust compliance roadmap.