Notes from the Asia-Pacific region: Singapore charts course for AI risk management in financial services

Few regulators have swum as steadily in AI governance waters as the Monetary Authority of Singapore. 

On 7 Oct., the MAS issued its Guidelines on Artificial Intelligence Risk Management for Financial Institutions, setting out detailed supervisory expectations for how financial institutions should govern, develop, deploy and monitor AI. 

The implementation timeline offers some breathing room, but impacted firms should not mistake it for an invitation to delay preparation. Governance and oversight requirements take effect from 7 Oct. 2027, with the more operational life cycle and capability requirements following beginning 7 Oct. 2028. Those dates may seem far offshore today, but will no doubt arrive soon enough, like waves in a roaring tide.

The MAS casts a broad net in defining AI, which under its definition encompasses machine learning systems, foundation models, large language models, generative AI applications and AI agents. 

As generative AI and agents in particular can operate in less transparent and more dynamic ways, governance frameworks must be correspondingly rigorous and adaptable. 

By contrast, rule-based systems and other deterministic automation that do not learn or adapt generally float outside the scope of the guidelines.

The guidelines adopt a proportionate, risk-based approach, by distinguishing between AI use cases based on their potential impact. Organizations can apply a simplified set of governance policies and procedures where an AI use case is on the shallow end and unlikely to have a material adverse impact. 

Institutions are still, however, expected to maintain oversight and accountability, establish permitted and prohibited uses, maintain an inventory of AI that is deployed, and conduct periodic reviews and trainings. 

For use cases that may have a material impact, the MAS expects a more comprehensive set of governance and risk-management measures, calibrated to the size and complexity of the institution, the nature of the use case and the level of risk involved.

Ultimate responsibility for AI risk management is embedded at the top. Rather than sitting with a standalone compliance function, it is anchored with senior management, who must keep the vessel on course day to day, implementing the framework, including escalation and incident management processes, and resource allocation. 

A key operational expectation is that organizations maintain clear and comprehensive records of AI deployment; specifically identifying AI use cases, keeping an AI inventory, and conducting a risk materiality assessment. The guidelines also set out detailed expectations across the whole life cycle. 

• Data management: If the data gauge is faulty, then the downstream quality also sinks.
• Transparency, explainability and fairness: Institutions should be able to understand, explain and justify AI outputs where they affect individuals. 
• Human oversight: A human "in the loop" who is simply swept along by the system's outputs provides no real safeguard. Reviewers should be empowered to challenge, override or halt AI-driven decisions when appropriate. 
• Selection, evaluation and testing.
• Technology and cybersecurity: Threat actors circle AI systems like sharks, and the defenses should be built accordingly.
• Post-deployment monitoring and change management: Models are living systems that change with the waters around them.
• Retirement and decommissioning: Systems should not be left to rust on the ocean floor, still holding onto data that ought to have been deleted.

The guidelines place significant emphasis on third-party AI risk management. The MAS is clear that outsourcing the development, deployment or hosting of AI systems does not diminish the institution's responsibility for the risks arising from their use. A handful of whale-sized model providers may dominate the market, but accountability stays with the user.

For privacy professionals, the supply chain and contractual points are the shoals to watch most closely. Questions of whether a vendor, or its upstream model providers, may retain, access or use customer data to train or improve models sit squarely at the junction of AI governance and data protection.

While the guidelines center around the financial sector, digital responsibility professionals alike have much to learn by digging deep, to avoid a scramble for the surface later, as more rules wash ashore. 

The guidelines provide a useful mariner's chart to digital governance professionals across sectors, and serve as a map of the rocks, reefs and currents that any organization deploying AI at scale will eventually need to navigate.