The MAS Guidelines make clear that responsible AI requires more than a policy. Drawing on our own implementation experience, this article explores how governance structures, an AI inventory, risk assessment and continuous awareness can turn high-level principles into practical oversight.
Artificial intelligence is increasingly embedded in productivity tools, business applications and third-party services. The governance challenge is therefore no longer limited to approving a small number of specialist models. Organisations must be able to identify where AI is used, understand the associated risks and maintain oversight as technologies and use cases evolve.
The Monetary Authority of Singapore’s Guidelines on Artificial Intelligence Risk Management for Financial Institutions set out supervisory expectations covering Board and senior-management oversight, AI identification, inventories, risk materiality assessment, lifecycle controls, and the capabilities needed to use AI responsibly. These expectations are intended to be applied proportionately, taking account of the financial institution’s activities, AI usage and risk profile.
We approach the Guidelines from two connected perspectives. First, our firm includes a service line regulated by MAS, and our AI governance framework helps align its AI use with applicable supervisory expectations. Second, applying common policies, approval routes, risk assessment, training and monitoring across our organisation promotes consistent internal practice beyond the regulated perimeter. This allows lessons from our implementation to inform both regulatory alignment and practical GRC advisory.
We have been strengthening our enterprise-wide AI governance to support responsible, secure and ethical use of AI. This common governance foundation also helps our service line regulated by MAS align its AI practices with relevant MAS expectations. Our implementation experience has included:
These measures were developed for our operating context and are applied as a common internal governance foundation. For our MAS-regulated service line, they support alignment with applicable MAS AI risk-management expectations. Across the wider organisation, they establish consistent expectations for responsible AI use. They also give us practical insight into what it takes to move from policy statements to operating controls. This description is not intended as a certification or independent assurance conclusion.
The first implementation lesson is simple: an organisation cannot govern AI that it cannot see. AI capability may be introduced through approved solutions, embedded features in existing applications, third-party services or employee-led experimentation. The identification process therefore needs clear definitions, ownership, attestation and escalation where it is uncertain whether a use constitutes AI.
Within RSM Stone Forest, our governance programme includes documenting material AI tools and agents and reviewing requests for new AI implementation. This reflects the MAS expectation for consistent identification across business and functional areas, including internally developed and third-party AI.
A useful AI inventory should tell management more than the name of a tool. It should connect the use case to its approved purpose, owner, data, dependencies, lifecycle status, risk classification, review status and supporting records. Those linkages help management understand aggregate exposure, detect use outside approved boundaries and direct attention to higher-risk areas.
Our internal policy requires approved AI systems to be classified and logged, while the supporting risk assessment procedure records the sponsor, business objective, AI type, data requirements, proposed users and preliminary risk tier. This provides a practical foundation for the broader register and oversight information contemplated by MAS.
Not all AI use carries the same risk. A general productivity tool operating without client or sensitive organisational data requires a different level of scrutiny from an AI agent that can access systems, process client data or perform actions. Risk assessment should therefore drive the approval route, testing depth, human oversight, monitoring and contingency arrangements.
MAS identifies impact, complexity and reliance as the minimum dimensions for AI risk materiality assessment, and expects both inherent and residual risk to be considered. Our current tiering approach and likelihood-impact assessment provide a practical base. For organisations aligning more directly with MAS, the next maturity step is to make impact, complexity and reliance explicit in the methodology and to document residual risk acceptance against approved risk appetite.
Approval is only a point in the lifecycle. Our procedure requires sandbox testing, final sign-off, production deployment through change management, continuous monitoring and periodic reassessment. Our policy also requires reporting of suspected data leakage, policy breaches or abnormal AI behaviour through established incident-management channels.
This experience reinforces a central MAS message: AI oversight must extend across deployment, monitoring, incidents, changes and eventual retirement. Governance is effective only when it produces evidence, timely escalation and action.
|
MAS cross-reference |
MAS expectation |
Our implementation example |
|
MAS 2.2-2.6 |
Board and senior-management oversight, risk appetite, coordination, escalation and capability. |
Enterprise-wide AI Governance Committee, defined approval and escalation responsibilities, annual policy review and training; common governance supports the MAS-regulated servie line’s alignment. |
|
MAS 3.2-3.3 |
Consistent AI identification supported by clear roles, documentation and review. |
Our processes review AI implementation requests and document material AI tools and agents across the firm, including use relevant to our MAS-regulated service line. |
|
MAS 3.4-3.7 |
Accurate, current AI inventory with ownership, risk and lifecycle information. |
Our approved-use logging and proposal fields cover purpose, data, users, ownership and risk tier, providing a consistent baseline for our regulated service line and wider organisation. |
|
MAS 3.8-3.11 |
Materiality assessment covering impact, complexity and reliance; inherent and residual risk. |
Tiered classification plus likelihood-impact risk analysis and control design; opportunity to make the three MAS dimensions more explicit. |
|
MAS 4.1-4.4 |
Lifecycle ownership, proportionality and contingency planning for high-risk AI. |
Six-stage assessment workflow, sandbox validation, final approval, monitoring and agentic-AI kill-switch controls. |
|
MAS 5.1-5.2 |
Competence, conduct, training and adequate resources. |
Foundational AI awareness training and continuing governance and awareness programme. |
The practical challenge is not writing another standalone policy. It is connecting AI governance to existing enterprise-risk, technology-risk, cybersecurity, data, privacy, third-party, legal and change-management processes. Financial institutions should be able to show how an AI use case is identified, assessed, approved, recorded, tested, monitored, changed and, where necessary, suspended or retired.
We bring together Governance, Risk and Controls (GRC) advisory expertise and Technology Consulting capabilities to help organisations establish effective AI governance frameworks, drawing on experience gained across the firm. We can support financial institutions with:
Our perspective is practical: responsible AI is not achieved by policy alone. It is built through visibility, ownership, proportionate controls and continuous challenge.