Services
MAS AI risk advisory
MAS has given every financial institution in Singapore until 7 October 2027 to identify and risk-rate every AI use case it runs, including AI inside the services of its material third-party providers. Epiphyte runs the inventory with your teams.
What we do
Identification. Across business units and vendors, including AI in services from material third-party providers (para 4.2) and SaaS not sold as AI that contains AI features (footnote 21).
The rating. Each use case rated on impact, complexity and reliance (para 4.12). Residual materiality sits within your risk appetite before deployment (para 4.11), and a designated control function approves the rating (para 4.13).
Gaps by paragraph. The open gaps against the Guidelines, listed by paragraph, and the work to close them.
The board's numbers. AI risk sits in the board's risk appetite (para 3.4(b)). Footnote 18 names the measures: number and financial impact of AI incidents, material AI use cases dependent on a single provider, and material AI use cases breaching performance thresholds.
For AI vendors. Under para 5.10 your customers test your AI in their own use cases, with their own data. Vendors that arrive with their own test evidence shorten that process. Epiphyte prepares it.
Two dates
MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to all financial institutions (para 1.5), and para 1.8 sets two dates.
7 October 2027. Sections 3 and 4: board-approved AI governance, AI in the risk appetite, and a risk-rated inventory of every AI use case.
7 October 2028. Sections 5 and 6: lifecycle controls, including testing, validation, monitoring, third-party AI, change and decommissioning.
The 2027 rating sets the 2028 workload.
What counts as AI
Footnote 6: machine learning, natural language processing, computer vision, generative AI and AI agents. Rule-based systems, manually specified formulae and fixed-instruction RPA are not ordinarily in scope. One test: was the logic learned from data, or written by a person?