MAS AIRG transition plan for agentic AI: October 2027 and 2028

What AIRG is, and where it stands¶

AIRG is the short name for MAS' Guidelines on Artificial Intelligence Risk Management. MAS consulted on a draft from 13 November 2025 (consultation paper P017-2025) until 31 January 2026, and issued the final Guidelines on 7 October 2026. They set out MAS' supervisory expectations in four areas: AI oversight by the board and senior management (Section 3); key AI risk management systems, policies, and procedures for identification, inventory, and risk materiality assessment (Section 4); AI life cycle controls (Section 5); and AI capability and capacity (Section 6).

Paragraph 1.8 sets the timetable: "These Guidelines take effect on 7 October 2027. FIs may meet the expectations set out in Sections 3 to 4 from 7 October 2027, and Section 5 and 6 of the Guidelines by 7 October 2028." The consultation had proposed a single 12-month transition. The final text keeps 12 months for governance and allows 24 months for the controls.

The scope of AI is broad by design. AI means "machine-based systems or models that derive outputs through learned premises such as the data or inputs it receives." The illustrative list covers machine learning, deep learning, natural language processing, computer vision, generative AI, and "AI agents (including multi-agent systems)." Rule-based systems, formulae specified by hand, and robotic process automation without learning fall outside it.

The August 2026 parliamentary reply, given by Deputy Prime Minister Gan Kim Yong as Chairman of MAS, had stated that the Guidelines "apply to all AI use cases by FIs, including agentic AI, and will be finalised soon." The final text confirms the first part. On agents specifically, MAS states that "in 2027, MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful."

Who is in scope, and how proportionality works¶

The Guidelines apply to all FIs as defined in Section 2 of the Financial Services and Markets Act 2022, and to "all forms of AI technologies." They apply on a group basis for locally incorporated FIs under consolidated MAS supervision or owning critical information infrastructure. An FI in a global group may use its group framework where that framework meets the Guidelines, and local senior management must be able to show MAS how it discharges its oversight responsibilities.

Application is proportionate along two axes. The first is the institution: oversight, policies, and procedures scale with the size and nature of activities, the use of AI, and the risk profile. The second is the AI itself: life cycle controls are calibrated to the assessed risk materiality of each use case.

Paragraphs 2.3 to 2.5 define a lighter route. An FI may apply basic AI governance policies if poor performance or unavailability of its AI "is unlikely to have a material adverse impact on the FI, its customers or other stakeholders." The basic set is an accountable senior manager, permitted and prohibited uses with human review requirements, an approved list of AI tools, staff education, regular compliance checks, and periodic review of whether the FI still qualifies. The examples MAS gives are drafting, summarising, internal analysis, and internal search with a human checking the output. An agent that triages AML alerts, screens payments, or drafts credit assessments inside a production workflow does not fit that route.

Paragraph 1.11 explains why agents land at the heavy end. An agent with tool access "could autonomously execute unauthorised or erroneous actions that are not aligned with an FI's business objectives or in a customer's best interests," and a compromised agent could "exfiltrate sensitive data or execute malicious commands at scale."

How AIRG relates to SAFR¶

AIRG and SAFR occupy different layers. AIRG sets MAS' supervisory expectations. SAFR (Safeguards for Agentic Finance at Runtime), the white paper from MAS' BuildFin.ai programme first published in July 2026, describes how agent actions are authorised, how human oversight is activated, and what is recorded at the point of each consequential decision. The August 2026 parliamentary reply described SAFR in those terms and named the Project MindForge AI Risk Management Toolkit as a second industry resource.

The final Guidelines do not mention SAFR. SAFR version 1.1, published on 9 October 2026, states that it "does not constitute regulatory guidance or supervisory expectations, nor does it prescribe or anticipate future directions for such guidance or expectations." SAFR remains voluntary, and MAS has made no commitment to make it mandatory.

SAFR still matters for planning. AIRG tells an FI what its board, control functions, and AI owners must be able to demonstrate. SAFR describes runtime machinery that produces that demonstration for agents: verified agent identity, explicit mandates, a disposition for every proposed action, and an append-only audit log. The full walkthrough is in SAFR, explained, and the build guidance, including a worked mandate and decision record, is in How to implement SAFR.

The AIRG expectations that decide your agent program¶

Five clusters of expectations in the final Guidelines carry most of the weight for agentic AI.

Board and senior management accountability (Section 3). The board, or a committee it delegates, approves the overall governance approach and ensures that AI risks are addressed in the risk appetite framework, "including qualitative statements and quantitative measures for such risks as appropriate." Senior management assigns roles across the three lines, establishes "an internal escalation process for managing material risks and exceptions from AI use, such as AI incidents," and updates the board on material AI risk issues in a timely manner. MAS does not require a dedicated AI committee; existing governance structures may be used.

Identification, inventory, and risk materiality (Section 4). A designated control function owns identification and is "the final arbiter on whether a given use constitutes AI use." The inventory captures purpose, approved scope of use, model type, data used, dependencies, lifecycle status, risk materiality rating, review status, and owners. For agents, footnote 25 adds "agent-specific identifiers, information on the tools and systems the agent can access, its components, and the guardrails imposed to manage risk." Materiality assessments cover at least impact, complexity, and reliance, and reliance includes "the extent of autonomy granted to the AI system or model and the degree of human involvement or oversight."

Life cycle controls (Section 5). The life cycle runs from inception to retirement, adapted from ISO/IEC 22989. Controls span data management, transparency and explainability, fairness, human oversight, third-party AI, selection, evaluation and testing, technology and cybersecurity, reproducibility and auditability, pre-deployment review, monitoring, change management, and retirement. High-materiality use cases need formal independent validation before deployment and contingency plans with fallback options; for AI with kill switches, "clear contingency activation protocols should be in place and tested regularly."

Human oversight (5.9). Clear roles with escalation and decision-making processes, personnel with "the necessary authority and ability to intervene," systems designed with mechanisms to escalate outputs for human review "where pre-defined conditions (e.g., on reliability and accuracy) are met," and documented review of oversight decisions and interventions, including near misses. The Guidelines name automation bias and decision fatigue as oversight risks.

Third-party parity (5.10–5.11). "The decision to onboard and use third-party AI is ultimately a decision of the FI, and the FI retains primary accountability." FIs should test third-party AI in their own use cases with their own data, perform compensatory testing where disclosure falls short, secure contractual visibility over the introduction of AI and later changes, assess supply chain and concentration risks, and consider limiting, suspending, or replacing a service whose residual risk exceeds appetite. A vendor agent embedded in your workflow is your AIRG problem.

The transition plan: October 2026 to October 2028¶

The plan below sequences the two deadlines for an FI running agents in production or bringing them there. The sequencing logic follows the Guidelines: governance, inventory, and materiality first, because they apply first and everything downstream depends on them; runtime controls for high-materiality agents next, because they take longest to build and produce the evidence the 2028 expectations consume; validation, monitoring, and assurance last, because they test what the earlier quarters built.

Two standing disciplines run across all eight quarters. Evidence retention: from the first quarter, keep the records an independent reviewer would need, covering development documentation, validation reports, oversight decisions and interventions, monitoring results, incidents, and change records, with retention rules settled once in policy. Board reporting: senior management updates the board on material AI risk issues throughout, with the formal cadence fixed before the first deadline.

One planning assumption: MAS intends to consult in 2027 on additional agentic AI guidance. Build the agent controls so that a new expectation adds a policy or a record field without redesigning the execution path.

Runtime controls and the authorization of each agent action¶

The hardest AIRG expectations for agents assume the FI can account for what the AI did. Monitoring should cover, where relevant, "information flow and decision-making paths across workflows that use AI, such as reasoning processes, actions taken, tools used." Human oversight requires personnel with the authority and ability to intervene and documented oversight decisions. Reproducibility and auditability require records an independent reviewer can work from. For a static model, logging and periodic review can meet these. For an agent that chooses its next action at runtime, they require a control point in the execution path.

A runtime authorization checkpoint is that control point. Each proposed agent action is intercepted before execution and resolved against approved policy into one of four outcomes: allow, warn, require approval, or block. The SAFR specification formalises the same pattern as its four dispositions and adds the property that matters for multi-step agents: authorization at one step carries no authority into the next, so step three of a workflow is evaluated as independently as step one.

This structure answers the AIRG expectations directly. The require-approval path gives human oversight the escalation mechanism paragraph 5.9 describes, with a named reviewer, a decision, and a record before the action executes. The decision log gives monitoring its per-action trail of what was proposed, which policy applied, and what happened. The block outcome plus a kill switch gives the contingency expectation its enforcement mechanism. The same checkpoint in front of a vendor agent supports third-party parity without changes to vendor code. KLA Control Plane implements this pattern, with the four SAFR dispositions mapped one-to-one to allow, warn, require_approval, and block; the component mapping is on the SAFR implementation page.

We learned one calibration lesson in our own test tenants. The first AML policy we seeded fell back to block when no rule matched. Every unforeseen case stopped, no request reached a reviewer, and to the compliance user the gate looked broken. In the payment-release policy we built later, the no-match default is require approval, so a case the rules did not anticipate reaches a person with authority to decide. For agents in scope of paragraph 5.9, that default is the one to start from.

The retention half matters as much as the enforcement half. A checkpoint that decides but does not durably record fails the auditability expectation; retention that captures logs without a decision structure fails the oversight one. The record for each consequential action should hold the proposed action, the policy version evaluated, the outcome, the human decision where one was required, and the execution result, kept for the period your record-keeping policy sets and retrievable when a validator or MAS asks.

What to do this quarter¶

Three moves fit inside the quarter to December 2026. First, run the gap assessment: score your current state across inventory, mandates, controls, dispositions, escalation, and evidence with the SAFR Readiness Checklist. Second, brief the board: Section 3 lands on them from October 2027, and the SAFR Executive Briefing is written for that audience. Third, pick the first high-materiality agent and put a runtime authorization checkpoint in front of it, so the 2028 controls start from a working reference implementation.