Making AI Work Responsibly: What the New MAS Guidelines Mean for the Insurance Industry

Artificial intelligence is rapidly moving from experimentation to implementation across the insurance industry at a global level.

It is already transforming how many of our clients work from helping them with analysing vast volumes of data, assessing risk to support underwriting decisions and streamlining claims management and improving stakeholder engagement. AI is reshaping core insurance functions and creating new opportunities for efficiency, innovation and growth.

Against this evolving landscape, the Monetary Authority of Singapore (“MAS”) has issued new Guidelines on Artificial Intelligence Risk Management (the “Guidelines”) on 7 October 2026 which sets out its supervisory expectations relating to AI risk management in Singaporean financial institutions. The aim of the Guidelines is to make sure AI is used responsibly, with clear accountability, controls that suit the level of risk and ongoing oversight.

The application of the Guidelines to different entities within the Singaporean insurance industry will vary depend on an entity’s regulatory status and circumstances. Even so, whether or not the Guidelines strictly apply to you, they provide good guidance whether you are an insurer, reinsurer, broker, intermediary, Insurtech, or a service provider supporting regulated financial institutions. Put simply, AI is more than a technology purchase. To get the most from it, an organisation needs to know where it is being used, what risks it entails and whether your controls continue to work as the technology develops.

What the Guidelines cover

The Guidelines set out in a clear structured way how MAS expects financial institutions ("FIs") to manage AI risk. They apply to conventional AI, generative AI, and newer tools such as AI agents. Where an FI is part of a global group, the FI may take guidance from or leverage their group’s AI risk management frameworks, as long as those frameworks meet the expectations set out in the Guidelines. 

At a high level, the key expectations include:

• Board and senior management oversight.
• Having policies / procedures in place to assess the risk materiality of AI use.
• Application of robust AI life cycle controls.
• Having the necessary human and technological resources to implement and use AI.

The specific matters dealt with in the Guidelines include the following:

• who is accountable for AI;
• how AI use should be identified and recorded;
• how the risks of each use case should be assessed;
• what controls should apply before and after deployment; and
• whether you have the people, skills and infrastructure to manage those risks.

The Guidelines build on existing law and regulatory guidance in Singapore rather than replacing it and follow an industry consultation process which the MAS ran from November 2025 – January 2026. An FI’s current obligations on fair dealing, data protection, technology risk, and third-party arrangements continue to apply when using AI. 

The Guidelines take effect on 7 October 2027, which gives the Singaporean insurance sector time to prepare, particularly those who are part of global groups who are deploying AI across their business and adopting a common AI risk management framework across jurisdictions which will now need to meet the MAS expectations. Financial institutions may meet the MAS expectations on governance, oversight and core risk management from 7 October 2027, and the expectations on AI lifecycle controls, capability and technology infrastructure by 7 October 2028. 

The Guidelines also make clear that FIs should implement them in a manner commensurate with the size and nature of their activities, and the extent to which their use of AI could lead to material risks to them. 

We set out below what the Guidelines could mean for your business and the practical steps you may want to consider, depending on your regulatory status and how you use AI.

Start by finding the AI already in your business and establish an AI inventory

It is hard to manage AI well if you do not know where it is. The MAS expects financial institutions to identify AI use consistently and, where practicable, keep an accurate AI inventory of their AI use cases, systems, and models. 

This can be harder than it sounds. AI is often built into software that was never bought as an "AI product". Staff may also be using public or unapproved tools outside your usual procurement process.

So it is worth looking beyond your major AI projects to the AI features in third-party platforms and everyday tools. For insurers and insurance intermediaries, this might include tools that review policy wordings, analyse submissions, prepare placement materials, compare cover or support client communications. Whether a particular use falls within the Guidelines, and what controls it needs, will depend on your regulatory status and the nature and risk of that use.

You do not need to treat every AI tool the same way

The Guidelines recognise that different AI uses carry different levels of risk. Your controls should reflect your business, how the AI is used and what could happen if it fails or performs poorly.

A tool that helps staff summarise meeting notes is very different from AI used in underwriting, claims assessment or other processes that significantly affect customers. Lower impact uses can generally be managed through basic governance, such as clear accountability, an approved list of tools, rules on permitted and prohibited uses, human review, and staff training. 

The MAS points to three main factors when assessing an AI use case for its level of risk materiality:

• Impact: what the consequences could be for your business, your customers and other stakeholders.
• Complexity: how novel or complex the technology, data and outputs are (including explainability of outputs).
• Reliance: how much you depend on the AI, including how much it acts on its own and how much human oversight is involved.

The practical task for insurers, brokers and other insurance businesses is to have a consistent, documented way of distinguishing routine AI assistance from higher-impact decision-making in the business workflows.

Accountability starts at the top

AI governance is not just a matter for your technology or data teams. Boards and senior management are expected to oversee your approach, make sure AI risks are covered by your existing risk management arrangements and set clear responsibilities across the business. 

If you are part of a global group, a regional or international AI framework can be a helpful starting point. Where the Guidelines apply, however, local senior management remains accountable for making sure that framework works for Singapore and meets the expectations of MAS in the Guidelines. Local management should have proper visibility of relevant matters and a clear route for raising Singapore-specific concerns. 

Even if your organisation is not directly subject to every part of the Guidelines, your regulated clients and business partners may increasingly ask for similar information, controls, and contractual protections before using your technology or services.

Keep customers at the centre

Where AI is used in underwriting or other activities that significantly affect existing and prospective insureds, fairness, transparency and explainability matter more.

It helps to understand the role AI plays in each outcome, look out for harmful bias and decide what information or explanation (prospective) insureds and other relevant stakeholders may need. This may mean checking whether the AI systematically disadvantages particular groups or individuals, and recording any steps taken to address this. There may also need to be an avenue for insureds to raise questions or seek redress. 
Not every AI system needs to be explained in the same way or in the same technical detail. The MAS expects your approach to fit the context, the audience, and the level of risk.

Brokers and other intermediaries may face similar questions where AI shapes recommendations, coverage comparisons, placement strategies, or client communications. It is worth checking that the role of AI stays transparent and that your people can spot and correct unreliable or unsuitable outputs.

Make human oversight count

Simply having a person "in the loop" is not enough on its own. The people reviewing AI outputs need the skills, information, authority, and practical ability to question or override them where needed across an AI life cycle. The level of human oversight required will depend on the objective of using AI and be proportionate to the risk of the AI use case. 

It is also worth watching for automation bias, where people trust an automated recommendation too readily, and decision fatigue as AI assisted work becomes faster and more frequent. Clear escalation routes, defined points for intervention and records of significant overrides or near misses can help you check that oversight is working. 

This matters most where AI generated content goes to policyholders, insureds, insurers, or other counterparties. Human review should be a genuine check, not a box-ticking step.

Your technology partners matter, but accountability stays with you

Third-party AI will be important for many insurance businesses. MAS is clear that a financial institution remains primarily accountable for its decision to use third-party AI, including the impact on its stakeholders and its ability to meet regulatory requirements. MAS expects that the FI ensures that contractual agreements with the third-party AI providers allow the FI to have a risk-appropriate degree of visibility over the introduction of AI and subsequent updates or changes so that the FI can apply the relevant controls. 

When choosing and contracting with third-party AI providers, it is worth asking:

• Does the provider give you enough information about the AI?
• How can you test and monitor the system?
• How will you be told about updates and significant changes?
• How will confidential, personal and commercially sensitive data be protected?
• Are suitable audit or review rights available?
• What happens if the service fails, behaves unexpectedly or is withdrawn?

If a provider cannot give you enough information, extra testing or closer human oversight may help. Depending on the level of risk, you may also need to consider limiting, pausing, or replacing the service. 

These questions are not limited to standalone AI products. They can also come up where AI is built into broking platforms, policy administration systems, claims services, analytics tools, or other outsourced technology.

Keep watching after launch

Going live is not the end of the process. AI performance can change as data, operating conditions, systems, and underlying models change.

The MAS expects ongoing monitoring, incident escalation, change control and periodic review. The level of monitoring should match the risk of each use case and be supported by suitable performance thresholds, documentation, and clear responsibilities. 

For higher risk uses, it is sensible to have a workable fallback in case the AI fails or behaves unexpectedly. Depending on the use case, this could be an alternative system, a manual process or a way to switch the AI off quickly. Fallback arrangements should be reviewed and tested so you know they will work when needed. 

Generative AI and AI agents need extra care

Generative AI can magnify existing risks and add new concerns around confidential information, privacy, cybersecurity, intellectual property, service availability, and reliance on outside providers.

AI agents can raise those risks further when they can use tools, connect to internal systems or act with more independence. An agent that is compromised or poorly controlled could take wrong or unauthorised actions or expose sensitive information at scale. 

If you are exploring AI agents, the question is not only whether the technology produces useful results. It also helps to be clear on:

• what the agent can access;
• what actions it is allowed to take;
• what limits and safeguards apply;
• how its activity will be monitored; and
• how unexpected or unauthorised behaviour can be stopped.

The takeaway

If used well, AI can bring real benefits to insurance businesses and the customers they serve.  In the highly regulated insurance sector with the evolving expectations from the regulator, this takes more than a policy document: it means knowing where AI is used, which uses carry material risk, who is accountable and whether your controls keep pace as technology and business practices change.

As a starting point to meet the MAS expectations in the Guidelines which will come into effect by October 2027, Singapore insurance companies should be reviewing their current AI use, governance arrangements (including interaction with global group AI risk management frameworks), and reliance on third parties, then build a prioritised plan around the potential impact on their business and customers.