ZetrixwebWhy the inventory comes first
MAS's final guidelines apply to all financial institutions and all forms of AI, including generative AI and agents, and ask boards and senior management to ensure existing risk frameworks address AI risk. IMDA's governance work for agentic AI and Singapore's wider guidance share the same starting point. Whatever your sector, you cannot assess, test, or oversee what you cannot see.
The inventory is therefore the backbone: the place where every control, test, and approval is attached to a specific use case.
A practical template
Keep the record short enough that owners will maintain it. For each use case capture a name and purpose, an accountable owner, the users and who is affected, the model or provider and version, the data used including any personal or sensitive data, what decisions or actions it influences, its level of autonomy, the human oversight in place, its testing status, its risk tier, and a review date.
Make updating the inventory part of normal workflows. New vendor contracts, architecture reviews, and project approvals should each ask whether AI is involved and trigger an entry.
| Field | Why it matters |
|---|---|
| Owner | Someone is accountable for outcomes |
| Data used | Drives privacy and security controls |
| Decisions influenced | Drives potential impact |
| Autonomy level | Drives oversight needs |
| Testing status | Shows evidence exists |
| Review date | Keeps the record alive |
A simple risk tiering
Score each use case on a few factors: how serious and how reversible the harm of a wrong output is, how many people are affected, how sensitive the data is, how autonomous the system is, and how much it relies on third parties. Group results into three tiers and attach standard controls to each: light-touch for low, standard testing and monitoring for medium, and strong oversight, independent testing, and senior sign-off for high.
Review tiers when a use case changes, for example when an assistant gains the ability to take actions.
Want help standing up an AI inventory and tiering process? Talk to us.
Key takeaways
- An AI use-case inventory is the backbone of governance; MAS's final guidelines apply to all forms of AI at financial institutions.
- Keep records short and owned, and include embedded and shadow AI.
- Capture owner, data, decisions influenced, autonomy, oversight, testing status, tier, and review date.
- Tier by impact, reversibility, scale, data sensitivity, autonomy, and third-party reliance, and attach standard controls.