ZetrixwebWhy suppliers are in the conversation
MAS's final AI risk management guidelines, published on 7 October 2026, place accountability with the institution's board and senior management and describe controls across the AI lifecycle: data management, human oversight, selection and testing, cybersecurity, monitoring, and change management. A bank that buys an AI product still has to satisfy a supervisor on all of those, which means it needs information that only the supplier holds.
Existing expectations such as those on technology risk and outsourcing continue to apply as well. The new guidelines add AI-specific questions on top.
What to put in the pack
Organize it around the lifecycle areas so a risk team can map it directly. Describe what the system does and what it is not meant to do. Show how data is handled, including where it flows and whether it is used to train models. Present your testing and evaluation approach with real results, including how you test for failure modes specific to generative and agentic systems.
Explain the human oversight model and the points at which a person can intervene. Summarize security controls and test results, ongoing monitoring, and how model or prompt changes are managed and communicated. Finally, disclose the supply chain, including model providers and sub-processors, and describe your exit and continuity arrangements.
| Lifecycle area | What to provide | Typical form |
|---|---|---|
| Data management | Data flows, retention, training use | Diagram and policy summary |
| Selection and testing | Evaluation method and results | Test report with representative cases |
| Human oversight | Where people review or override | Process description and screenshots |
| Cybersecurity | Controls and adversarial test results | Security summary and test attestation |
| Monitoring | Quality, drift, and incident handling | Dashboard examples and runbook |
| Change management | How changes are tested and notified | Release policy and sample notices |
Keep it honest and current
Overstated claims are a worse problem than gaps. State limitations plainly, date every document, and assign an owner who updates the pack when something material changes. Offer a short walkthrough call so the client's risk team can ask questions in context.
If your product is agentic, add a section on the actions it can take, the credentials it uses, and the approval gates in place, in line with Singapore's agentic AI guidance.
Selling to Singapore financial institutions? Talk to us about building your evidence pack.
Key takeaways
- MAS's final guidelines place accountability on the institution, so banks need evidence from AI suppliers.
- Organize an evidence pack around the lifecycle areas: data, testing, oversight, security, monitoring, and change management.
- Disclose your supply chain, including model providers, and your exit arrangements.
- Be honest about limitations, date everything, and keep it updated.