MAS’s New AI Guidelines, Explained for Financial Advisers

The MAS AI guidelines, issued on 7 October 2026, set out what MAS expects of every financial institution that uses AI, including financial advisory firms and insurers. They take effect on 7 October 2027.

The rules are written for firms, but you will feel them as an adviser: approved tools only, no client data in public AI, and a human check on everything AI produces.

This is a plain-words summary to help you make sense of it. Your firm’s own policy and compliance team always have the final word.

What MAS issued

The full name is the Guidelines on Artificial Intelligence Risk Management, and you can read them in full on MAS’s website. MAS consulted the industry on a draft in November 2025, then published the final version together with a paper responding to the feedback it received.

Three things are worth knowing up front:

They cover every financial institution. MAS’s own page lists the types, and financial advisers and insurers are on it.
They cover every kind of AI. That includes the chat tools many advisers already use, and newer AI agents.
They are proportionate. A large firm using AI to approve loans has more to do than a small firm using it to tidy emails.

Firms have time to get ready. The guidelines take effect on 7 October 2027. The parts on oversight and keeping track of AI apply from that date, and the more detailed controls on how each AI tool is chosen, tested and watched apply by 7 October 2028.

A few terms, in plain words

AI, as MAS uses it: a system that learns from data to produce estimates, summaries, content, recommendations or decisions. A calculator or a spreadsheet formula that follows fixed rules is not AI under the guidelines.
Generative AI: AI that writes text, images or other content, such as ChatGPT, Gemini or Copilot.
AI agent: AI that can take actions on its own, such as sending a message or updating a record, not just answer a question.
Shadow AI: staff using public AI tools at work without the firm’s approval or knowledge. MAS uses this exact term.
Risk materiality: how much harm it would do if the AI got something wrong. The more harm, the more care MAS expects.

What firms must now do

At the firm level, the guidelines ask for four broad things:

Oversight from the top. The board and senior management own the risks of AI use. A firm doesn’t need a new AI committee if its existing structures can do the job.
Know where AI is used. Firms must identify their AI use, keep an inventory (a list of where and how AI is used) and rate how risky each use is.
Controls that match the risk. Higher-risk uses get stronger checks on data, testing, fairness, human oversight and security.
Responsibility for vendors’ AI. If a firm buys software with AI inside it, the firm is still accountable for how it behaves.

The part most advisers will meet first is the set of basic policies MAS expects even where AI use is low-risk. According to the guidelines, these should at least include:

one senior person accountable for AI oversight
clear rules on permitted and prohibited uses, for example no confidential or client information in public AI tools
when a human must review AI output before it’s used
an approved list of AI tools, and a way to request a new one
staff education on the firm’s AI policies
regular compliance checks, and a review of whether the firm’s AI use is still low-risk

What it means for you, the adviser

The guidelines don’t speak to representatives directly. They tell firms what to put in place, and firms will turn that into rules for you. Here’s how it is likely to show up in your week.

1. Use the tools your firm approves

Expect an approved list of AI tools. If the one you like isn’t on it, ask for it to be assessed rather than using it quietly. Quiet use is exactly the shadow AI that MAS asks firms to find and reduce.

2. Keep client data out of public AI tools

The guidelines give “no confidential, proprietary or client information in public AI tools” as an example of a prohibited use, and firms may add technical controls to stop it happening. Build the habit now: remove names, NRIC numbers, policy numbers and anything else that identifies a client before you paste text into any AI tool. For more, see Is my client data safe with AI?

3. Check everything before you use it

MAS gives examples of AI use it would generally treat as low-risk: drafting or proofreading emails to customers, summarising documents or meeting notes for internal use, and designing marketing visuals. Even for these, it says the people involved should review and check the output before using it.

In practice: if AI drafted it, you read it, fix it and stand behind it. A wrong figure in an email is your wrong figure.

4. Treat anything close to advice as higher-risk

The guidelines single out financial advisory services as an area with a high impact on customers, where AI needs more transparency and explanation. Using AI to help you write is one thing. Letting it shape what you recommend to a client is another, and your firm is likely to treat the two very differently.

5. Be ready to explain, and to tell clients

For higher-risk uses, MAS expects firms to consider telling customers when AI is used, how it affects them and where they can raise concerns. It also says this need not be technical. If your firm uses AI in its client process, you may be the one explaining it, so be able to say in one or two sentences what the tool does and what you check yourself.

6. Take the training seriously

Firms are expected to train their people in the right use of AI and keep that training up to date as the technology changes. When the session comes round, treat it as useful, not as a box to tick. It’s where you’ll learn which tools you may use and how.

What doesn’t change

Your duties to clients stay the same. The guidelines say plainly that a firm using AI must still meet MAS’s existing expectations, and give the Guidelines on Fair Dealing as an example. MAS’s FEAT principles (fairness, ethics, accountability and transparency) for AI in finance also still apply.

AI changes how some of the work gets done. It doesn’t change who is responsible for it. That’s still you and your firm.

An example

Here’s how it might look. The adviser and every detail are invented.

Daniel uses a free AI chat tool on his phone to tidy his client emails. After his firm rolls out its new AI policy, three things change.

He moves his email drafting to the AI tool the firm has approved. He stops pasting client names and policy details into any tool, and writes “[Client]” and “[Plan A]” instead, filling in the real details himself at the end. And before anything goes out, he reads it line by line, checking every figure against the source.

None of this makes him slower for long. Within a week the new habits are automatic, and he has a clear answer when a client asks whether a computer wrote his email: “AI helps me draft. I check every word, and the advice is mine.”

Two prompts worth saving

Use these only in a tool your firm allows, with client details removed.

To check a draft before you send it:

Here is an email I drafted with AI help. List every fact, figure, date and promise it contains, so I can check each one against the source before I send it. Do not rewrite the email.

To explain your firm’s AI policy back to yourself:

Here is my firm’s AI policy. Summarise it as a short list: the tools I may use, what I must never put into an AI tool, and when a person must review AI output. Quote the policy’s own wording for each point.

You still read the policy itself. The second prompt just gives you a checklist to keep beside you.

Frequently asked questions

Do MAS’s AI guidelines apply to individual financial advisers?

They are addressed to financial institutions, including financial advisory firms and insurers, not to individual representatives. But firms will apply them through their own policies, training and approved tools, so they will shape how you use AI at work.

When do the MAS AI guidelines take effect?

On 7 October 2027. The sections on oversight and on identifying and listing AI use apply from that date. The more detailed controls over each AI tool’s life, and the expectations on staff skills and technology, apply by 7 October 2028.

Can I still use ChatGPT for work?

That depends on your firm’s policy, which is likely to include a list of approved tools. The guidelines treat drafting emails and summarising notes as generally low-risk, as long as a person checks the output, but they also expect firms to keep client information out of public AI tools.

What is shadow AI?

It’s staff using public AI tools at work without the firm’s approval or knowledge. MAS expects firms to reduce it, with clear rules on what is allowed, technical controls where needed, and regular reminders to staff.

Do the guidelines cover AI agents?

Yes. They cover all forms of AI, including generative AI and AI agents, and note that agents’ ability to act on their own can make the risks bigger. MAS has said it will consult the industry on further guidance specific to AI agents.

Sources

MAS, Guidelines on Artificial Intelligence Risk Management for Financial Institutions, 7 October 2026 (guidelines page and full text, read 18 October 2026).
MAS, MAS sets out supervisory expectations on responsible AI adoption by financial institutions, media release, 7 October 2026.
MAS, Response to feedback received on Guidelines on Artificial Intelligence Risk Management, 7 October 2026.

Full Disclosure

The Content above is generated by AI. The objective of the #AiSeries is for me to test if I can generate website traffic using just AI-generated content. However, having that said, even I, have learned a lot from the content above.