MAS AIRG01
Guidelines on AI Risk Management (AIRG)
Issued by MAS on 7 October 2026 and in force from 7 October 2027. Governance, systems and processes, life cycle controls, capability and capacity.
The MAS AI Risk Management Guidelines, built in.
Every AI use inventoried, risk-assessed, controlled and inspection-ready. Mapped clause by clause to the Guidelines and verified against the primary text.
MAPPED TO MAS AI GOVERNANCE FRAMEWORKS AND STANDARDS:MAS AIRGMindForgeVeritasSAFRTRM Guidelines
THE PROBLEM
The AI your firm uses is not on any list.
Most firms cannot answer three questions their supervisor will ask: which AI systems are in use, who owns them, and what controls are in place. The answer sits in spreadsheets, emails, and heads. Governance Row replaces all three.
HOW IT WORKS
From AI use to inspection-ready: five steps, one motion.
One record. Every step timestamped. Nothing lives in spreadsheets.
01
Inventory
Log every AI use with owner, source, and description
02
Assess
Score risk materiality on impact, complexity, and reliance
03
Control
Apply the controls MAS expects, scaled to each use's materiality
04
Evidence
Attach the proof each control requires
05
Produce
Generate the inspection pack in one motion
EVERY STEP RECORDED IN THE APPEND-ONLY LEDGER.
INSIDE THE PLATFORM
Every screen has one job.
Not a spreadsheet with a login. A workspace for the compliance officer, built for the way MAS asks.
01 · THE INVENTORY
Every AI use, on one screen.
A live register of every AI system in the firm: internal builds, vendor AI, staff use of tools like ChatGPT. Source, business function, risk level, owner and status visible at a glance.
- Third-party AI detection across vendor tools
- Owner and business function per entry
- Risk level set by the assessment, shown at a glance
02 · THE ASSESSMENT
Risk scoring the way MAS defines it.
Every AI use scored on impact, complexity, and reliance: inherent risk before controls, residual after. Same method every time. Auditable.
- MAS-defined risk dimensions
- Inherent and residual scoring
- Consistent scoring across all AI uses
03 · THE PROOF
What each document covers, in plain English.
Firm-wide governance is covered once for the whole firm. For each AI use, what's left is grouped into a few documents to attach, each showing the controls it satisfies, with anything still outstanding flagged.
- Firm-wide governance covered once, not per AI
- Obligations grouped into a few documents to attach
- Outstanding evidence flagged on the spot
04 · THE OUTPUT
The document your supervisor asks for. In one motion.
A complete, timestamped record of your AI governance, ready to hand over. Board-ready. Regulator-ready. Every entry backed by the append-only ledger.
- Board-ready summary and detail
- Complete, timestamped output
- Every change tied to the append-only ledger
THE LEDGER
Append-only. Timestamped. Auditable.
Every action in Governance Row (every AI added, every risk score changed, every control attested, every piece of evidence attached) is written to an append-only ledger on the server, timestamped as it happens. No part of the application can edit or remove an entry once written, not even our own admin tools. A supervisor gets a complete record of every governance action, not a summary compiled after the fact.
app.governancerow.com/ledger
Append-onlyIllustrative sample data
- 2026-08-03 16:04:22DSEvidence added: AI Governance Policy v2.1
- 2026-07-31 10:12:47DSEvidence added: Q2 2026 Board Minutes
- 2026-07-28 15:38:09WLEvidence added: Model Card, Credit Scoring
- 2026-07-24 11:22:19ROControl mapped: MAS AIRG 5.3
- 2026-07-22 09:19:03MLAI use added: Aladdin Copilot
BUILT TO THE STANDARD
MAS's clauses, mapped to our controls.
Governance Row's control library is grounded in the supervisor's own materials, not a translation of a US or EU framework. It is mapped to the MAS AI Risk Management Guidelines and the frameworks they draw on, and verified against the primary text.
MINDFORGE02
Operationalisation Handbook (January 2026)
Published under Project MindForge by MAS and 24 industry partners. Working templates for identification, inventory, GenAI, and life-cycle controls.
VERITAS03
FEAT Assessment Toolkit (2022)
MAS's toolkit for assessing fairness, ethics, accountability, and transparency in FS AI/ML systems.
SAFR04
Safeguards for Agentic Finance at Runtime (SAFR)
A voluntary industry reference model for real-time safeguards on agentic AI, developed through MAS's BuildFin.ai collaboration (2026). Not a supervisory expectation.
TRM GUIDELINES05
Technology Risk Management (2021)
Technology and cyber risk management principles, applied to AI systems and third-party deployments.
WHO IT'S FOR
Built for the practitioner. Read by the board.
Compliance officers, heads of risk, general counsel. The people who will answer the supervisor's questions. Governance Row gives them:
- A live view of AI risk, not a spreadsheet
- Every control tied to the clause it satisfies
- Evidence attached, not chased
- One-click inspection pack
Chief compliance officers, chief risk officers, boards. The people accountable for what the firm attests. Governance Row gives them:
- A defensible record on demand
- Clear ownership per AI use
- A ledger nothing can rewrite
- Board-ready reporting, always current
REQUEST ACCESS
The Guidelines are final. The clock is running.
MAS issued its Guidelines on AI Risk Management on 7 October 2026. AI oversight, the AI inventory and risk materiality are in force from 7 October 2027, and the fuller life cycle controls by 7 October 2028. That is a build window, not a grace period. Talk to us about your AI governance before your supervisor asks to see it.