Governance readiness
AI inventory, risk materiality assessment, lifecycle controls, third-party exposure, human oversight and board reporting.
AI Governance
Your AI programme will be audited before it is celebrated.
Inventory, materiality, lifecycle controls, third-party exposure and board reporting — built to the supervisory expectations that apply to you, in Singapore and in Europe.
MAS AI Risk Management GuidelinesEU AI ActISO/IEC 42001NIST AI RMF
Why it is difficult
The knowledge sits in three places and the accountability sits in one.
Legal understands the contracts but not the data. The data team understands the pipelines but not the clauses. Procurement holds the vendor relationships. The board carries the accountability. Nobody has the whole picture, and a supervisory review asks for it in a single document.
Data licensing for AI
Whether your market data agreements permit training, retrieval, entitlement-crossing copilots and derived output. Most predate all of it.
Evidence and reporting
The operating artefacts a supervisor or board will actually ask for, in a form you can maintain after we leave.
The regulatory position
Two supervisors, one compliance calendar.
The headline that the EU delayed the AI Act is only half true. Some obligations moved. Others did not move at all.
- Singapore. MAS issued a consultation paper on proposed Guidelines on AI Risk Management in November 2025, covering all financial institutions — oversight, risk management systems and policies, lifecycle controls, and capability. The consultation closed in January 2026 and a twelve-month transition period following issuance was proposed.
- Operationalisation. In March 2026 MAS published an AI Risk Management Toolkit, centred on an Operationalisation Handbook structured around scope and oversight, risk management, lifecycle management and enablers.
- Europe. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force in July 2026. High-risk obligations for stand-alone Annex III systems were deferred to 2 December 2027, and for AI embedded in regulated products under Annex I to 2 August 2028.
- What did not move. The Article 50 transparency obligations applied from 2 August 2026 as originally scheduled. Article 50(2) applies to systems already on the market from 2 December 2026.
Sources: MAS consultation and Toolkit publications; Regulation (EU) 2026/1744. Position reviewed periodically. Confirm against current guidance before relying on any date.
Self-assessment
AI Governance Readiness Check.
Eight questions, about three minutes. You will get a readiness profile across the dimensions a supervisor is most likely to examine. Nothing is stored and no details are required.
Question 1 of 8
What the engagement covers
- A complete AI inventory, including tools acquired outside technology
- Risk materiality assessment and tiering of each use case
- Lifecycle controls from development through monitoring to retirement
- Third-party and vendor AI exposure, which cannot be delegated away
- Data licensing and entitlement exposure across AI use
- Human oversight, explainability and fairness controls
- Board and senior management reporting structures
- Gap analysis against MAS expectations, the AI Act and ISO/IEC 42001
What you receive
- AI inventory register in a format your team can maintain
- Risk materiality framework with worked examples
- Prioritised remediation roadmap with owners and sequencing
- Board pack, written to be tabled without rewriting
- Licensing exposure register with renewal negotiating positions
- Capability assessment — what to build in-house and what not to
- Who it is forCRO, Head of Risk, CDO, Head of Compliance, Head of Internal Audit
- How longDiagnostic 2 weeks. Full readiness review 8–12 weeks.
Start with the two-week diagnostic.
We will tell you the size of the gap and whether a full review is justified. If it is not, we will say so.