Side by side
MAS means the Guidelines on AI Risk Management. SAFR means Safeguards for Agentic Finance at Runtime. Australia means APRA's letter to industry on AI together with existing prudential standards.
| MAS Guidelines (Singapore) | SAFR v1.1 (Singapore) | EU AI Act, as amended by the Digital Omnibus | APRA (Australia) | |
|---|---|---|---|---|
| Legal status | Supervisory guidelines issued 7 Oct 2026. Not law, but MAS supervises against them. | Industry white paper. Explicitly not guidance or a supervisory expectation. Voluntary. | Binding regulation with extraterritorial reach. | Letter of 30 Apr 2026. No new AI standard; expectations sit within the existing prudential framework (we map them to CPS 220, 230 and 234). |
| Scope | All financial institutions, all forms of AI, at enterprise and use-case level. | AI agents executing financial tasks. | All sectors, risk-tiered. In finance, high-risk covers credit scoring of individuals and life and health insurance pricing. | Banks, insurers and superannuation trustees. |
| Agentic AI | In scope. Further consultation on agentic AI expected in 2027. | The core purpose: agent identity, authorisation and a check of each proposed action before it executes. | No agent-specific regime. Agents are classified by use case. | Expects controls over agentic and autonomous workflows and strong privileged access management. |
| Governance | Board and senior management oversight, risk appetite and clear roles. | Institution configures its own rules. | Provider risk management system; deployer assigns competent human oversight. | Board AI literacy; AI strategy tied to risk appetite with defined triggers. |
| Inventory and materiality | AI inventory and risk materiality assessment, with proportionate controls. | Every action declared within a governance envelope. | Classification by risk tier; fundamental rights impact assessment for lenders and insurers. | Inventory of AI tools and use cases. |
| Human oversight | Required lifecycle control, proportionate to risk. | Defines when oversight is triggered at runtime. | Mandatory for high-risk systems. | Human involvement for high-risk decisions. |
| Runtime control and records | Monitoring, change management and cybersecurity across the lifecycle. | A checkpoint between every decision and execution, with a record at the point of decision. | Automatic logging; deployers keep logs for at least six months. | Continuous monitoring and a credible fallback where AI supports critical operations. |
| Third parties | Institution stays accountable: obtain assurance, add compensating controls, or limit, suspend or replace. | Runs in the institution's own infrastructure. | Duties split between provider and deployer. | Map the third- and fourth-party AI supply chain; audit rights; concentration and exit. |
| Deadlines | 7 Oct 2027 for sections 3 and 4; 7 Oct 2028 for sections 5 and 6. | None. Reference implementation available now. | AI literacy and prohibited practices since 2 Feb 2025; transparency duties since 2 Aug 2026; Annex III high-risk from 2 Dec 2027; embedded products from 2 Aug 2028. | Now. |
| Penalties | Supervisory action. | None. | Up to EUR 15M or 3% of turnover for most breaches; EUR 35M or 7% for prohibited practices. | Supervisory action and, where appropriate, enforcement. |
Sources: MAS media release, 7 Oct 2026; Singapore Business Review on the 2027 agentic consultation; MAS SAFR page; laws.sg on SAFR status; Singapore Business Review on SAFR v1.1; European Commission AI Act page; European Parliament on the Digital Omnibus; AI Act Article 99; AI Act Annex III; APRA release, 30 Apr 2026; Regulation Tomorrow on APRA expectations. Not legal advice.
Common questions
When do the MAS Guidelines on AI Risk Management take effect?
MAS issued them on 7 October 2026. Sections 3 and 4 take effect on 7 October 2027 and sections 5 and 6 on 7 October 2028.
Is SAFR mandatory?
No. SAFR is an industry white paper published on 3 July 2026 and states that it is not guidance or a supervisory expectation. It describes runtime controls for AI agents in finance in detail.
When do EU AI Act high-risk obligations apply to banks and insurers?
After the Digital Omnibus, Annex III high-risk obligations apply from 2 December 2027. Credit scoring of individuals and life and health insurance pricing are in Annex III.
Does APRA have a dedicated AI standard?
No. APRA's 30 April 2026 letter sets expectations for AI within its existing prudential framework, and they apply now. We map them to CPS 220, CPS 230 and CPS 234.
Can a product make us compliant?
No product makes an institution compliant; that is a judgement for the institution and its supervisor. A runtime governance product can support specific controls: agent identity, pre-execution checks, decision records and the ability to suspend an agent.
Where do you stand?
Check twelve controls against the regimes you answer to and cost the business case. It takes about five minutes and runs entirely in your browser.