MAS AI Risk Management Guidelines: an HR guide to AI hiring tools
Practical HR guide for Singapore financial institutions applying MAS’s 2026 AI Risk Management Guidelines to recruitment AI, vendors, testing and key dates.
Adan Vielma · · 24 min read
Guidelines checked 19 October 2026. The Guidelines take effect on 7 October 2027; MAS provides until 7 October 2028 for implementation of Sections 5–6.
A financial institution can outsource an AI interview. It cannot outsource understanding the risk of using it.
Imagine an AI interviewer mistranscribes part of a candidate’s answer. The system marks a required capability as missing and recommends rejection. The recruiter sees the recommendation but never reopens the source answer.
For HR or Talent Acquisition, the governance question is not simply whether a vendor calls itself “MAS compliant.” It is whether the institution can answer four operational questions: Is the use visible in the AI inventory? What happens if it is wrong? Can a reviewer trace the assessment to candidate evidence and change the outcome? Will the institution know if the vendor changes the model or workflow?
MAS issued its Guidelines on Artificial Intelligence Risk Management for Financial Institutions on 7 October 2026. This guide follows one AI interview use case through the parts HR needs to contribute to: scope, inventory, materiality, vendor evidence, testing, approval and monitoring.
MAS AI Risk Management Guidelines at a glance
| Question | Practical answer |
|---|---|
| Who is in scope? | MAS-regulated financial institutions, including banks, insurers, payment institutions, fund managers, financial advisers and other entity types on MAS’s official list. |
| Which AI is covered? | All forms of AI technology within the Guidelines’ definition. A workflow based only on predefined rules is not AI simply because it is automated. MAS expects AI risk to be managed at both enterprise and individual use-case levels. |
| Does every use get the same controls? | No. The framework is risk-proportionate. Materiality depends on the use case, including its impact, complexity and reliance. |
| What about third-party AI? | The institution still needs enough assurance to judge whether the AI is suitable for its intended use and whether the remaining risk fits its risk appetite. |
| When do the Guidelines take effect? | The Guidelines take effect on 7 October 2027. MAS provides until 7 October 2028 for implementation of Sections 5–6. |
MAS summarises the framework this way: financial institutions should manage AI risks “at both the enterprise and individual use case levels” while applying the expectations proportionately. MAS announcement
Which organisations do the MAS AI Risk Management Guidelines apply to?
The Guidelines apply to the MAS-regulated financial institutions on MAS’s official “Applies to” list, including banks and finance companies, insurers and brokers, fund managers and capital-markets firms, financial advisers, payment institutions, trust businesses and credit bureaus. Official applicability list
Check the regulated entity, not the label on the company. Being a “fintech” is not enough by itself. An employer outside the MAS regulatory perimeter should not treat these Guidelines as a general Singapore hiring rule. A multinational financial institution may leverage a group AI risk-management framework where it meets MAS’s expectations, but the Singapore entity still needs adequate oversight of the AI it uses.
Do the MAS AI Risk Management Guidelines cover recruitment AI?
Yes, where recruitment AI is used by a financial institution within scope. There is no recruitment-specific chapter, but MAS says the final Guidelines apply to all financial institutions and all forms of AI. Its August 2026 parliamentary reply described the framework as covering all AI use cases by financial institutions. MAS parliamentary reply
That does not make every CV summary or AI interview high-risk. Compare two workflows:
- an assistant drafts an internal interview note that a recruiter checks against the source; and
- an AI assessment automatically rejects applicants before anyone reviews the evidence.
Both may use AI. The consequence, reliance and controls are very different.
MAS allows basic AI governance policies and procedures where poor performance or unavailability is unlikely to have a material adverse impact. Examples include drafting, proofreading and summarising for internal reference.
Treat a recruitment decision system as its own use case and assess the actual consequences before assigning it to a lower-impact category. MAS response to feedback
The implementation timeline for an HR team
| Date | What the institution needs | What HR can have ready |
|---|---|---|
| Now | Final Guidelines issued. | Find AI already used in recruitment, including embedded vendor features; identify the business owner and the control-function route. |
| 7 October 2027 | The Guidelines take effect; Sections 3–4 cover oversight and core AI risk-management systems. | Recruitment uses visible in the inventory, with ownership, materiality, escalation and the institution’s risk decision. |
| By 7 October 2028 | Implementation window for Sections 5–6 closes: lifecycle controls and capability. | Proportionate testing, third-party assurance, review, monitoring, change controls, fallback and role-appropriate capability backed by evidence. |
These are implementation milestones, not a reason to defer controls that are already appropriate for the assessed risk. MAS’s response indicates that high-risk use cases should receive the relevant lifecycle controls as soon as possible, rather than waiting until 2028. MAS response to feedback
How to apply the MAS AI Risk Management Guidelines to an AI hiring use
Treat the recruitment product as a set of specific AI uses, not one vendor-level risk label.
AI interviewer for operations hiring
Start with one bounded workflow rather than reviewing “the recruitment platform” as a single object.
Use case: First-stage AI interview for operations vacancies
Candidates provide:
CV information and spoken interview answers
AI produces:
Transcript
Evidence summary
Assessment against job criteria
Suggested areas for recruiter review
Human action:
Recruiter reviews the assessment and decides whether to progress the application
Initial automation:
No automatic rejection, stage move or candidate message
Scale:
Approximately 2,000 applicants per year
System connections:
Applicant tracking system
Interview platform
Transcription and model providers
Fallback:
Recruiter reviews the application through the normal ATS process if the AI interview or assessment is unavailable
Business owner:
Talent Acquisition lead
Control partners:
HR, technology risk, information security, privacy, legal and procurement as applicable
Put the recruitment use in the AI inventory
An inventory entry should show what the AI actually does without requiring someone to open the product:
| Inventory field | Example entry |
|---|---|
| Purpose | Conduct first-stage interviews and help recruiters assess evidence against predefined job criteria. |
| Owner | Talent Acquisition lead. |
| AI functions | Speech transcription, question generation or follow-up, evidence extraction and assessment generation. |
| People affected | Applicants to covered vacancies and recruiters reviewing their applications. |
| Data used | CV, candidate answers, audio or transcript, job criteria and recruiter configuration. |
| Output | Transcript, assessment, evidence summary and suggested next step. |
| Decision or action connected to output | Recruiter decides whether to progress the applicant. Any automatic stage movement or rejection should be recorded separately if enabled. |
| Third parties | Recruitment vendor and relevant model, speech or infrastructure providers used to deliver the service. |
| Fallback | Manual review through the ATS if the AI service is unavailable or the output cannot be relied on. |
Inventory the AI functions behind the supplier name. One recruitment product may contain several functions with different failure modes. A transcript error, an evidence-extraction error and an incorrect hiring criterion can produce the same-looking “low score” for different reasons.
The designated control function remains responsible for the policies and procedures governing the AI inventory. HR or the relevant business team can maintain the recruitment entry under that oversight.
Assess materiality through impact, complexity and reliance
For a hiring use case, make the institution’s three dimensions concrete:
| Lens | Questions to ask |
|---|---|
| Impact | Who could be affected, how serious could the consequence be, and how hard would it be to correct? |
| Complexity | How understandable is the system, how many models or providers are involved, and how much visibility does the institution have into important changes? |
| Reliance | Is the AI drafting, recommending or acting? What meaningful human review occurs before the consequence? |
Assess inherent materiality before the proposed controls and residual materiality after them. Human review may reduce residual risk; it does not erase the underlying consequence of a wrong exclusion. The remaining risk should fit the institution’s risk appetite before deployment. MAS Guidelines
Example record: The system can influence whether applicants progress and depends on third-party transcription and generative models. A recruiter makes the stage decision and can inspect the source transcript. A wrong assessment could contribute to excluding a qualified applicant, so the use receives enhanced testing and review. The institution’s designated control function determines the formal rating.
What could push an AI hiring use higher or lower?
| Dimension | Could push higher | Could push lower |
|---|---|---|
| Impact | Exclusion at scale, sensitive candidate data, or a decision that is difficult to correct after action. | Internal drafting with limited reach, easy correction and no direct candidate outcome. |
| Complexity | Multiple models/providers, opaque logic or limited visibility into upstream changes. | Bounded use, inspectable inputs and outputs, and a test process the institution can reproduce. |
| Reliance | The assessment strongly determines progression or automated action; reviewers rarely inspect the source. | The source is visible and a reviewer actually checks and can change the result before action. |
The institution still applies its own rating methodology.
What changes if the institution rates the use case high-risk?
For a use case that the institution classifies as high-risk under its own methodology, the final framework expects formal independent validation before deployment by competent people sufficiently independent from development and deployment.
MAS’s response says this validation expectation applies even when the high-risk use case is a pilot or partial deployment. It also indicates that the relevant lifecycle controls should be applied as soon as possible rather than waiting until 2028.
Official Guidelines PDF · MAS response to feedback
| Not rated high-risk | Rated high-risk |
|---|---|
| A documented pre-deployment review can be calibrated to the assessed risk, with appropriately qualified reviewers independent of the development or deployment work. | Formal independent validation is expected before deployment, including a pilot or partial deployment. |
| Fallback, monitoring and review depth remain proportionate. | Stronger contingency arrangements and ongoing independent re-validation. |
Whether an AI interviewing or screening use is high-risk depends on the institution’s methodology and control function.
By 7 October 2027: inventory, materiality and ownership for AI hiring
The first phase covers the governance and core risk-management foundation in Sections 3–4.
If HR or Talent Acquisition owns the recruitment use, it is the business line operating it, not just a source of facts for Risk. It should be able to identify the use, keep the inventory information current, assess it under the institution’s methodology, operate the agreed controls and escalate when the risk or workflow changes.
| Institution-level expectation | What HR should be able to show for a recruitment use |
|---|---|
| Clear accountability | A named business owner, plus the control, technology, privacy, security and procurement teams involved. |
| Visibility of AI use | An inventory entry that identifies the actual AI functions and connected actions, not just the vendor name. |
| Materiality assessment | A reasoned first-line assessment of impact, complexity and reliance using the institution’s methodology, with the designated control function retaining independent oversight and the final say on the rating. |
| Risk appetite and escalation | The approval conditions, limits, failures or changes that require escalation, a narrower workflow, a pause or another control. |
| Basic policies for lower-impact uses | Where the institution uses the lighter route, the basis for doing so and the trigger for reassessment if the use becomes more consequential. |
A risk reviewer or internal auditor should be able to reconstruct what the tool does, how HR relies on it, which controls HR actually operates and who can stop the workflow.
Copyable handoff: what HR can send to Risk and Procurement
HR can own the business facts and first-line assessment without approving its own regulatory risk rating.
AI recruitment use-case handoff
Business owner:
[Name and function]
Use and scope:
[What the AI does; roles, locations, candidate groups and expected volume]
AI functions and outputs:
[For example: transcription, summarisation, assessment, ranking, question generation]
Candidate data used:
[Data categories]
Decision or action influenced:
[What happens after the output; identify anything automatic]
Human oversight:
[Who reviews, what source they can see, what they can change, and when]
Providers and dependencies:
[Recruitment vendor, model, speech or other material providers]
Known failure modes:
[For example: transcript error, missing evidence, unsupported assessment, technical failure]
Materiality assessment:
Impact:
Complexity:
Reliance:
[Apply the institution's methodology; note important assumptions]
Controls and assurance gaps:
[Controls HR will operate; important vendor or internal evidence still missing]
Fallback:
[How hiring continues if the AI fails or is suspended]
Pilot boundary and reassessment triggers:
[Time, roles, users and automation limits; changes that require another review]
Evidence available:
[Test results, vendor answers, data flow, security/privacy reviews, logs]
Decision or challenge needed from control functions:
[Rating approval; risk appetite decision; required validation or review; deployment conditions]
HR owns the recruitment use and the evidence it produces; the designated control function independently oversees, challenges or approves the materiality assessment under the institution’s framework.
Who should own what in an AI hiring review?
Give each question a named owner rather than leaving every function with a generic instruction to “review AI risk.”
| Team | Useful responsibility |
|---|---|
| HR and Talent Acquisition | Own the recruitment use as the business line where applicable; keep the workflow and inventory information current; perform the first-line materiality assessment; operate hiring controls; and escalate material changes or failures. |
| Risk, Compliance or other designated control function | Set or oversee the materiality methodology, provide independent challenge, arbitrate or approve ratings, and apply the institution’s risk appetite and escalation framework. |
| Privacy and Legal | Assess candidate-data use, notices, transfers, retention, correction or challenge routes and applicable employment requirements. |
| Technology and Security | Review integrations, access, logging, resilience, cybersecurity, incident response and technical dependencies. |
| Procurement and Third-party Risk | Obtain provider evidence, understand material dependencies, and preserve appropriate change, incident, fallback and exit rights. |
The vendor supplies evidence. The institution decides what reliance is acceptable. Independent review requirements then follow the use-case materiality and the institution’s framework.
Lifecycle controls: prove the AI hiring controls actually work
Sections 5–6 are due by 7 October 2028 across the institution’s AI use cases, with high-risk uses expected to receive the relevant controls sooner. In recruitment, each control should leave evidence that it actually works.
| Control area | What it means in a hiring workflow | Evidence worth keeping |
|---|---|---|
| Data management | Know which candidate data enters the system, whether important inputs such as transcripts are accurate enough, and how access, retention and corrections work. | Data flow, retention settings, accuracy tests, access controls and correction route. |
| Fairness and criteria | Use job-related criteria and investigate unexplained differences, repeated exclusions or other patterns that could reflect a bad criterion or system behaviour. | Criteria version, test set, appropriate subgroup review, error analysis and remediation. |
| Explainability and human oversight | Let the reviewer connect an assessment to candidate evidence, recognise uncertainty and change the outcome before action. A person who only clicks approve is not meaningful oversight. | Source evidence, rationale, reviewer instructions, permissions and override test. |
| Third-party selection and assurance | Understand the models and providers behind the service, why the service is suitable for this task, what assurance exists and what changes require another review. | Selection rationale, limitations, provider map, due diligence, contracts and assurance scope. |
| Evaluation and pre-deployment review | Test realistic failures before live use and have the required reviewer challenge the evidence and unresolved risks before approval. | Test cases, results, fixes, retests, review findings and approval conditions. |
| Cybersecurity | Protect candidate records, administrative settings, model integrations and workflow actions from unauthorised access or manipulation. | Security review, access model, incident route and supplier evidence. |
| Auditability | Keep enough context to reconstruct which criteria, configuration, output and human action contributed to a past decision. | Criteria or instruction version, output, timestamps, reviewer action and change history. |
| Monitoring and change management | Watch for recurring errors, complaints, reviewer disagreement, technical failures and material model, instruction or integration changes. | Metrics, thresholds, investigations, change log and retest decisions. |
| Fallback and exit | Be able to continue hiring safely when the AI is unavailable, suspended or no longer acceptable to use. | Manual route, stopped automations, data return/deletion process and exit plan. |
The strongest evidence is usually a record of a realistic failure being detected and corrected, not a policy saying that failures should be detected and corrected.
Ask the AI recruitment vendor for evidence, not a compliance label
Ask beyond whether the supplier is “MAS compliant.” Request evidence that lets the institution assess the specific hiring use itself.
We are assessing your service for AI-assisted recruitment within a MAS-regulated financial institution.
Please provide:
1. The AI functions used in our workflow, what each produces and which downstream actions can use the output.
2. The model or service providers involved, including material dependencies, and how we are notified when AI functionality or a material provider/model changes.
3. The candidate data each function receives, its permitted uses, and whether our recordings, transcripts or assessments are used to train or improve any model.
4. How a recruiter can trace an assessment to the relevant candidate evidence and job criterion, including how missing, uncertain or failed inputs are shown.
5. How a reviewer corrects an error or overrides an assessment, and whether downstream actions use the corrected result.
6. The testing you perform before release and after material changes, including known limitations.
7. Independent assurance available for the relevant service, with its scope and limitations.
8. The logs and records available to investigate a disputed assessment or incident.
9. The fallback, suspension and exit options if the AI service fails or no longer meets our requirements.
Please distinguish current product behaviour from planned features.
Security certifications and assurance reports can support due diligence, but they do not establish that a hiring assessment is fair or appropriate for the institution’s use.
MAS says financial institutions should obtain sufficient assurance from third-party providers, assess whether the AI is suitable for the intended use, and apply compensating controls where assurance gaps or practical constraints remain. For a recruitment use, representative acceptance testing is one practical way to support that assessment. MAS announcement
Keep AI risk materiality separate from outsourcing or third-party materiality. The same provider may require both assessments, but one does not replace the other.
Test failure paths before launch, not just the happy path
A polished demonstration tells you what the normal path looks like. Test cases tell you whether the controls work when something goes wrong.
Create authorised sample applications and plant the problems deliberately.
| Test case | What you are trying to learn |
|---|---|
| Relevant experience described in unfamiliar terminology | Does the system assess the actual capability or over-rely on one employer, job title or software keyword? |
| Candidate answer is incomplete | Does the system preserve uncertainty or invent a reason to pass or reject? |
| Transcript contains a material error | Can the recruiter find the source, correct the record and make sure the old assessment no longer drives the next action? |
| AI recommends rejection but source evidence supports the criterion | Can a reviewer recognise the conflict, override the result and record why? |
| Interview or assessment fails technically | Does the application remain visible with a clear fallback, rather than silently becoming a poor score or missing application? |
| Automatic stage move or message is disabled for the pilot | Does the integration actually respect that configuration, including queued actions? |
| Vendor changes a model or material instruction | Will the institution know what changed, decide whether retesting is needed and preserve the prior decision record? |
Have the person who will perform the real review use their normal permissions. A control that works only for the system administrator is not evidence that the recruiter can use it.
Record the failure, fix and retest. If a candidate-facing error could have affected other applications, define how the institution would find and reconsider those cases.
Train people for the controls they actually perform
MAS also expects financial institutions to build the capabilities and capacity needed for responsible AI use. Training should match the control a person is expected to perform. MAS announcement
| Person | They should be able to |
|---|---|
| Recruiter or hiring manager | Use job-related criteria, check material evidence, recognise uncertainty or failure, change an incorrect outcome and escalate recurring problems. |
| System administrator | Understand permissions, automation, logs, change controls, fallback and how to stop an unintended action. |
| Risk or control reviewer | Challenge materiality, understand the limits of vendor evidence and decide when another test, validation or escalation is needed. |
A generic “responsible AI” course is not evidence that a recruiter can perform the control. Test that skill with a planted-error case. For job redesign as employees adopt AI, see AI job redesign in financial services.
Record the deployment decision
A test log shows what happened. The decision record shows what the institution is actually approving.
A limited deployment decision could read:
Decision:
Approve a limited pilot for first-stage operations hiring.
Approved scope:
AI interview, transcript, evidence summary and recruiter-facing assessment.
Human oversight:
A recruiter reviews the source evidence and assessment before deciding whether the applicant progresses.
Automation:
No automatic rejection, stage move or candidate message.
Known limitations:
Transcript accuracy and assessment quality have been tested on the approved pilot cases only. The pilot does not establish an error rate for all roles, languages or candidate populations.
Pause and investigate if:
- a material assessment conflicts with the source evidence and the reviewer cannot correct it before action;
- an application disappears from the normal review path because the AI fails;
- an unauthorised stage move or candidate message occurs; or
- the vendor introduces a material model, provider or workflow change that could affect the approved use.
Reassess before:
adding automatic rejection, adding materially different roles or languages, changing the candidate data used, or materially changing the AI service.
Owner:
Talent Acquisition lead, with the institution's required risk and control approvals.
Review:
At the end of the pilot and earlier if a pause or reassessment trigger occurs.
Someone reading the record later should be able to tell which use was approved, under which controls and what would make that approval stale.
The final guidelines recognise that pilots and phased rollouts can require adjusted controls. Treat “pilot” as a bounded use with explicit limits, monitoring and success criteria, not as a reason to skip governance. MAS AI Risk Management Guidelines
What should you monitor after launch?
Choose monitoring signals based on whether they show the hiring control is still working, not simply on what the product dashboard exposes.
| Signal | Question it helps answer |
|---|---|
| Missing or technically failed assessments | Are applications disappearing from the normal review path when the AI cannot produce a result? |
| Transcript or source corrections | Are upstream data errors materially changing assessments, and are certain workflows or languages producing more corrections? |
| Recruiter disagreement or override | Where do reviewers repeatedly reach a different conclusion after checking the source evidence? |
| Proposed rejection reversals | Are qualified applicants being recovered only because a human catches the AI recommendation? |
| Candidate complaints or challenges | Are there recurring issues with records, explanations, access or the interview experience that internal testing missed? |
| Model, instruction or provider changes | Did the system change enough that the previous assessment and test evidence may no longer describe the live workflow? |
| Reviewer completion and source-check behaviour | Is the intended human review still happening after the team becomes familiar with the tool? |
An override rate is not automatically evidence that the model is bad, and a low complaint rate does not prove fairness. Use the signals to decide what to investigate. Keep enough context to distinguish a model error from a bad job criterion, a transcript problem, a reviewer mistake or a technical failure.
If the use processes interview recordings, transcripts or other candidate records, keep the monitoring design connected to the institution’s actual retention decisions. See How long should you keep candidate data in Singapore? for the separate retention question.
Keep an evidence pack another reviewer can reconstruct
Keep a compact record that lets another reviewer challenge the decision to use the system:
- the use-case description and AI inventory entry;
- the materiality assessment and owner;
- the data flow and relevant privacy or security review;
- vendor due diligence, contracts and applicable assurance;
- evaluation plan, sample cases, results and unresolved limitations;
- deployment approval and any conditions;
- reviewer instructions and escalation route;
- monitoring metrics and thresholds;
- change history and retest decisions;
- incident, candidate-challenge and fallback procedures.
Reuse existing records where they already answer the question. MAS expressly allows existing governance structures to do the work when they provide adequate oversight. The same principle should apply to the evidence: do not create a second document merely to rename an existing control “AI.”
How does this fit with Singapore’s hiring and privacy rules?
Treat AI governance, fair employment, privacy and security as separate reviews, even when they rely on the same facts. A data flow or test result can support several reviews; passing one does not satisfy the others.
| Question | Primary lens |
|---|---|
| Are we governing this AI use appropriately as a financial institution? | MAS AI Risk Management Guidelines and the institution’s own risk framework. |
| Are the hiring criteria and process fair and job-related? | Singapore’s current fair-employment framework, including the TGFEP and FCF where applicable, plus the institution’s employment practices. |
| Can we collect, use, retain and transfer the candidate data this way? | PDPA and the institution’s privacy assessment. |
| Can the system and its integrations be operated securely? | Applicable technology, cyber, operational and third-party risk controls. |
MOM currently says the Workplace Fairness Act will be implemented at the end of 2027. A 2026 review should therefore distinguish today’s fair-employment framework from the future statutory regime. MOM, 7 October 2026
For the employment and data-protection side, see AI hiring in Singapore: current rules and practical safeguards.
What changed from the 2025 consultation to the final Guidelines?
If you worked from the draft, five changes are worth updating in your notes. MAS response to feedback
| Final position | Why HR should care |
|---|---|
| The draft’s “integrated into business processes” dependency test was removed. | Focus on material impact, not whether a tool is merely internal or connected to an ATS. |
| Materiality is assessed at the AI use-case level. | CV summarisation, interview assessment and automatic rejection can warrant different treatment inside one product. |
| Identification reaches embedded AI in material third-party services. | An existing vendor adding AI can change the institution’s AI perimeter even without a new procurement. |
| A dedicated AI committee is not required solely for these Guidelines. | Use existing governance where it provides adequate oversight and cross-functional coordination. |
| Implementation is explicitly phased. | Build the governance and materiality foundation by 2027; lifecycle controls and capability follow by 2028. |
Official sources and companion frameworks
Use the source that matches the question.
| Resource | Use it for |
|---|---|
| MAS Guidelines landing page | Status, effective date and the official list of regulated entities in scope. |
| Official Guidelines PDF | The detailed supervisory expectations. |
| Response to feedback | How MAS resolved questions on proportionality, embedded and third-party AI, independent review and implementation. |
| Project MindForge | Implementation material, including the Operationalisation Handbook and financial-institution examples. |
| FEAT principles | Fairness, ethics, accountability and transparency considerations around AI and data analytics. |
If your institution already uses MindForge artefacts such as its AI Card, risk taxonomy or metrics library, map the recruitment use into those records instead of creating an HR-only parallel process. Reuse the institution’s existing formats rather than creating separate HR templates for the same controls.
MAS AI Risk Management Guidelines: practical HR questions
| Question | Answer |
|---|---|
| Are the MAS AI Risk Management Guidelines mandatory? | They are not a Singapore-wide statute. MAS says the Guidelines set supervisory expectations and apply to financial institutions. An institution in scope should assess and implement them through its normal regulatory, risk and compliance processes. MAS Guidelines |
| Are these Guidelines a new Singapore-wide AI hiring law? | No. They are MAS supervisory guidelines for financial institutions. Other employers should not treat them as a general Singapore hiring rule. |
| Does every automated ATS workflow count as AI? | No. A rule-based stage move or formula is not AI simply because it is automated. A workflow can mix predefined rules with AI-generated transcripts, assessments or recommendations, so map the components rather than labelling the whole ATS. MAS Guidelines |
| What if our financial institution says it does not use AI? | MAS’s response indicates that even an institution without adopted AI should have basic policies governing whether and how staff may use it. That matters for shadow AI. For example, a recruiter might put candidate information into an unapproved assistant. MAS response to feedback |
| Do we have to submit the AI inventory to MAS by 7 October 2027? | The Guidelines do not set out a general filing deadline requiring every financial institution to submit its AI inventory on that date. The institution should be able to demonstrate its identification, inventory and materiality process, while handling any institution-specific supervisory request separately. |
| Is AI risk materiality the same as outsourcing or third-party materiality? | No. AI risk materiality concerns the AI use case; outsourcing or third-party materiality concerns the service arrangement. The same vendor may require both assessments, but one does not replace the other. |
Start with one rejected-candidate simulation
Take one proposed recruitment use and create a test application where the AI recommendation conflicts with the candidate evidence.
Can the recruiter find the source, explain the criterion, correct the assessment and prevent the wrong action? Can the institution reconstruct what happened afterward?
If not, you have found a governance gap before a real applicant does.
That is the practical value of the MAS framework for HR: turning an AI hiring workflow into something the institution can identify, assess, test, monitor and stop when necessary.
This article provides general information. It is not legal advice, a MAS interpretation, certification or a determination that a specific use case meets MAS expectations. Financial institutions should apply the final MAS Guidelines and their own legal, risk, privacy, security and employment processes to each use case.
