Raffles Consulting Services
Apply MAS AI life cycle controls to data, testing, monitoring, model changes, vendor updates, human oversight and retirement evidence.
MAS AI life cycle controls should follow an AI use from approval through change and retirement, not stop when a model is launched. Financial institutions need evidence for data governance, testing, human oversight, cybersecurity, monitoring and change management in proportion to risk. A vendor update or new use can materially alter the approved risk even when the product name stays the same.
Define the approved AI use and materiality boundary
Record the entity, business process, users, affected customers, decision supported, data sources, model or service version, provider and accountable owner. State what the AI may do, what requires human approval and what it must never decide. Link the use to the institution’s materiality assessment and applicable policies.
The MAS AI risk-management guidelines apply to all financial institutions and all forms of AI from 7 October 2027. The MAS media release highlights inventories, risk materiality and proportionate controls across the life cycle. Existing privacy, security, conduct and outsourcing duties still apply before that date.
Set change triggers before monitoring begins
List triggers for new data, drift, performance deterioration, vendor release, prompt or policy change, integration change, expanded user group, new customer effect and material incident. Define who may approve each change and which tests must be repeated. A monitoring alert needs a decision path, not only a dashboard.
Use the MAS AI readiness map for enterprise governance and the human-override test for intervention evidence. Keep this guide focused on the chronology of one AI use and its versions.
Retire the use without losing evidence
Define the stop decision, replacement process, customer or staff communication, access removal, retained data, model artefacts, unresolved incidents and audit record. Test that the old service cannot continue through an undocumented interface or spreadsheet. Where a vendor hosts the system, confirm deletion and continuing evidence access under the contract.
Preserve the final inventory status, last approved version, monitoring history and reason for retirement. If a model is replaced, do not copy the old approval to the new use. Run a fresh materiality and control assessment for the actual data, decision and operating context.
Turn the decision into a controlled file
Use a dated decision record that identifies the applicant, business need, current official source, chosen route, responsible owner, costs, milestones and evidence. Separate facts already verified from forecasts and assumptions. A catalogue listing, supplier statement, consultant recommendation or portal acknowledgement does not establish approval. The company remains responsible for its declarations and commercial decision.
Give each quotation, contract, invoice, payment and deliverable a stable reference. Preserve earlier versions and explain material changes instead of silently replacing them. Where the authority, tax adviser, auditor or another professional must decide a point, record the open question and obtain the required view. Do not convert uncertainty into a confident eligibility statement.
Review before commitment and again before closeout
Run four reviews: suitability, authority, implementation and closeout. At suitability, test the entity, activity and business outcome. Before commitment, freeze the proposed scope, vendor and financial assumptions. During implementation, compare actual work with approved terms. At closeout, reconcile deliverables, accepted results, invoices, full payment, operating evidence and obligations that continue.
Name the person who may approve each stage and the records that person must see. Procurement should not treat a draft application as permission to contract. A project team should not treat supplier completion as company acceptance. Finance should not treat a submitted claim as cash received. Clear status words prevent accidental commitments and weak reporting.
Handle exceptions without rewriting history
Maintain an exception log for changed facts, delayed milestones, supplier variations, cost movements, missing records and failed tests. State the effect on scope, eligibility, timing and expected value. If an authority decision or formal variation is required, use the published route before relying on the change. Silence and helpdesk receipt are not approval.
If a material defect appears, pause the affected acceptance, filing or claim item. Keep original evidence, assign corrective action and set a review date. Do not backdate records, move costs between categories or adjust a baseline after seeing the result. A candid exception with an owned resolution is more credible than a clean-looking file that cannot explain what happened.
Plan handovers before the original project team disperses. The handover should identify the current version, source locations, system access owner, next review date, open exceptions and any condition that continues after payment or filing. Restrict personal, financial and commercially sensitive records to authorised users, while giving each responsible owner enough information to perform the assigned control. Record the external event that should trigger an earlier review, such as a changed programme page, revised authority letter, supplier failure or material business change.
Verify the final outcome independently
Ask someone who did not prepare the final pack to compare the decision, current official source, approved terms, deliverables, payments and operating evidence. Recalculate totals and sample source records. The reviewer should be able to reproduce the conclusion without relying on the preparer’s memory. Record unresolved points with named owners and dates.
Use the Singapore business support cornerstone for the wider decision and keep this article as the narrower operating guide. After submission, preserve the receipt and reconcile questions, adjustments and the final registered or paid outcome. Continue any reporting, retention, asset-use or other condition that survives closeout.
Practical review checklist
- Use and materiality defined
- Version and data recorded
- Change triggers approved
- Monitoring decisions reproducible
- Retirement evidence retained
The life-cycle file is credible when reviewers can identify the approved version, reproduce monitoring decisions, see who authorised each material change and confirm that retirement removed the old risk without erasing evidence.