The Singapore MAS AI consultation closed five months ago. The transition clock has not started. That gap is not a delay. It is the only unobserved building time you will ever be given, and most institutions are spending it waiting for a document.
On 10 June 2026, the Monetary Authority of Singapore published a consultation paper on proposed amendments to its Notices on Technology Risk Management. It closes on 31 July 2026, and MAS proposes that the revised Notices “shall take effect 12 months after the date that the finalised Notices are published.” Eight domains, including immutable offline backup and unplanned-outage monitoring — the sort of requirement that reads dull and costs a great deal.
That is the third technology-governance instrument MAS has put into the market in seven months. On 13 November 2025 came the Consultation Paper on Guidelines on Artificial Intelligence Risk Management, closing 31 January 2026, with a proposed twelve-month transition after issue. On 6 March 2026 came the proposed Guidelines on Third-Party Risk Management — which supersede the Outsourcing Guidelines and extend from institutions with outsourcing arrangements to all institutions that rely on third-party services, a scope change that quietly captures almost everyone — closing 20 April 2026, with a proposed transition of six months rather than twelve.
Three consultations. Seven months. One direction.
And in the middle of it, the AI Guidelines sit finished-but-not-final. The consultation closed on 31 January. It is July. The transition clock has not started, which means — and this is the part the industry has been reading exactly backwards; the observation period has not started either.
The consensus is treating the gap as a delay
Ask a Steering Committee what it is doing about the AI Risk Management Guidelines and you will hear a version of the same sentence: we are waiting for the final text. It is said with a certain professional dignity, as though waiting were a form of diligence. The logic is not stupid. Why build against a draft that may move? Twelve months of transition is generous; when the document lands, we will start.
The mistake is subtle, and it is a mistake about what a transition period is.
Every regulatory briefing this year has framed the sequence as: draft, wait, final text, transition, comply. Read it that way and the gap between consultation-close and publication is dead time, a delay imposed on you by someone else’s calendar. But the gap is not dead. It is the last stretch of road in which what you build is not yet evidence. Once the Guidelines are issued, your AI inventory stops being an internal artefact and becomes a supervisory one: dated, versioned, and read backwards by someone with the benefit of hindsight and the full text in front of them.
The thesis
A transition period is not when you build. It is when you are watched building. The only unwatched construction time you will ever get is the gap you are currently spending on waiting, and the parts of the Guidelines you can safely build against today are precisely the parts nobody is arguing about.
That second clause is the practical half, and it deserves stating plainly, because it inverts the instinct: the boring provisions are the safe ones. Consultation feedback moves thresholds, carve-outs, proportionality language and definitions at the edges. It almost never moves the spine. What survives from draft to final is what nobody bothered to contest, and what nobody contests is what everybody already accepts they must do.
What follows:
- Why the seven-month, three-track sequence is one instrument, not three
- The invariants — the provisions that cannot change, and can therefore be built against today
- The contested layer — where the final text will move, and what to build so the move costs a calibration rather than a rebuild
- The convergence — why your AI inventory, your third-party register and your IT asset inventory are one object seen from three angles
- A diagnostic to run before Friday that tells you, with one number, whether you have an AI inventory or a list
The framework: build the invariants, scaffold the contested, converge the registers
TRIZ has a name for the situation where a system is fought over on its most visible axis while the real constraint sits somewhere unglamorous: wrong problem segmentation. The visible axis here is the deadline. The real constraint is the sequence of work, most of which does not depend on the deadline at all.
Three tiers. The first can start this month with no further information from anyone. The second can be scaffolded now and calibrated later. The third is where institutions treating the three tracks as three programmes will discover they have built the same register three times.
Tier One — Foundation: build the invariants
1. The AI inventory — and the deletion that comes first
The universal pattern. You cannot govern a population you have not enumerated. Every governance regime begins with a register, and every register begins with an argument about what counts as a member. The argument about membership is the actual work; the list is the residue.
The regulated-industries manifestation. MAS is unusually precise here. The consultation defines AI across three objects: a model (”method or approach that converts assumptions and input data into outputs such as estimates, decisions or recommendations”), a system (”can comprise one or more models and other machine-based components”), and a use case (”specific real-world context that the model or system is applied to”). Then it draws a boundary most institutions have not yet felt: “Calculators or tools whose outputs are solely based on predefined programming logic or rules would not be regarded as AI.” The requirement is an “accurate and up-to-date inventory of AI use cases, systems or models... maintained across the FI.”
Note what that boundary does. It does not expand your inventory. It shrinks it. Somewhere in your organization is a deterministic rules engine that acquired the word “AI” during a budget cycle and has been carrying it ever since, like a knighthood. It is not in scope. Removing it is not a loophole; it is the first act of governance — and it is free.
Your translation. The inventory is not a spreadsheet exercise for the AI team. It is a definitional exercise run across every business and functional area, resolving three questions per candidate: is it a model, a system, or a use case; is it in scope under the rules-based exclusion; and who owns it. Model risk, technology and the business owner sign each row.
What to build by Friday. A one-page inventory schema — the columns, the in/out test, the named owner per row. Not the populated inventory. The schema. Populating it is a quarter’s work and it cannot begin until people agree what a row is.
2. AI identification — the process, not the artefact
The universal pattern. A register decays the moment it is completed. What a supervisor examines is not whether your list was right on the day it was written, but whether the machinery producing it is capable of staying right. An inventory is an output. Identification is a system.
The regulated-industries manifestation. MAS separates the two deliberately. Alongside the inventory sits the expectation that “systems, policies and procedures should be established to ensure consistent identification of AI usage across all relevant business and functional areas,” with “clear roles and responsibilities for AI identification” assigned. Consistent. Across all areas. Assigned. Three words doing an enormous amount of work — because AI in a regulated institution no longer arrives through the AI team. It arrives inside a procurement bundle, inside a SaaS release note, inside a feature nobody asked for and everybody enabled.
Your translation. Identification must be attached to the places AI enters: procurement, vendor change notification, the software development lifecycle, the annual attestation from each functional head. If it lives only in the AI CoE, you have built a searchlight and pointed it at your own feet.
What to build by Friday. A one-page identification map: the doors through which AI enters your institution, and the named control at each. The doors you cannot name are your finding.
Tier Two — Process maturity: scaffold what will be calibrated
3. Risk materiality — the method is fixed, the thresholds are not
The universal pattern. Proportionate regimes split into a method and a dial. The method; how you asses, is structural, and survives because nobody contests it. The dial; where the threshold sits, what counts as material, who is exempt — is where every industry response spends its ink. Build the method; leave the dial loose.
The regulated-industries manifestation. MAS is explicit about the method and silent about your dial. It expects an assessment methodology considering “the inherent risk materiality of an AI use case, system or model before appropriate risk management controls are applied” and “residual risk materiality after risk management controls are applied,” across risk dimensions “at a minimum, covering impact, complexity and reliance.” Inherent and residual. Impact, complexity, reliance. That structure is not going to change in the final text — it is the least controversial paragraph in the paper. What may change is how hard MAS presses on proportionality. Industry responses broadly accepted the twelve-month transition; what they asked for was checklists, toolkits and templates. That is a request for dials, not for a different method.
Your translation. Build the scoring instrument now with the three MAS dimensions as fixed axes and your thresholds as configurable parameters. When the final text lands, you turn dials. You do not rebuild an instrument.
What to build by Friday. A one-page materiality rubric: three axes, a scoring scale, an inherent column and a residual column, and one worked example on your highest-stakes live use case. If the worked example takes more than an hour, your scale is too clever.
4. Third-party AI — the line you cannot delegate
The universal pattern. Responsibility for a system does not transfer with the invoice. This is the oldest principle in outsourcing supervision and the one most reliably forgotten the moment a technology is new enough to be frightening.
The regulated-industries manifestation. AIRM expects institutions to ensure “onboarding, development and deployment controls for third-party AI are adequate for the risk materiality of the use case, system or model that uses or depends on third-party AI.” Read that beside the TPRM proposal of 6 March 2026, which supersedes the Outsourcing Guidelines and applies not only to institutions with outsourcing arrangements but to all institutions relying on third-party services — on a proposed six-month clock rather than twelve. The AI you did not build and the vendor you did not classify as an outsourcing arrangement are converging on the same register, on the shorter clock.
Your translation. Your third-party AI population is almost certainly larger than your AI inventory and your outsourcing register combined, because it includes AI features shipped into tools you already own. Someone must own the sentence ”we do not delegate governance to the vendor” and be able to show what that sentence costs.
What to build by Friday. A single joined view: for each third-party arrangement, does it contain AI; for each AI use case, is it third-party. The cells where the two answers disagree are the reason those must stop being two registers.
Tier Three — Scale: converge the registers, and buy the capability early
5. One register, three tracks
The universal pattern. When a supervisor upgrades three adjacent regimes inside one cycle, they are not asking for three programs. They are describing a single object — the institution’s technology estate, from three angles.
The regulated-industries manifestation. Set the three consultations side by side. AIRM wants an AI inventory. TPRM wants a register of third-party arrangements. The proposed TRM Notice amendments want a complete IT asset inventory across hardware, software and cloud, with lifecycle tracking. These are not three inventories. They are three projections of one estate. Note too the direction of legal travel: TRM requirements are moving from Guideline (supervisory expectation) into Notice (statutory obligation). The soft instruments harden.
Your translation. Design the AI inventory as a view over the asset and third-party registers, joined on a common identifier — not as a standalone artifact belonging to the AI function. The institution that gets this right answers a supervisor’s cross-cutting question in an afternoon. The ones that do not answer it in a quarter, from three systems, with three reconciliations and one apology.
What to build by Friday. A one-page data model: the three registers, the join key, the owner of the key. A fifteen-minute drawing that saves a nine-month integration.
6. Capability and capacity — the longest lead time in the paper
The universal pattern. Every control in a governance framework can be documented in weeks. The people who can operate it cannot be hired in weeks. Capability is always the critical path, and always the line item the deadline-driven program discovers last.
The regulated-industries manifestation. MAS expects an institution to “determine and ensure the necessary competence and proper conduct of personnel involved in developing an AI use case, system or model,” with regular review that they are “equipped with adequate capabilities and capacity for effective AI risk management.” This is the only expectation in the paper on which no consultation response will win you relief, because there is nothing to argue with. You either have people who can evaluate a model’s fairness, or you have a policy that says you do.
Your translation. Count the people who could independently challenge a model’s evaluation evidence and be believed by your regulator. If the number is under three, that is your program risk, and it will not be solved inside a twelve-month transition window — particularly one shared with two other tracks and a market of institutions hiring the same people at once. The cross-sector reader should sit up here: the same bottleneck governs a pharmaceutical firm’s model validation function under EMA scrutiny, an energy operator’s control-system assurance, and a hospital group’s clinical algorithm review. The regimes differ. The scarcity does not.
What to build by Friday. A named list. Not roles — names. The gap between the roles you have written down and the names you can write next to them is the honest state of your capability.
A note on confidence
Confirmed: the dates, scope and quoted expectations above come from the published MAS consultation papers of 13 November 2025, 6 March 2026 and 10 June 2026, and the law-firm analyses that followed them. The definitional boundaries, the four AIRM domains, the twelve- and six-month proposed transitions, and the eight TRM domains are matters of public record.
Strong inference: that the AIRM final text will retain the inventory, identification and materiality structure essentially intact. I cannot confirm this. MAS has not published a Response to Consultation at the time of writing, and I have no visibility into the feedback beyond the published industry responses. The inference rests on a pattern, not a promise: provisions that attract no contest survive; provisions that attract contest get calibrated. If you believe the spine will move, do not build against it. I would take that bet.
Design hypothesis, offered as such: that institutions treating the three registers as one data model will materially outperform those treating them as three programs. This has not been tested at scale in this cycle. It is what the structure of the three papers implies, and it is what I would build.
The two lists
Here is a diagnostic that costs an hour and reliably ruins an afternoon.
Ask two people — one from technology, one from a business function that has been buying software, to independently write down every AI system in production in your institution. Do not let them confer. Then lay the lists side by side.
The union will be longer than either list. The intersection shorter than both. And the interesting number is neither: it is the count of items appearing on exactly one list. That is not a measure of your inventory. It is a measure of your identification process, and if it is not close to zero, then what you are maintaining is a list, not an inventory. An inventory is a thing two people arrive at independently.
The most common finding is not that items are missing. It is that the two people disagree about whether an item is AI at all — which, given that MAS has published a definition excluding rules-based tools, is a disagreement you can settle this week rather than during an inspection.
The Prompt Kit
Reading a framework is pleasant. Discovering which parts of it your institution has silently skipped is what changes next week’s plan.
Prompt Kit 08 does that work: four sequenced prompts taking you from an unstructured description of your AI estate to an inventory schema with a working scope test, an identification map with named door-controls, a materiality rubric scored on the three MAS dimensions, and a gap statement written in the language a supervisor uses rather than the language a program manager uses. It runs in an afternoon, by someone who is not a model risk specialist, and produces an artefact you would be willing to show.
It is not a compliance product. It is a way of finding out how much of the gap you have already spent.
Before Friday
Run the two-list test. Then do one more piece of arithmetic, and do it honestly.
The AI Risk Management consultation closed on 31 January 2026. Count the working days between that date and today. That is the unobserved build time your institution has been given, days in which nothing you produce is yet evidence, nothing you revise is yet a version history, nothing you get wrong is yet a finding. Now, put next to that number the count of AI-governance artefacts your institution has actually produced in that window.
The first number will be in the hundreds. The second, for most readers, in the single digits. The uncomfortable part is not the ratio. It is that the ratio was a choice, made by nobody in particular, in a series of meetings where the sentence ”we are waiting for the final text” was said aloud and no one asked what, precisely, we were waiting to be told.
You already know what the inventory needs. You have known since November.
If you are inside this window, you want an AI inventory that is really a list, three registers that are really one estate, a materiality method waiting on a threshold, and you want a structured outside read on where your identification process leaks, how your registers should join, and which capability gaps cannot be closed inside a transition period, mention it in your reply.
I take one such conversation per month.
Replies to this post reach me directly. I read all of them.