Singapore AI Governance for Insurers: Preparing for the 2027 Compliance Phase-In

Singapore AI governance for insurers is moving from voluntary principles to supervisory expectation. MAS has signalled that AI risk management requirements for financial institutions will phase in from 2027, and insurers that use AI in underwriting, claims, pricing, distribution or fraud detection should start preparing now. The practical work is the same regardless of the final wording: build a complete inventory of AI use, classify each use case by materiality, assign accountable owners, bring third-party AI tools under vendor governance, and give the board a clear line of sight. Insurers that begin in 2026 will have a full planning cycle; those that wait will be doing it under supervisory time pressure. Confirm the exact scope, definitions and transition dates against the final MAS publication before locking your programme timeline.

Where Singapore AI Governance Stands

MAS has built its approach over several years. The FEAT principles (Fairness, Ethics, Accountability and Transparency), issued in 2018, set the baseline expectation for AI and data analytics in financial decision making. The Veritas initiative then produced assessment methodologies and open-source tooling so firms could test fairness and transparency in practice, with insurance use cases among those covered.

Project MindForge, led by MAS with industry participants, moved the discussion to generative AI and produced a risk framework and practical guidance on managing it. For insurers, the relevance is direct: generative AI is already appearing in policy servicing, claims triage, agent support and document summarisation.

The next step is the shift from guidance to supervisory expectation. MAS has published a consultation on AI risk management guidelines for financial institutions and an AI risk management toolkit, and the phase-in described for 2027 means the toolkit's structure is a reasonable preview of what supervisors will examine. Read the toolkit as an inspection guide, not as optional reading.

Build the AI Inventory First

Every other governance step depends on knowing what AI the insurer uses. Many insurers discover during a first inventory that AI is more widespread than central teams assumed, because business units have adopted embedded features in vendor platforms without a formal approval process.

A defensible inventory covers, at a minimum:

• Models built in house, including machine learning used in pricing, reserving support, lapse prediction and fraud scoring
• AI features embedded in vendor systems, such as claims platforms, underwriting workbenches, chatbots and customer analytics tools
• Generative AI tools used by staff, whether provisioned centrally or accessed independently
• AI used by intermediaries, agents and outsourced service providers on the insurer's behalf

For each entry, record the business purpose, the data used, the decisions or customer outcomes it influences, the owner, the vendor if any, and the date of last validation. An inventory that is a spreadsheet maintained by one person will not survive an inspection. Assign ownership of the register to a named function, typically second line risk or technology risk, and require business units to attest to completeness at least annually.

Classify by Materiality and Customer Impact

Proportionality is central to the MAS approach. Not every AI use case needs the same controls, and a uniform heavy process will either stall adoption or be quietly bypassed. Classify each use case using a small number of factors:

• Impact on customers: does the output influence pricing, acceptance, claims outcomes or access to products?
• Degree of autonomy: does a human review the output before it takes effect, or does the system act on its own?
• Data sensitivity: does the system use health, financial or other personal data, including data covered by the Personal Data Protection Act?
• Complexity and explainability: can the insurer explain why a particular output was produced?
• Financial and conduct exposure: could errors cause material mispricing, reserving error or unfair treatment of a customer group?

High materiality use cases should require independent validation before deployment, documented fairness testing, defined performance thresholds, monitoring for drift and a tested fallback process. Lower materiality use cases can follow a lighter approval path, but they still belong in the inventory.

Underwriting and claims decisions deserve particular attention. An AI-assisted claims triage tool that systematically routes certain claimant groups to slower handling is a conduct issue under the MAS Guidelines on Fair Dealing, as well as a model risk issue. Fairness testing should look at outcomes across relevant customer segments, not only at overall accuracy.

Bring Third-Party AI Under Vendor Governance

Third-party AI risk in Singapore insurance is likely to be the largest practical gap. Many insurers rely on vendors for AI capability and have limited visibility into how models were trained, tested and updated. The MAS Guidelines on Outsourcing and related notices already make the insurer accountable for outsourced activities. AI does not change that accountability; it makes it harder to discharge.

Update vendor due diligence and contracts to address the following:

• Disclosure of where AI is used in the product or service, and notice of material model changes
• Rights to receive validation evidence, performance metrics and fairness testing results
• Data use restrictions, including whether the insurer's data may be used to train the vendor's general models
• Audit and access rights extending to AI components
• Incident notification covering AI failures, bias findings and security events
• Exit and substitution plans if a model must be withdrawn

Where a vendor will not disclose enough to support the insurer's own risk assessment, record that as a residual risk, escalate it, and decide explicitly whether the use case is acceptable. Concentration risk also needs attention: several core processes depending on one foundation model provider is a resilience question that connects to the insurer's technology risk and business continuity frameworks.

Board Accountability and Three Lines Roles

MAS expects the board and senior management to own AI risk, not to delegate it entirely to technology teams. In practice that means three things.

First, approve an AI risk appetite or equivalent policy statement that sets out what the insurer will and will not use AI for, and the conditions for high-impact use. Second, designate a senior manager accountable for AI governance, with clear reporting lines to the board risk committee. Third, receive regular management information: the number and materiality of AI use cases, validation status, incidents, fairness testing results and open vendor issues.

Across the three lines, first line business owners are accountable for the performance and appropriate use of their AI systems. Second line risk and compliance set standards, challenge materiality classifications and review high-risk deployments. Third line internal audit should include AI governance in its audit universe and plan, which fits with the expectations in Singapore's internal audit requirements for insurers. The ORSA should also reflect material AI-related risks, including model failure, data quality and third-party dependency, where they affect the insurer's risk profile.

A 12-Month Readiness Roadmap

For an insurer starting from a low base, a sequence that works is as follows.

In the first quarter, complete the AI inventory, appoint the accountable executive and agree a materiality framework. In the second quarter, perform a gap assessment against the MAS toolkit and the FEAT principles, and prioritise the high materiality use cases for validation. In the third quarter, update the third-party risk framework and renegotiate contracts at renewal, while drafting the AI policy and risk appetite statement for board approval. In the fourth quarter, run a tabletop exercise on an AI incident, such as a biased pricing output or a vendor model failure, and put regular board reporting in place.

Document the work as it happens. Supervisors will look for evidence that governance operates, not a policy that was written once. Meeting minutes, validation reports, exception approvals and monitoring dashboards are the evidence that counts.

Common Gaps to Avoid

Several weaknesses recur when insurers first assess their AI governance. Inventories omit embedded vendor features and staff use of generative AI. Fairness testing is performed at launch and never repeated. Human oversight exists on paper, but reviewers approve outputs without the information needed to challenge them. Policies refer to AI generally but never define materiality, so every team classifies its own use case as low risk. And boards receive a presentation on innovation rather than a report on risk. Each of these is cheaper to fix before a supervisory review than after.

Next Steps

Alpha Consultant advises Singapore-licensed insurers on enterprise risk management, including governance frameworks for emerging risks. If you want an independent view of your AI inventory, materiality framework or third-party controls ahead of the 2027 phase-in, see our enterprise risk management services and insurtech and digital advisory, or contact us to scope a readiness assessment.