The Brief · Issue #4
Good evening,
Within a day of each other, two financial supervisors put AI risk where the board and senior management answer for it. Singapore issued guidelines with a start date; Canada restated the principle in its risk outlook. This issue is about what a board needs in front of it to carry that accountability, whether or not a supervisor has asked.
▪ THE SIGNAL
What happened. On 7 October the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management, covering all financial institutions and all forms of AI (MAS release, carried by The Asian Banker). Institutions are to ensure that the board and senior management oversee AI risk effectively; no dedicated AI committee is required. They keep an inventory of their AI use, assess how material each use is, and remain accountable for AI that third parties build, run or supply. The Guidelines take effect on 7 October 2027, with two sections phased to 7 October 2028. On 8 October Canada's prudential supervisor, OSFI, released a Semi-Annual Risk Outlook focused on frontier AI and said boards and senior management remain accountable for managing the risks it amplifies (OSFI).
Two surveys published in September, both fielded in May and June, show the starting point. In 248 responses from audit committee chairs and members to Deloitte and the Center for Audit Quality, 29% said their committee holds primary oversight of AI governance, up from 20%. Of those 72, 56% were confident in overseeing it, the lowest of any area surveyed (report). EY surveyed 202 senior AI decision-makers at listed companies with revenue above $1 billion. It found 98% with formal AI governance policies, and 47% whose organisation had not applied its governance process for an urgent deployment (EY).
The analysis. Neither supervisor wrote a new idea: accountability for a risk sits with those who govern, whoever built the system. What is new is the detail of what oversight rests on: an inventory, a materiality judgment for each use, and assurance over AI bought from others. Both surveys are self-reported and drawn mostly from large US companies, and EY's carries a seven-point margin of error: a benchmark, not a measure of any one board. Our read: accountability has been assigned, and the information needed to carry it has not been assembled. A board can test that by asking for the inventory. A policy does not close that gap. Evidence does.
