How to assess AI risk materiality

MAS’s assessment includes impact, complexity and reliance, and considers risk before and after controls.[1] In practice, I would ask whether a wrong output could mislead a client or influence an investment, onboarding or financial decision. I would also consider the information involved, whether the tool can take actions, and whether the person checking it has the expertise and authority to identify an error and stop the output being used. The firm should be able to reconstruct what happened if the use went wrong.

An ordinary meeting summary checked against the meeting record may have limited consequences. Those consequences change if the summary inaccurately records a material approval and staff then rely on it to act. The same distinction applies to slides and periodic reports. Formatting information for internal reference may be relatively straightforward; producing an assessment that management relies on for a consequential decision requires closer attention. For fund management companies in Singapore, for example, the assessment should consider whether AI is assisting with presentation or influencing the firm’s investment, client or control decisions.

For AI used to prepare financial advice about regulated products, my starting point would be to treat the use as material. The output can influence a customer’s decision, and a polished explanation may be persuasive even when it is incomplete, unbalanced or wrong. The firm’s assessment should document the actual use and the reasons for its rating. An internal or external label alone cannot explain the consequences or the level of reliance.

How AI assistance can change a financial sales email

In one compliance review, sampling of client correspondence identified emails that appeared AI-assisted and contained urgency-driven sales language. The numbers and calculations had remained the same. The concern was how the proposition was presented: the wording pressed the customer to act on a limited-time offer and introduced a fear of missing out. Several emails had been sent. The review identified the issue even though no client complaint had been received.

MAS explains that factual information is generally not financial advice, but may become financial advice when presented with the intention of inducing someone to buy, sell or hold an investment product or a class of investment products. Its example compares the historical returns of two products without mentioning their relative risk profiles, potentially steering the reader towards the higher-return product.[2] The full context matters, and MAS separately considers whether the person is carrying on a business of providing financial advice. For an FI’s sales email, unchanged numbers do not settle whether the presentation amounts to advice or is appropriate for the customer.

Checking the figures alone would not have addressed the concern. A reviewer also needs to consider the meaning of the communication, the balance of the explanation and whether the customer is being pushed towards a decision. An authorised representative should read the complete message before sending it and decide whether they would stand behind its claims and tone. Does it reflect the relevant product information and the firm’s sales advisory process? Has rephrasing changed a qualified explanation into something more forceful? AI assistance can make a message fluent and confident, but the person communicating with the customer still needs the subject knowledge and professional judgment required by the firm’s financial adviser compliance arrangements.

What uncontrolled agent access can mean for a trading platform

Another situation involved an existing trading platform whose management wanted to use Claude to analyse client transactions and orders, identify behavioural patterns and explore cross-selling opportunities. By the time the issue was reviewed, some agents had already been given codebase access and were analysing client data. The FI’s staff were not experienced developers. Without code review, independent IT audit or penetration testing, they could not confirm whether Claude had changed code or taken actions that affected data privacy.

The immediate concern was the firm’s inability to establish what the agents could do and what they had actually done. That finding does not establish that a breach or malicious code change occurred; it identifies a gap in management’s ability to oversee the use. A commercially useful objective still needs defined permissions and operating boundaries. Reading client activity, recommending an offer, changing code and executing an action are different capabilities. Management should understand which have been granted, how changes are reviewed and what records are available.

Before extending this use, I would want the firm to explain the permitted purpose, accessible information, available actions, review arrangements and means of stopping the workflow. Uncertainty over those matters should form part of the risk assessment and management’s decision.

Five steps for an AI risk management policy

The following is the approach I would use to turn the firm’s AI usage into a workable set of policies and procedures.

1 Identify the AI tools and their uses

Start with the tools actually being used and the tasks they support. Include staff use and AI features within existing systems. Record the intended outputs, users and connections to operations or client communications. The useful question is what people do with the result: an AI-generated draft may be edited, relied on unchanged or fed into another process. Those are different operating arrangements.

2 Assess materiality for each use

Assess the consequences of an error, the information involved, the complexity of the use and the degree of reliance. Record the reasons for the rating and how existing controls affect the risk. A personal drafting aid may be relatively limited, while an internal tool that determines customer risk ratings or influences investment decisions can have significant consequences. The assessment should follow the actual workflow.

3 Establish the Human-in-the-loop review and escalation

For material uses, define who reviews the output or decision before it is relied on, what they must check and when they must escalate. Reviewers need relevant expertise and the ability to challenge the result. Consider an AI tool that proposes low, medium or high customer risk ratings during onboarding: a competent reviewer should assess the underlying customer information and relevant red flags. Accepting the label without considering its basis leaves the firm dependent on the tool’s judgment. Keep appropriate records of the decision, review and exceptions so that management and compliance can understand how the controls were applied.

4 Consider the information supplied to the tool

Identify whether the use involves confidential or personal information and whether it fits the firm’s approved data-handling arrangements. A commercial subscription or a description such as closed environment does not, on its own, establish how the information is handled.

5 Document the arrangements and check that staff follow them

The policies and procedures should explain permitted uses, responsibilities, review expectations and escalation routes. Staff education makes those expectations usable in day-to-day work. Compliance can conduct proportionate sample checks, review recorded approvals and test whether the arrangements are being followed. Assign owners to findings and track the agreed actions through to follow-up.

First line accountability and compliance monitoring

Enterprise-wide AI use would be difficult to manage if the compliance officer had to read every email or inspect every output before it left the firm. The first line of defence, including the staff member using AI and the person responsible for the resulting activity, needs to understand the risks and perform the required checks. For financial advice, authorised representatives should apply their own expertise and professional obligations before sending material to a customer. Staff education should make clear when ordinary assistance has become a use that needs further review or approval.

Compliance has an education and monitoring role. It can explain recurring problems, sample communications and other outputs, and check whether staff can demonstrate the reviews required by the policy. Management needs to ensure that the firm has suitable oversight and resources.[1] Retained correspondence can show what was sent, but it should be supported by relevant review, approval and follow-up records. An email backup by itself does not show that someone checked the output competently.

If a workflow allows hallucinated facts or misleading advice to pass into client financial communications, my recommendation is to stop that defective use and investigate. The firm should establish what went wrong, assess affected outputs and decide what needs to change before the workflow resumes. The investigation should address the process that allowed the error to pass through, including staff understanding and supervision. The same approach to review ownership and monitoring can inform insurance-broker compliance work where staff use AI in broking operations or client communications.

Common questions about AI risk management in Singapore

Is using AI to reply to emails or do research always immaterial?

No. The assessment depends on how important the communication is, who relies on the research, and what could happen if the AI output is wrong.

For example, if AI is used to draft an email containing financial advice that may influence a client to purchase a product, that is very different from using AI to rewrite an internal administrative email.

In that situation, the representative remains responsible for reading, checking and approving the content before it is sent.

The same principle applies to research. If senior management, an investment team or a client is relying on the research to make a decision, the potential impact of an incorrect or hallucinated answer is much higher.

Does a business or enterprise subscription replace human review?

No.

A financial institution should not treat an enterprise AI subscription as permission to automate an entire regulated activity without clear human responsibility and oversight.

AI can be extremely useful for replacing junior-level review, repetitive work and high-volume administrative tasks. However, access to an enterprise tool does not mean that every output is automatically suitable for a financial recommendation, customer decision or operational action.

There still needs to be a competent person who understands what the AI is doing, reviews the output where necessary and remains accountable for the final decision.

Should compliance approve every AI output?

No. That would create unnecessary work and friction for the compliance team.

My preferred approach is for the first line of defence to remain responsible for the AI output it uses. The employee or business user benefiting from the AI should also be the first person responsible for checking whether the output is accurate and appropriate.

Compliance cannot realistically babysit every AI-generated email, document or piece of research produced across the firm.

Instead, employees, particularly authorised representatives and staff performing regulated activities, should be trained to review AI outputs properly. Compliance should support this through clear policies, staff education, monitoring and escalation rules for higher-risk uses.

That is a much more practical control than requiring compliance to approve every use of AI.

Putting AI governance into practice

The practical objective is to give the firm a defensible account of its AI use: what it permits, what risks it has assessed, who checks consequential outputs and how it responds when something goes wrong. Begin with a clear picture of the firm’s uses and an initial policy framework, then refine the procedures around actual responsibilities and controls. A policy is useful when staff can apply it and management can check that it works.

At Advisors Assemble, we can help develop AI risk management policies and procedures, identify the tools and uses to assess, review materiality and establish appropriate review and supervision arrangements within an agreed scope. If your firm is already using AI and needs to organise those arrangements, discuss your compliance requirements with Advisors Assemble.

Sources

  1. [1]

    Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management. Issued 7 October 2026; paragraphs 1.1–1.2, 1.8, 3.4–3.5, 4.10–4.13 and 5.9.

  2. [2]

    Monetary Authority of Singapore, Guidelines on Provision of Financial Advisory Service. 10 July 2019; paragraph 3.3.