At a glance
- The risk: An AI use case can outgrow the assumptions that made it acceptable as low-risk.
- The governance implication: Materiality must be reassessed when scope, autonomy, data, dependencies or customer impact changes.
- The leadership takeaway: Name who can reclassify the use case—and pause it—before expansion becomes normal operations.
An AI use case may begin as a low-risk assistant and end up influencing a consequential business decision. The governance problem is deciding when that transition has occurred—and who has authority to stop the expanded use until the controls catch up.
Approval at launch is only a judgment about a defined purpose, scope and risk boundary. It should not become a permanent label attached to a tool while the business changes how the tool is used.
Low Risk Is a Decision, Not a Permanent Label
Risk classification often happens early: the tool drafts text, summarizes internal material or assists a human who remains accountable. Basic controls may be proportionate because poor performance is unlikely to create material harm.
That conclusion can become stale. A summary tool may begin recommending actions. An internal copilot may reach customer data. A limited pilot may spread across business units, or a third-party provider may introduce a more autonomous feature. Each change can alter the financial, operational, conduct or customer consequence of failure without changing the product name in the inventory.
What the MAS Guidelines Establish
Verified source facts: On 7 October 2026, the Monetary Authority of Singapore issued final Guidelines on Artificial Intelligence Risk Management for financial institutions. They apply to all forms of AI used by covered Singapore financial institutions and take effect in phases: oversight and core risk-management expectations from 7 October 2027, and lifecycle-control and capability expectations by 7 October 2028.
MAS permits a risk-proportionate approach. It says basic governance may be sufficient where poor performance or unavailability is unlikely to have a material adverse impact. But even basic governance includes clear accountability, permitted and prohibited uses, effective human oversight, an approved-tool process, compliance checks, and periodic and trigger-based review of whether the use still qualifies for that treatment.
The guidelines are supervisory expectations in Singapore. They are not a universal legal rule, but their logic is useful beyond that jurisdiction: proportionality only works if classification can change.
Expansion Can Outrun Governance
The specific failure is classification drift. The original assessment remains on file while the real use case acquires new data, users, decisions or downstream actions. Monitoring may confirm that the model performs as designed, yet miss that the design is now supporting a more consequential decision.
Change management may miss several small expansions—more users, broader prompts, new integrations and less human checking—that collectively move the use case outside its approved boundary.
Editorial interpretation for review: the control objective is to detect when the basis for the current classification no longer holds, not merely to schedule an annual review.
An Illustrative Insurance Scenario
Illustrative scenario—not a client case: An insurer approves an AI assistant to summarize policy documents for internal reference. Staff review every output, and the use is classified as low-risk. Over time, the assistant is connected to claims information and begins suggesting which files need escalation. Teams rely on those suggestions to manage workload.
The tool now affects which cases receive attention and when. A missed escalation could change a customer outcome. The consequential decision is no longer simply whether a summary is accurate; it is whether the workflow may rely on the tool’s prioritization. That expanded decision requires a new materiality assessment, a named business owner and authority for risk or control functions to pause use.
Reclassification Needs Both a Trigger and an Owner
Leaders should define trigger events before deployment. These can include new customer or confidential data, broader user groups, additional jurisdictions, integration with operational systems, reduced human review, new decision rights, higher transaction volumes, vendor model changes, or evidence that staff rely on outputs beyond the approved purpose.
The use-case owner should be accountable for reassessment, but an independent control function needs authority to challenge the classification. The decision record should show the approved boundary, the change, the inherent and residual risk, required controls, accountable approver and any conditions for continued use.
Governance should intervene before the expanded workflow becomes difficult to unwind—not after an incident proves that the old label was wrong.
Questions for the Leadership Team
- What changes would make this AI use materially different from the use we originally approved?
- Who must initiate and approve reclassification, and who can pause use while that decision is unresolved?
- Can our inventory show the approved purpose and boundary—not merely the tool or model name?
Closing Thought
A proportionate control environment does not mean low-risk use receives permanent light-touch treatment. It means governance follows the real exposure. The most important classification decision may therefore be the second one: the point when an apparently modest tool begins shaping a material business or customer outcome.
Sources and Further Reading
- MAS media release: Supervisory Expectations on Responsible AI Adoption — 7 October 2026.
- MAS Guidelines on Artificial Intelligence Risk Management — final guidelines dated 7 October 2026.
- Beyond1n0: AI Governance Is Failing at the Design Phase.
- Beyond1n0: Before an AI Agent Acts for Your Business, Decide What You Have Authorized.
About Gary
Gary Cheung writes about decision accountability, design-phase governance and executive judgment in AI and information risk. Contact Gary.
