Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
AI adoption in insurance is accelerating. The governance frameworks needed to manage it are not keeping pace. That gap is not a technology problem, it is a leadership problem. And it is where risk quietly accumulates.
AI governance in Singapore's insurance sector is widening a gap that boards are only beginning to recognise: the speed at which AI tools are entering underwriting, claims, and fraud detection is outpacing the governance frameworks MAS expects to see around them. Singapore insurers have always built analytical models, underwriting has been a quantitative discipline for decades, but the MAS Technology Risk Management guidelines and the incoming AI Risk Management guidelines consulted on in late 2025 set explicit expectations for board-level oversight that most insurers' current AI practices do not yet meet. As a former statutory CRO at AIG Asia Pacific, I have seen how quickly model risk can accumulate below board awareness and how difficult it is to retrofit accountability onto tools deployed without governance structures in place. The organisations that govern AI well will treat model inventory, explainability standards, and independent validation as standing governance obligations, not technical footnotes.
And yet the governance challenge is real, and it is not well managed. The speed at which AI capabilities are being integrated into underwriting, claims, fraud detection and customer service is outpacing the speed at which risk frameworks, board oversight and regulatory expectations are developing. That gap is where risk accumulates.
The governance gap is a leadership gap
When I describe this as a leadership problem, I mean something specific. The absence of adequate AI governance in most insurance organisations is not primarily a failure of the technology team or the data science function. It is a failure of senior leadership and boards to ask the right questions at the right time, and to demand accountability for the answers.
What models are we using to make underwriting decisions, and who has accountability for their outputs? What happens when a model produces a decision that a customer or regulator challenges, who in this organisation can explain it, and to what standard? What are the failure modes we have stress-tested for, and what is our remediation plan? These are governance questions, not technology questions. And they are frequently not being asked at board level.
“If your board cannot describe the AI risk it is carrying in the same terms it describes credit risk or concentration risk, you have a governance gap, regardless of how sophisticated your models are.”
Three areas where risk is accumulating
- Model dependency and brittleness. As organisations lean harder on AI-driven underwriting and claims decisions, the failure risk of those models, and the difficulty of identifying and correcting a systematic error,increases. A poorly calibrated fraud detection model, for example, can systematically disadvantage a segment of policyholders before anyone notices.
- Regulatory and liability exposure. Regulators across Asia are developing frameworks for algorithmic accountability in financial services. Organisations that cannot explain their AI-driven decisions to a regulator, or to a policyholder who has had a claim declined, are exposed, regardless of whether the underlying decision was technically correct.
- Third-party model risk. Many insurers are integrating models built or maintained by third parties, vendors, reinsurers, data providers. The governance obligations do not travel with the vendor relationship. The accountability stays with the insurer.
What effective AI governance looks like
Effective AI governance in insurance is not about slowing down AI adoption. The efficiency gains in fraud detection, claims processing and underwriting automation are real and significant. It is about building the oversight and accountability structures that allow you to move fast with confidence rather than fast with exposure.
At minimum, this means an AI model inventory that is known to your risk function, not just your data science team. It means explainability standards that are defined before models go into production, not after they are challenged. It means a model validation function that has independence from the teams building the models. And it means board reporting that gives directors meaningful visibility into the AI risk the organisation is carrying.
The organisations that get this right will find that good governance accelerates AI adoption rather than constraining it. When your risk framework is clear, your validation process is efficient and your board is informed, you can move from concept to production faster because you are not working around uncertainty about what is permissible. Good governance is a competitive advantage, not a brake.
A question for boards
If you sit on a board of an insurance organisation, I would encourage you to ask for a briefing on the three most consequential AI models currently in production, what they do, how they are validated, what the failure scenario looks like, and who is accountable. The answers will tell you a great deal about the maturity of your AI governance. And the question itself will send a signal that this is an area where the board expects to be informed.
Common Questions
What do MAS Technology Risk Management guidelines require Singapore insurance boards to own on AI?
MAS's Technology Risk Management guidelines require Singapore insurers to maintain board-level oversight of technology and AI risks, including a documented risk appetite for technology risk and clear accountability for AI model governance at senior management level. The board must approve the technology risk framework and satisfy itself that AI models, particularly those used in underwriting, claims, and fraud detection,are subject to independent validation and documented explainability standards. This goes beyond receiving a CISO briefing: the board needs to understand the AI risk the organisation is carrying and the controls in place.
What is the difference between AI governance and AI model risk governance for Singapore insurers?
AI governance covers the broad policies and frameworks an insurer has for developing and deploying AI, ethics principles, data use policies, regulatory compliance processes. AI model risk governance is narrower and more specific: it covers how individual AI models are validated, monitored for performance drift, stress-tested for failure scenarios, and reviewed when they produce unexpected outputs. Singapore insurance boards that focus only on AI governance at the framework level often miss the model risk layer, the specific questions about which models are in production, who validated them, and what happens when they fail.
How should a Singapore insurance board get visibility into AI risk?
The board should receive periodic reporting from the risk function, not the data science team,that covers: the inventory of AI models in production or near-production, the validation status of each material model, any model performance drift flagged since the last report, and the regulatory exposure from models that cannot yet be explained to MAS or to a challenged policyholder. Asking management for this report, and asking why any material models are not on it, is a straightforward governance action. The act of asking tells management that AI model risk is board-supervised, not just CIO-supervised.
Related insights
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.