Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
AI model risk governance in Singapore insurance is not the same job as AI governance. Many boards have approved an AI policy and an accountable executive, yet still cannot say how wrong their pricing, claims or underwriting models could be, or who would notice.
Early in my time as statutory CRO at AIG Asia Pacific, I sat in a review of a new claims triage model. It had been through every governance step we had: a business case, a data privacy check, a fairness review, sign-off from the steering group. I asked what it would cost us if the model's fraud flags were wrong by ten percentage points for a quarter. Nobody in the room could answer. The model was well governed. Its risk had never been measured. [CONFIRM with Raymond: replace with a real episode if possible]
I see the same gap in Singapore insurance boards today, and MAS's Guidelines on AI Risk Management, issued on 7 October 2026 and taking effect from October 2027, will expose it. Most boards have responded to AI with governance: a policy, an inventory, an accountable executive, sometimes a committee. That work is necessary. It is not model risk management, and treating the two as one job is the most common error I see.
Two different questions
AI governance asks whether we should use this AI, for what purpose, under whose authority and with what protections for customers. It is about permission and accountability. Model risk asks how wrong this model can be, how we would find out, and what it costs us when it is. It is about measurement. An insurer can answer the first set of questions perfectly and know almost nothing about the second.
Actuaries know the second set well. Every reserving and pricing basis I have signed off went through independent review, back-testing against actual experience, sensitivity testing and a written statement of its limitations. No board would accept a reserving model because the actuarial committee had a good charter. Yet that is roughly the standard many AI models are held to: the process looked right, so the output is assumed to be right.
“A well-governed model can still be a badly wrong one. Governance tells you who approved it, not how far it can miss.”
What MAS has already told the industry
MAS has not been silent on this. Its December 2024 information paper on AI model risk management, drawn from a thematic review of banks, described what good practice looked like: independent validation, pre-deployment testing in proportion to materiality, and monitoring after go-live. The new guidelines carry those lifecycle expectations to every financial institution, insurers included, and keep the insurer accountable for models that third parties build or supply. I covered the board accountability side in what the MAS AI risk guidelines mean for boards, and the inventory problem in AI governance in Singapore insurance. This piece is about what sits underneath both.
Where conflating the two goes wrong
When a board assumes its AI governance covers model risk, the same five weaknesses tend to appear:
- Validation by the builders. The review is done by the data science team that built the model, or by the vendor that sold it. In actuarial work that would be marking your own homework. Model risk needs challenge from someone with no stake in the model going live.
- Materiality by label, not by loss. A use case is classed as low risk because a human makes the final decision. If that human approves the model's output nine times out of ten under time pressure, the model is making the decision. Materiality should be expressed as an estimated financial and customer impact if the model is wrong.
- No tolerance for model error. Most insurers' risk appetite statements say nothing about how much model error they will accept in pricing, claims or underwriting. Without a number, monitoring has nothing to trigger against, a gap I discussed in why risk appetite frameworks fail to influence decisions.
- Drift reported, not acted on. Dashboards show performance moving. Nobody has clear authority to pull the model when a threshold is breached, so it keeps running.
- Vendor models outside the model register. Third-party AI often sits in procurement records rather than the model inventory, so it is never validated at all.
Insurers already own the missing discipline
The good news is that insurers already have what is missing. The appointed actuary function, the reserving committee and the actuarial control cycle exist because the industry learnt long ago that models drive the balance sheet. My recommendation is not a new AI framework. It is to bring material AI models into the model risk framework that already governs pricing and reserving, with the same expectations of independent validation, documented limitations and periodic review.
That has practical consequences. The second line needs people who can genuinely challenge a gradient-boosted claims model or a language-model underwriting assistant, not just review its documentation. Where an AI model feeds pricing or reserving assumptions, the appointed actuary should see it. And the board risk committee should see model risk as its own line in the risk report, not as a paragraph inside the technology risk update. My piece on what a board risk committee should look like applies directly here.
None of this means slowing AI adoption. In my experience the insurers that validate properly deploy faster over time, because the board trusts the evidence and stops asking for another review each time a model changes.
What I would ask management for
If I chaired the risk committee of a Singapore insurer today, I would ask for four things before the end of the year:
- A tiered list of AI models ranked by financial and customer impact if wrong, with the top tier named and each model owned by one person.
- Evidence that each top-tier model, including vendor models, was validated by someone independent of the people who built or bought it.
- A stated tolerance for model error in each material area, and the thresholds that trigger review or withdrawal.
- The last occasion a model was paused or changed because monitoring flagged it. If the answer is never, that is the finding.
MAS has given the industry until October 2027 to have its AI risk management in place. The insurers that come out of that year well will be the ones that tested their models as hard as they tested their policies. If you want an independent view of whether your board can see model risk as clearly as it sees AI governance, this is the work I do with Singapore insurance boards.
Common Questions
What is the difference between AI governance and AI model risk management for Singapore insurers?
AI governance decides whether and how an insurer uses AI: policy, accountability, permitted use cases and customer protections. AI model risk management measures how wrong a specific model can be, how quickly the insurer would detect it, and what the error would cost. A Singapore insurer needs both, and boards often assume the first covers the second.
Do MAS's AI Risk Management Guidelines require independent validation of AI models?
The guidelines expect controls across the AI lifecycle, including evaluation before deployment and monitoring afterwards, in proportion to materiality. MAS's December 2024 information paper on AI model risk management highlighted independent validation as good practice. For material models at a Singapore insurer, I treat independent validation as the practical way to evidence those expectations.
Does an insurer need to validate an AI model supplied by a vendor?
Yes. Under MAS's AI Risk Management Guidelines, the insurer remains accountable for AI that third parties develop, operate or supply. Vendor assurances are an input, not a substitute. Material vendor models belong in the insurer's own model inventory and validation programme.
Who should oversee AI model risk on a Singapore insurance board?
The board risk committee, supported by a second-line model risk function with the technical skill to challenge AI models. Where AI models feed pricing or reserving, the appointed actuary should be involved. Model risk should appear as its own line in board risk reporting.
Related insights
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.