1. Does this apply to me?
Which rules apply to you
Tell us where you operate. We work out which rules apply, what they mean for you, and show only the controls they require. Nothing you enter leaves this browser.
2. What they require
Where do you stand today?
Only the controls required by the rules that apply to you are shown, with what each one requires. Change your answers above and the controls change with them.
| Control | What this means for you | Your status |
|---|
How readiness is calculated. Only the controls required by the rules that apply to you are counted. Each control marked in place scores 2, partial 1 and not yet 0, and readiness is your total as a share of the maximum. Each regime’s score uses only the controls that regime requires. The mapping is Midships’ reading of the published texts, not legal advice.
3. Where Midships helps
The runtime controls for AI agents
Most of these controls are governance work for your own teams. The runtime controls are different: they are hard to build, and they are where agents create supervisory risk. That is the part Midships does.
Icebreaker: runtime governance for AI agents
Supports agent identity and delegated authority, checks before every action, a record of every decision, and the ability to stop. Contributes to human oversight and monitoring.
- Each agent acts under an identity, with authority delegated by a named person.
- Every proposed action is checked against that authority before it executes. Anything outside it is stopped or sent to a person. It fails closed.
- A record is written at the point of decision, so the evidence exists without being assembled later.
- Runs in your own infrastructure and works with your identity platform.
Midships says a control is "supported", never that a product makes you "compliant". Compliance is a judgement for your institution and its supervisor. See runtime governance decide, action by action, or cost what governed agents are worth.
Take this to your risk committee
Download a one-page summary of your result, or send it to us and we will walk through it with your team in 45 minutes. The email opens in your own mail app; nothing is sent until you press send.
4. Common questions
About these rules and this check
When do these rules take effect?
MAS: the Guidelines on AI Risk Management were issued on 7 October 2026; oversight, inventory and risk assessment apply from 7 October 2027, and life cycle controls and capability by 7 October 2028. EU AI Act: AI literacy and the prohibited practices have applied since 2 February 2025, transparency duties since 2 August 2026, and the high-risk duties for credit and insurance pricing from 2 December 2027. APRA: its 30 April 2026 letter sets expectations under the existing prudential framework that apply now, with no deadline. SAFR: voluntary, with no deadline.
Do these rules cover AI agents?
Yes, in different ways. MAS's guidelines cover all AI, including agents, and MAS plans further guidance on agentic AI in 2027. APRA expects strong privileged access management and controls over agentic and autonomous workflows. The EU AI Act regulates agents by what they are used for. SAFR is written specifically for agents that take actions in finance.
Which rules apply to me?
Tell us where you operate in step 1. The MAS guidelines apply to MAS-regulated financial institutions in Singapore, and SAFR is a voluntary Singapore blueprint for agents that take actions. APRA's expectations apply to APRA-regulated banks, insurers and superannuation trustees in Australia. The EU AI Act applies wherever AI is used in the EU or its outputs are used there, with extra duties for high-risk uses such as credit decisions about individuals and life or health insurance pricing.
How is readiness worked out?
Only the controls required by the rules that apply to you are counted. Each control marked in place scores 2, partial 1 and not yet 0, and readiness is your total as a share of the maximum. Each regime's score uses only the controls that regime requires.
Can a product make us compliant?
No. Compliance is a judgement for your institution and its supervisor. A runtime governance product can support specific controls: agent identity, checks before execution, decision records and the ability to stop an agent.
Does anything I enter leave my browser?
No. Your answers stay in the page and in the shareable link, after the # sign, which is never sent to a server.