FSB publishes 12 AI practices urging financial firms to strengthen oversight

Financial institutions can benefit from AI, but its growing autonomy can also put their controls under strain. The Financial Stability Board published its final responsible-AI report on October 15, 2026, setting out 12 sound practices. It urges boards to oversee adoption and firms to keep assessing risks as systems develop, enter use and change.

The report, Sound Practices for Responsible Adoption of Artificial Intelligence, is guidance rather than binding regulation. Its stated aim is to help institutions capture AI’s benefits while managing risks in ways that support the financial system’s resilience. The recommendations address both institutional leadership and the handling of individual AI uses.

Boards set the approach; responsibilities must be explicit

Four practices concern organization-wide governance. Boards and senior managers should set and oversee the approach to AI, aligning adoption with the institution’s business model, strategy and willingness to take risks. The FSB strongly encourages those leaders to use the practices when developing or refining their governance, risk-management and control frameworks.

The governance framework should spell out roles and responsibilities. AI risks should also be incorporated into the institution’s risk-management framework, with effective documentation of AI use. These recommendations place oversight across the organization, rather than treating each deployment solely as a technology-selection decision.

Continuous learning and adaptation complete this governance group. The FSB also wants financial institutions, supervisors and other stakeholders to cooperate and share information, both within jurisdictions and across borders, as adoption increases.

Checks extend beyond the decision to deploy

The other eight practices address risks throughout an AI system’s lifecycle. They cover development and deployment, with systematic assessment of how significant a use case is and what risks it presents—not just at inception, but afterward.

• Assess the use and choose suitable technology. The first two lifecycle practices call for evaluating the significance and risks of an AI use case, then selecting appropriate AI technologies. The assessment is intended to continue as the use develops.
• Govern data and address explainability. Two further practices cover appropriate data governance and the ability to explain different types of AI. The explainability guidance also calls for considering compensating controls—other safeguards that can help address limitations.
• Evaluate performance and maintain human oversight. These are separate practices: assessing how an AI use case performs is paired with ensuring appropriate and effective supervision by people. The framework includes both evaluation of the system and oversight of its use.
• Manage security and supplier dependencies. The final two lifecycle practices address AI-related cyber and information-technology risks, alongside risks arising from reliance on third-party AI providers. External dependencies are therefore part of the recommended framework, not outside its scope.

Institutions can tailor the practices to their context and risk profile, integrating them into existing frameworks, including those for cybersecurity and third-party risk. The report includes case studies showing benefits reported by financial institutions and examples of proportionate application.

Agents can change after the initial assessment

The report’s warnings about autonomous agents give ongoing assessment a concrete purpose. As quoted by PYMNTS, the FSB warns that these systems may act unpredictably or outside intended boundaries. Possible consequences include unauthorized or erroneous actions, data-security incidents and disruption to connected systems. These are identified risks, not findings that such failures have occurred.

The FSB also cautions that agents do not reason like humans and may interpret predefined goals unexpectedly. Their actions and capabilities can change over time, particularly when they receive new prompts or gain access to new tools. That warning concerns changing behavior, not just whether an initial model performs well.

The final practices follow a consultation launched on June 10, 2026, which closed July 22 and drew around 160 responses across regions and sectors. An accompanying overview of consultation responses summarizes the feedback and changes made to the final report. The FSB says it will monitor AI developments and update the practices as necessary.