The Pulse
FSB Finalizes 12 AI Practices for Financial Institutions
The Financial Stability Board finalized 12 nonbinding practices for financial institutions adopting artificial intelligence. The guidance addresses board oversight, AI lifecycle risks, autonomous systems and third-party providers.
AI.info Team · Written with AI ·
Flexible guidance meets calls for tighter controls
The Financial Stability Board finalized 12 practices for financial institutions adopting AI on 15 October, retaining a flexible, nonbinding approach even as consultation respondents called for stronger detail on risks from autonomous systems and outside providers. The guidance asks boards and senior executives to consider how AI fits their institution’s strategy and risk appetite, while addressing controls from development through deployment.
The tension is clearest around agentic AI: respondents wanted concrete safeguards for systems that can plan and act across tasks, while the FSB says practices for agentic and multi-agent systems are still developing. The final report adds considerations for those systems but does not turn the recommendations into a binding international standard.
“The sound practices are non-prescriptive and do not constitute a binding international standard.”
Financial Stability Board, “Sound Practices for Responsible Adoption of Artificial Intelligence (AI)”
Boards oversee four organization-wide practices
The first four practices address governance across an institution. They call for board and senior-management oversight aligned with business strategy and risk appetite; clear roles and accountability; AI risks incorporated into existing risk-management frameworks with documentation of AI use; and ongoing organizational learning as AI changes.
The other eight practices cover the AI lifecycle. They address assessing a use case’s materiality and risk, selecting suitable systems, data governance, explainability and transparency, performance monitoring, human oversight, cyber and information-technology risks, and dependencies on third-party AI providers.
The FSB says institutions should apply the practices in proportion to their size, complexity, connections to other firms and the importance of the functions using AI. A smaller institution or a lower-risk application may need a different set of controls from a large firm using AI in a critical function.
Consultation exposed concerns about providers and agents
The FSB received around 160 responses to its consultation, which closed on 22 July 2026. Respondents broadly supported its principles-based, proportionate approach, while some asked for more prescriptive guidance. They also raised concerns about limited information from third-party model providers, dependence on a small number of suppliers and the difficulty of assessing frontier AI models.
In response, the final report adds detail on documentation, auditability and traceability, including the need to reconstruct actions in agentic AI use cases. It expands discussion of third-party risks to include AI embedded in outside products and subcontracted services, and highlights supplier transparency, concentration risk, continuity planning and exit strategies.
Respondents also asked for more attention to agentic systems, including runtime monitoring, clear accountability and practical human intervention. The FSB added agentic-AI considerations and a case study, while saying those recommendations were drawn from consultation feedback and were not fully consulted on as a separate set.
System-wide risks remain outside the report’s scope
Some respondents raised broader concerns, including the possibility that firms using the same models could behave in correlated ways, amplifying market movements or concentration risks. The FSB made no changes to address those macroprudential questions in this report, which focuses on practices for individual financial institutions. It says it will continue monitoring AI-related systemic risks through its regular assessment of vulnerabilities.
The final report also adds case studies involving insurers and nonbank firms such as asset managers and payment providers. The FSB presents them as illustrations, not benchmarks for expected results. Its guidance is a reference for institutions refining AI governance and controls; it does not replace their obligations under local law and regulation.