FSB sound practices for responsible AI adoption: what financial institutions should do
The Financial Stability Board finalised 12 sound practices for responsible AI adoption on 15 October 2026. Practices 1 to 4 cover organisation-wide governance: board oversight, roles, integrating AI into risk frameworks, and continuous learning. Practices 5 to 12 cover the AI life cycle: materiality assessment, technology selection, data governance, explainability, performance evaluation, human oversight, AI cyber and ICT risk, and third-party AI dependencies.
The practices are a toolkit, not a new international standard. The FSB encourages boards and senior management to reference them and to apply them proportionately, integrating them into existing cyber and third-party risk frameworks.
What are the 12 FSB sound practices?
| No. | Sound practice | Practical first action |
|---|---|---|
| 1 | Board and senior management oversight | Approve AI strategy and risk appetite; receive regular AI risk reporting |
| 2 | Governance framework with defined roles | Name owners, developers, validators and approvers for every AI use case |
| 3 | AI risks in the risk framework, with documentation | Map AI risks to existing frameworks; keep an AI inventory and records |
| 4 | Continuous learning and adaptation | Build skills across board, risk, compliance and audit; update as AI changes |
| 5 | Materiality and risk assessment of use cases | Rate each use case at inception and after changes |
| 6 | Selection of appropriate AI technologies | Choose models against objectives, constraints and risk |
| 7 | Data governance | Own, document and quality-check data used by AI |
| 8 | Explainability and compensating controls | Set explainability needs; add controls where it is limited |
| 9 | Performance evaluation | Test before launch and monitor in production |
| 10 | Human oversight | Design human review in proportion to risk |
| 11 | AI-related cyber and ICT risk | Extend security controls to AI-specific attacks |
| 12 | Third-party AI dependencies | Due diligence, contracts, concentration and exit plans |
Are the FSB sound practices binding?
No. The FSB states they are not intended to establish an international standard or impose a prescriptive approach. They matter because FSB members, including national supervisors, are likely to draw on them, and because they align closely with the MAS guidelines issued a week earlier.
How should a smaller institution apply them?
Proportionately. A small bank with a handful of AI uses can meet the governance practices with a one-page AI policy, a named owner per use case, an inventory in its risk system and quarterly reporting to the risk committee. Life-cycle practices can be concentrated on the few use cases rated material.
Primary sources (reviewed 17 Oct 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
When were the FSB AI sound practices published?
The consultation report was published on 10 June 2026 and the final report on 15 October 2026.
Do the FSB practices cover frontier AI?
The consultation report said they are not designed to address risks specific to frontier AI models, although some practices help institutions respond to them.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.