Key dates
- 2026-06-10
- The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.
- 2026-07-22
- The FSB consultation closed; approximately 160 responses were received.
- 2026-10-15
- The FSB published the overview of consultation responses and the final report containing the 12 sound practices.
Suggested considerations
- Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
- Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
- Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
- Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
- Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
- Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
- Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
- Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.
What changed
The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.
Compliance impact
The publication does not itself impose binding obligations, penalties, or a compliance deadline, so its immediate legal impact is limited. Its supervisory significance is nevertheless material: the detailed expectations on governance, documentation, human oversight, AI lifecycle controls, cyber risk, and third-party dependencies provide a likely benchmark for supervisory reviews and for future domestic implementation, particularly in higher-risk or autonomous AI use cases.