FSB Guidance

Key dates

2026-10-15

FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.

Suggested considerations

• Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
• Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
• Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
• Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
• Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
• For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
• Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
• Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.

What changed

The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...