FSB Policy Statements

Key dates

2026-06-10

The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.

2026-07-22

The FSB consultation closed; approximately 160 responses were received.

2026-10-15

The FSB published the overview of consultation responses and the final report containing the 12 sound practices.

Suggested considerations

• Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
• Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
• Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
• Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
• Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
• Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
• Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
• Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.

What changed

The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.

Key dates

2026-06-10

The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.

2026-10-15

The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.

Suggested considerations

• Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
• Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
• Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
• Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
• For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
• Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
• Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
• Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.

What changed

The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies.