FSB finalises sound practices for the responsible adoption of artificial intelligence (AI)

Key dates

2026-06-10

The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.

2026-10-15

The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.

Suggested considerations

• Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
• Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
• Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
• Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
• For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
• Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
• Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
• Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.

What changed

The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies. Commentary on the final version indicates additional emphasis on agentic AI, including more intensive human oversight for higher-risk uses, risk-based triggers for human approval, limits on autonomous actions, mo

Who is affected

• Banks and other credit institutions using or developing AI
• EU-authorised financial institutions within scope of the Digital Operational Resilience Act
• Investment firms, asset managers, broker-dealers and trading venues using AI
• Insurers, reinsurers and pension institutions using AI or relying on third-party AI providers

Related regulations

• Digital Operational Resilience Act (DORA)
• EU Artificial Intelligence Act
• EBA Guidelines on outsourcing arrangements
• EBA Guidelines on internal governance
• GDPR