Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Overview of consultation responses
AI Analysis
The FSB published its 15 October 2026 overview of approximately 160 consultation responses and finalised 12 sound practices for responsible AI adoption by financial institutions. The practices are non-binding, technology-neutral recommendations, but the final text materially sharpens expectations for agentic AI, risk-based human approval, documentation, safe interruption, and third-party AI dependency management.
Key dates
- 2026-06-10
- The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.
- 2026-07-22
- The FSB consultation closed; approximately 160 responses were received.
- 2026-10-15
- The FSB published the overview of consultation responses and the final report containing the 12 sound practices.
Suggested considerations
- Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
- Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
- Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
- Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
- Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
- Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
- Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
- Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.
What changed
The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk. In response to feedback, the final report gives greater emphasis to autonomous or agentic AI: firms should apply more intensive human oversight to higher-risk uses, establish risk-based triggers requiring human approval, constrain agent actions, and test mechanisms for safe interruption or shutdown. The final text also clarifies that AI agents should not be treated as synthetic employees because they do not reason like humans and m
Compliance impact
The publication does not itself impose binding obligations, penalties, or a compliance deadline, so its immediate legal impact is limited. Its supervisory significance is nevertheless material: the detailed expectations on governance, documentation, human oversight, AI lifecycle controls, cyber risk, and third-party dependencies provide a likely benchmark for supervisory reviews and for future dom
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original FSB source before acting. Full disclaimer.
What the FSB said
This document summarises the responses to the June 2026 public consultation on the Sound Practices for financial institutions’ responsible AI adoption.
Published by FSB . Read the full notice at the source for the authoritative text.