The Financial Stability Board published 12 sound practices for responsible artificial-intelligence adoption by financial institutions on 15 October. The final report covers organisation-wide governance and risk management throughout the AI lifecycle. It strongly encourages boards and senior management to use the practices when shaping strategy, technology adoption and control frameworks.
The package is a non-binding, non-prescriptive toolkit rather than an international standard. It follows a consultation issued in June and incorporates public feedback. Reuters reported that the FSB strengthened its treatment of agentic AI, reflecting increased institutional interest and the technology's distinctive risks. For higher-risk uses, the final guidance calls for more intensive human oversight and clear, risk-based triggers for an AI agent to seek human approval.
GOVERNANCE AND ACCOUNTABILITY
The first four practices place responsibility at institution level. Boards and senior managers are asked to align AI deployment with the business model, risk appetite and strategy, while firms should define roles, maintain governance frameworks and document uses and risks. Institutions are also encouraged to keep adapting their capabilities and controls as the technology develops.
Five further practices address decisions made before and after deployment. They cover recurring materiality and risk assessments, technology selection, data governance, explainability and performance management. The framework says institutions should use more explainable systems where appropriate and feasible, or apply compensating controls, while testing and monitoring should be proportionate to each use case.
HUMAN OVERSIGHT AND DEPENDENCIES
The final three practices focus on human oversight, cyber and information-technology resilience, and third-party dependencies. Oversight should reflect a system's materiality, risk, autonomy, complexity and explainability. Third-party controls should consider performance, transparency, data quality, supply chains, concentration and business continuity, while cyber scenarios may be incorporated into tests and exercises.
The FSB describes the practices as a practical toolkit that institutions can tailor to their circumstances and integrate into existing cyber and third-party frameworks. It also seeks coordination and information-sharing among firms, supervisors and other stakeholders across jurisdictions. The next test will be how institutions and supervisors translate the guidance into controls; the FSB said it would monitor developments and update the practices when necessary.