The Financial Stability Board has finalized a set of 12 “sound practices” intended to help banks and other financial institutions adopt artificial intelligence responsibly. Published on October 15, the framework covers the full AI lifecycle, from organization-wide governance and human oversight to data quality, cyber risk and dependence on external technology providers. It is not a new law or directly binding regulation; it is an international toolkit that institutions can adapt to their existing governance and risk-management systems.
Clear responsibility for boards and senior management
The first group of practices focuses on organization-wide AI governance. Boards and senior management are encouraged to ensure that AI adoption remains aligned with an institution’s business model, risk appetite and strategy. Firms should define roles and responsibilities clearly, incorporate AI risks into their broader risk-management framework and document where systems are used and what purposes they serve.
The framework also argues that AI governance should not be treated as a one-time compliance exercise. Controls need to evolve as models, data sources and use cases change, while employees and decision-makers should continue learning and adapting. The FSB says this approach is designed to preserve financial-system resilience while allowing institutions to benefit from technological innovation.
Eight risk areas across the AI lifecycle
The second group addresses the lifecycle from technology selection and development through deployment and ongoing operation. Financial institutions are encouraged to assess the materiality and risk of every AI use case at launch and afterwards, select technology suited to the intended purpose and maintain appropriate data governance. Where a system’s output is difficult to explain, firms should consider additional compensating controls.
The FSB also highlights regular performance evaluation and “appropriate and effective” human oversight. The principle is particularly relevant to agentic systems that can plan or take actions with limited intervention, because accountability should not be transferred entirely to software. Reuters reported that the final guidance calls for stronger human supervision as regulators increase their focus on risks associated with agentic AI in finance.
Cyber risk and third-party dependence
The final practices cover AI-related cyber and information and communications technology risks. Institutions are expected to assess not only models developed internally but also their reliance on cloud providers, external model developers and data services. A disruption or weakness at a widely used provider could affect many institutions at once, making concentrated third-party dependence an operational and potentially systemic concern.
Canada’s financial regulator, OSFI, welcomed the FSB publication and said the practices reinforce clear accountability, effective human oversight, sound data governance and controls proportionate to the materiality and risk of each use case. The ABA Banking Journal similarly reported that the framework emphasizes organization-wide governance and controls throughout the AI lifecycle for banks and other financial firms.
How implementation is expected to work
The FSB says the 12 practices can be tailored to the size, activities and risk profile of individual institutions. They are designed as a practical toolkit that can be integrated into existing frameworks for cyber security, third-party risk and model governance. The board also wants stronger coordination and information-sharing among financial institutions, supervisors and other stakeholders across jurisdictions.
The framework does not require identical controls for every use case. Its proportional approach allows institutions to apply stronger review and oversight to systems that affect customers or critical decisions, while using controls suited to their context for lower-risk internal processes.
The final report follows a consultation draft issued in June 2026 and incorporates public feedback. The FSB said it will monitor technological developments and update the practices when necessary. The document is therefore better understood as an evolving common foundation for AI governance in finance, rather than the final word on how the sector should regulate or deploy the technology.
