FSB Names Concentration and Model Governance as AI's Systemic Financial Risks

What happened

Why it matters

• ·The FSB's concentration finding creates direct regulatory exposure for firms relying heavily on one or two AI providers. Examiners in FSB member jurisdictions now have an authoritative basis to request vendor concentration risk assessments and contingency plans. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) already expects banks to assess third-party model dependencies, and this report raises the stakes further.
• ·Firms that cannot document how an AI model reaches a decision now face a documented gap against a globally recognized benchmark. The same applies to firms unable to show a complete model lifecycle from intake to retirement.
• ·The FSB frames AI risk as something that must be absorbed into existing operational resilience and third-party supervision programs, not handled by a standalone AI team. Firms with siloed AI governance structures face the most immediate pressure to restructure accountability and reporting lines before the next supervisory cycle.

Governance controls affected

What to do now

• ☐Map all AI systems currently in production to your existing model risk management inventory and confirm each has a documented governance owner, risk rating, and review schedule.
• ☐Assess third-party AI provider concentration: identify how many of your material AI capabilities depend on a single vendor, and document what you would do if that vendor became unavailable or was restricted by regulators.
• ☐Review your third-party AI vendor contracts to confirm they require notification of material model changes, security incidents, and significant operational failures.
• ☐For each high-risk AI system, confirm that decision outputs can be explained in plain terms to an examiner or auditor, and document where that explainability requirement is currently unmet.
• ☐Brief your chief risk officer and board risk committee on the FSB report and ask them to confirm whether AI risk is currently reported through the same escalation path as other operational and model risks.

What to watch next

Prudential regulators in FSB member jurisdictions will likely incorporate the FSB's risk taxonomy into their examination playbooks. These include US banking agencies, the European Central Bank, and the Bank of England. This is expected over the next supervisory cycle. Firms should watch for examination questionnaires or targeted reviews on AI provider concentration and model lifecycle governance. This is especially important given the ECB's October 31, 2026 deadline for bank AI cyber action plans noted in a prior supervisory signal. The EU AI Act (Regulation (EU) 2024/1689) and the EU Digital Operational Resilience Act create binding obligations for financial entities in Europe. These obligations directly intersect with the FSB's recommendations. Convergence of supervisory expectations for EU-regulated institutions is likely by mid-2027.