Sound Practices for Responsible Adoption of Artificial Intelligence (Consultation Report)

Applies To

Overview

Published in June 2026 as a consultation report, this FSB document offers a structured menu of 12 sound practices organized around AI governance and operational risk management in financial services. The practices span the entire AI lifecycle, from initial design and data governance through deployment, monitoring, and decommissioning. Key provisions address model risk management frameworks, accountability structures, third-party and vendor oversight, and the need for ongoing human review of AI-driven decisions. While the report is consultative and non-binding in its current form, FSB outputs carry significant weight with national supervisors and central banks, and the practices are expected to inform domestic regulatory guidance across member jurisdictions. The consultation period invites feedback from industry stakeholders before the FSB finalizes recommendations. Financial institutions operating in FSB member jurisdictions should treat these practices as indicative of near-term supervisory expectations.

Key Requirements

• •Establish a formal AI governance framework covering accountability, oversight, and escalation procedures for AI systems in use.
• •Apply model risk management principles to AI and machine learning models, including validation and independent review commensurate with model materiality.
• •Maintain comprehensive documentation across the AI lifecycle, from data sourcing and model development through deployment and retirement.
• •Implement third-party oversight controls for AI systems sourced from external vendors, including contractual provisions and ongoing due diligence.
• •Conduct regular post-deployment monitoring of AI model performance, including drift detection and outcome fairness assessments.
• •Ensure human review mechanisms are embedded at critical decision points, particularly for high-impact AI-driven determinations affecting customers or financial stability.

What Your Organization Must Do

• →Audit all AI systems currently in production and map each to the 12 FSB sound practices to identify governance gaps.
• →Update the model risk management policy to explicitly cover machine learning and generative AI models, reflecting FSB lifecycle expectations.
• →Review all third-party AI vendor contracts and insert provisions requiring transparency, audit rights, and conformity with applicable sound practices.
• →Assign named accountable owners to each material AI system and document escalation paths within the governance framework.
• →Establish a structured post-deployment monitoring program with defined frequency, thresholds for review, and a process for decommissioning underperforming models.
• →Prepare a consultation response documenting the institution's current practices relative to the FSB's 12 proposed practices, to inform internal gap remediation and engage with domestic supervisors.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Is the FSB AI Sound Practices report legally binding on banks and insurers?

No, the June 2026 consultation report is non-binding in its current form. However, FSB outputs carry substantial influence with national supervisors and central banks across member jurisdictions, so financial institutions should expect these 12 practices to shape domestic regulatory expectations in the near term.

Which financial institutions are in scope for the FSB AI Sound Practices?

The practices apply to banks, insurers, and other regulated financial entities that develop or deploy AI systems in FSB member jurisdictions. This covers both large enterprises and smaller regulated firms, whether they build AI in-house or source it from external vendors.

How do the FSB AI Sound Practices align with existing model risk management frameworks like SR 11-7?

The FSB practices extend traditional model risk management principles to cover machine learning and generative AI, requiring validation and independent review scaled to model materiality. Institutions already complying with SR 11-7 or equivalent guidance will need to update their frameworks to address AI-specific lifecycle controls, drift detection, and outcome fairness assessments.

What third-party vendor oversight does the FSB AI consultation report require?

Institutions must implement contractual provisions and ongoing due diligence for AI systems sourced externally. Specifically, contracts should include transparency obligations and audit rights, ensuring vendors conform to the applicable sound practices across the AI lifecycle.

What is the deadline to submit a response to the FSB AI Sound Practices consultation?

The consultation report was published in June 2026, with the consultation period inviting stakeholder feedback before finalization. Institutions should monitor the FSB website for the official comment deadline, as submission of a response also serves as a useful internal benchmark for gap remediation against the 12 practices.

What human oversight requirements do the FSB AI Sound Practices impose for high-impact decisions?

The practices require embedded human review mechanisms at critical decision points, particularly where AI-driven determinations affect customers or financial stability. Institutions should document where these review checkpoints sit within their workflows and assign named accountable owners to each material AI system.