Sound Practices for Responsible Adoption of Artificial Intelligence
Issued by
Financial Stability Board
- September 30, 2026 · Correction — Labeled as consultative guidance from the Financial Stability Board. (Cody Maxwell)
- September 30, 2026 · Correction — Recorded that the consultation closed on 22 July 2026 and described the practices as a non-prescriptive menu for all financial institutions (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
- October 12, 2026 · Correction — Fact-check: the human-oversight FAQ answer wrongly said the practices 'require' embedded human review at critical decision points, contradicting the entry's own vendor-oversight FAQ ('it requires nothing'). Confirmed via FSB's own consultation announcement that the practices are non-prescriptive and non-binding. Rewrote the answer to match the document's actual legal character. (Cody Maxwell)
- October 20, 2026 · Correction — Dropped the stale "(Consultation Report)" suffix from the title now that the FSB has published the final report (confirmed 2026-10-15). (Claude (acting on Cody Powell's review-queue decisions, 2026-10-20))
- October 20, 2026 · Correction — Merged the parked pipeline-proposal rather than applying it wholesale. Updated content to reflect the report is now FINALIZED (published 2026-10-15), not a June 2026 consultation draft -- the prior text's 'expects to publish a final report in coming months' language was stale. Added two genuinely new specifics from the proposal (materiality assessment, documented pre-deployment risk assessments) and the risk_tiers classification (was empty). Explicitly KEPT the 'voluntary, non-prescriptive toolkit, not a binding international standard' framing that the proposal had dropped -- re-verified directly against the final report's own press release today, which still describes it as a 'practical toolkit... can tailor,' not reframed as mandatory. Did NOT apply the proposal's who_it_affects swap (adding 'Public sector', dropping 'SMB'): the final report's press release explicitly scopes to private financial institutions only, no public-sector/central-bank adopters, and gives no basis for excluding SMBs. (Claude (acting on Cody Powell's review-queue decisions, 2026-10-20))
The Financial Stability Board published its final report on 12 sound practices for responsible AI adoption on 15 October 2026, after a June 2026 consultation. The practices cover banks, insurers, and other regulated financial entities developing or deploying AI, and are a voluntary, non-prescriptive toolkit rather than a binding international standard. Institutions should map them to governance, model risk, third-party oversight, and lifecycle controls, applying them proportionately to how much AI they use.
Applies To
Overview
Finalized on 15 October 2026 following a consultation that closed on 22 July 2026, this FSB report offers a structured menu of 12 sound practices organized around AI governance and operational risk management in financial services. The practices span the entire AI lifecycle, from initial design and data governance through deployment, monitoring, and decommissioning. Key provisions address model risk management frameworks, accountability structures, a materiality assessment process to tier AI applications by risk before deployment, documented pre-deployment risk assessments, third-party and vendor oversight, and ongoing human review of AI-driven decisions throughout an AI system's operational life. The FSB frames the practices as a practical, non-prescriptive toolkit that institutions can tailor to their own context, not a binding international standard -- but FSB outputs carry significant weight with national supervisors and central banks, and the practices are expected to inform domestic regulatory guidance across member jurisdictions. The report includes case studies showing how some practices have been applied proportionately, reflecting an institution's actual AI use rather than a one-size-fits-all requirement.
Key Requirements
- •The practices are a non-prescriptive menu; the FSB says they are not an international standard.
- •They are addressed to financial institutions of all types, applied in proportion to their AI use.
- •Governance: clear accountability, oversight, and escalation for AI systems.
- •Model risk: validation and independent review scaled to how material each model is.
- •Third parties: due diligence and contract terms for AI sourced from vendors.
- •Monitoring and human review: ongoing performance checks, and human review at high-impact decision points.
- •Conduct and document a materiality assessment for each AI application to tier the level of scrutiny required before deployment.
- •Complete documented risk assessments as a condition of deployment, rather than conducting them informally.
What Your Organization Must Do
- →Read the 12 sound practices as a voluntary menu, not as binding rules.
- →Map each practice to existing governance, model risk, vendor oversight, and lifecycle controls.
- →Scale validation and independent review of AI models to how material each model is.
- →Review AI vendor due diligence and contracts for transparency and audit rights.
- →Document where human review sits in high-impact AI decisions and name accountable owners.
- →Track domestic supervisory guidance in your jurisdictions that may build on the FSB's now-published final report.
- →Develop a materiality assessment process to tier AI applications by risk level before any new deployment is approved.
- →Require completed, documented risk assessments as a condition of deployment sign-off for any AI system.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- Is the FSB AI Sound Practices report legally binding on banks and insurers?
- No, the June 2026 consultation report is non-binding in its current form. However, FSB outputs carry substantial influence with national supervisors and central banks across member jurisdictions, so financial institutions should expect these 12 practices to shape domestic regulatory expectations in the near term.
- Which financial institutions are in scope for the FSB AI Sound Practices?
- The practices are addressed to all types of financial institutions, not only banks and insurers. The FSB expects firms to apply them in proportion to how they use AI.
- How do the FSB AI Sound Practices align with existing model risk management frameworks like SR 11-7?
- The FSB practices extend traditional model risk management principles to cover machine learning and generative AI, requiring validation and independent review scaled to model materiality. Institutions already complying with SR 11-7 or equivalent guidance will need to update their frameworks to address AI-specific lifecycle controls, drift detection, and outcome fairness assessments.
- What third-party vendor oversight does the FSB AI consultation report require?
- It requires nothing, because the practices are a non-prescriptive menu. Among the options are due diligence on AI vendors and contract terms such as transparency and audit rights.
- What is the deadline to submit a response to the FSB AI Sound Practices consultation?
- The consultation closed on 22 July 2026, and the FSB published the responses on 6 August 2026. It expects to publish the final report in the coming months.
- What human oversight requirements do the FSB AI Sound Practices impose for high-impact decisions?
- It requires nothing, because the practices are a non-prescriptive menu, not a binding standard. Human review at critical decision points is one of the lifecycle sound practices (within practices 5-10) that boards and senior management are strongly encouraged, not required, to reference and apply in proportion to their AI use.