FSB sets 12 sound practices for AI in financial institutions: what finance leaders should check

Global reference

• Body: Financial Stability Board (FSB)
• Topic: Sound practices for the responsible adoption of AI
• Key dates: Consultation June 2026; final report published 15 October 2026
• Status: Final. Non-binding, proportionate and does not override local legal or regulatory requirements

The 12 practices

• Governance (4): board and senior management oversight of AI strategy and risk appetite; clear roles and accountability; AI risks built into the risk framework, with records of AI use; adapting as AI changes.
• Lifecycle (8): materiality and risk assessment of each use case; choosing the right technology; data governance; explainability, with compensating controls; performance monitoring; human oversight; cyber and ICT risk; third-party AI risk.

Points finance teams should note

• Embedded AI counts: the report covers AI inside vendor services that are not marketed as AI.
• Vendors may change the underlying model without enough notice. The institution stays accountable for outcomes.
• Agents should have unique identifiers and traceability: what triggered an action, what tools and data were used, and whether the agent stayed within its permissions.
• The board can set limits, including bans on fully automated decisions in critical areas where risk exceeds appetite.
• Staff should keep the skills to work when AI is unavailable or wrong. Over-reliance and automation bias weaken oversight.

What to do now

• Build or update an inventory of AI use in finance, including AI built into ERP, close and payment software.
• Rate each use case for materiality and name a business owner and a human reviewer.
• Ask key vendors how they notify you of model changes, and add this to contracts.
• Give every AI agent its own identifier, defined permissions and an action log.
• Report AI use and risks to the board or audit committee at least once a year.

Our take

This is the clearest global checklist yet for AI controls in finance. It asks for nothing exotic: an inventory, owners, testing, human review and vendor management. Firms that already run good model risk and outsourcing controls are most of the way there. The gap for most is embedded AI and agents.

Important. This summary is for general information and is not legal, regulatory or financial advice. It is based on public Financial Stability Board publications and may be incomplete or out of date. The official publications prevail; check the official source before acting.