The Financial Stability Board on 15 October published the final version of its Sound Practices for Responsible Adoption of Artificial Intelligence, four months after consulting in June. The 12 practices carry no legal force, and the FSB calls them a “practical toolkit”. Their influence will come from two places: the FSB “strongly encourages” boards and senior management to reference them when building AI governance frameworks, and national supervisors that sit on the FSB will measure their own rules against them.
The practices split into governance and life cycle risk
The first four practices concern organisation-wide governance: the board and senior management’s role in aligning AI adoption with the firm’s business model, risk appetite and strategy; a governance framework with defined roles; bringing AI risks into the risk management framework with proper documentation of AI use; and continuous learning and adaptation.
The other eight cover the AI life cycle from development to deployment. They are a systematic assessment of materiality and risk for each use case, at inception and afterwards; selecting appropriate technologies; data governance; explainability, with compensating controls where a model cannot be explained; evaluation of performance; human oversight; management of AI-related cyber and ICT risk; and management of risks from third-party AI dependencies.
Firms that have read the Monetary Authority of Singapore’s final AI guidelines, issued on 7 October, will find little new in that list. MAS covers the same ground: board oversight, inventories and materiality assessment, life cycle controls and accountability for third-party AI. The FSB says its practices are “broadly compatible” with work by other standard setters, and the overlap with Singapore suggests national regimes and the FSB have converged on the same core expectations.
The FSB says the practices can be tailored to each firm’s context and risk profile, and the report includes case studies of benefits reported by financial institutions and of practices applied proportionately. That is a signal to smaller banks and insurers that the list is a menu to be scaled, and a reminder to large firms that supervisors will expect most of it in full.
Explainability gets a pragmatic answer
The one practice that addresses a live supervisory dispute is explainability. Some model types, including large language models, cannot be explained in the way a credit scorecard can. The FSB’s practice (viii) refers to “explainability of various types of AI and consideration of compensating controls”, which accepts that explainability differs by model type and asks firms to make up for gaps with other controls. That gives supervisors a basis for allowing the use of less transparent models in some functions, provided other controls, such as output testing and human review, carry more weight.
The Chair’s letter frames AI as a market risk
The practices arrived alongside FSB Chair Andrew Bailey’s letter to G20 finance ministers, dated 8 October and published on 12 October. The letter repeats risks Bailey raised in August, including “the potential for a market reassessment of AI-related valuations to trigger a broader market correction”, and “increasingly sophisticated AI-enabled cyber threats to the resilience of critical financial institutions and financial market infrastructures”.
While the Sound Practices will help financial institutions’ responsible AI adoption, there are broader macroprudential issues that may warrant continued consideration and coordination.
Andrew Bailey, FSB Chair, letter to G20 Finance Ministers and Central Bank Governors, 8 October 2026
That sentence separates two problems. The 12 practices deal with how a single bank or insurer uses AI. The macroprudential questions, such as many firms relying on the same few model providers or AI-driven trading amplifying moves, are system-wide and are not addressed by firm-level governance. Bailey says the rapid pace of development means safe AI adoption “should remain an important feature of the FSB’s agenda next year”, which points to further work in 2027.
Third-party dependence is where firm rules meet system risk
Practice (xii), on third-party AI dependencies, is the one that links the two levels. Each firm is asked to manage its exposure to outside providers. If every large bank relies on a small number of foundation model vendors and cloud platforms, the aggregate dependency is a concentration risk that no single firm can manage. The FSB says firms can integrate the practices into existing frameworks, including those for cyber and third-party risk, so AI vendors will be assessed alongside other outsourcing. Supervisors will want to collect data on which providers banks use before they can say whether concentration is a financial stability issue.
The FSB also published an overview of responses to the June consultation, and says it will update the practices as AI technologies evolve.
What to watch
- National supervisors’ references to the FSB practices in their own AI guidance.
- The FSB’s 2027 work programme on AI, including macroprudential issues.
- Any data collection by authorities on concentration in AI and cloud providers.
Primary sources
- FSB, FSB finalises sound practices for the responsible adoption of artificial intelligence (AI), 15 October 2026
- FSB, FSB Chair’s letter to G20 Finance Ministers and Central Bank Governors (PDF), 8 October 2026
- MAS, MAS sets out supervisory expectations on responsible AI adoption by financial institutions, 7 October 2026
Related: HKMA plans a registry of material AI agents under its new “ART” framework for banks
Photo (cropped): Carl Lender from Sunrise, USA, CC BY 2.0 via Wikimedia Commons
.jpg){kind=link}