On 15 October 2026 the Financial Stability Board, which coordinates financial regulators internationally, published 12 final sound practices for financial institutions adopting artificial intelligence (AI). They cover board oversight, governance, risk assessment, data, explainability, testing, human oversight, cyber risk and outside AI providers. They are guidance, not binding rules, and institutions tailor them to their size and risk.
A worked example: a credit model built on a vendor’s AI
Take a mid-sized bank that wants to decide personal loans faster, using a credit model supplied by an outside AI provider. This is our illustration, not a case from the report.
Until now the bank leaned on its supervisor’s rules on model risk and outsourcing, and on the FSB’s 2023 third-party risk toolkit, which the report calls technology-neutral. The report adds AI-specific questions. Four of them:
-
How much does this model matter?
The bank assesses materiality, meaning the model’s importance to its viability, critical operations and legal duties, at the start and again before scaling up. AI heavily relied on for credit decisions may warrant greater explainability.Practices 5 and 8
-
What if the vendor will not open up its model?
The report points to compensating controls: more testing before launch, low-risk uses first, closer human oversight, warranties or indemnities. If nothing brings the risk within appetite, the bank may decide not to use it.Practice 12
-
What should the contract cover?
Monitoring, audit and information rights; data terms, including where data is processed; business continuity; termination; and notice of material changes to the AI’s behaviour.Practice 12
-
What does the applicant get?
Possibly a notice that AI may materially influence the decision, and of any right to an explanation or redress. One form of oversight the report lists lets customers appeal an AI-enabled loan denial.Practices 8 and 10
Terms, in plain words
- AI
- A machine-based system that infers from its input how to produce outputs such as predictions, content or decisions.
- Agentic AI
- AI that acts as an autonomous agent, carrying out tasks without direct human intervention.
- Explainability
- How far people can understand how an AI system turns inputs into outputs.
- Compensating controls
- Extra safeguards used where explainability or vendor information is limited.
What is the Financial Stability Board, and does its guidance bind anyone?
The Financial Stability Board (FSB) coordinates the work of national financial authorities and international standard-setting bodies. Its members include national authorities from 24 countries and jurisdictions, alongside international bodies, and its Chair is Andrew Bailey, Governor of the Bank of England.
Its decisions are not legally binding. The FSB works by moral suasion and peer pressure, and national authorities implement its policies. This report is softer still: the practices are non-prescriptive and “do not constitute a binding international standard”. Following them does not release an institution from local legal requirements on AI.
Why was it issued, and what came before?
The FSB’s stated aim is to help institutions “harness the benefits of AI while managing its risks responsibly, in ways that support the resilience of the financial system”. AI, the report says, may amplify existing risks and introduce new ones.
The FSB assessed AI and machine learning in financial services in November 2017. Its November 2024 update named four AI-related vulnerabilities: third-party dependencies and provider concentration, market correlations, cyber risks, and model risk, data quality and governance. The draft sound practices followed on 10 June 2026 and drew around 160 responses.
Our reading: the earlier reports assessed risks for authorities; this one speaks directly to institutions’ boards and senior management.
What are the 12 sound practices?
Four set governance across the organisation. Eight manage risk through the AI lifecycle, from first idea (inception) to retirement. The FSB says the order does not signal priority.
Organisation-wide governance
- Strategic direction and oversight Board and senior management align AI with business model, risk appetite and strategy.
- Governance and accountability Clear roles and a fitting framework.
- AI risks in the risk framework With documentation of AI use.
- Organisational adaptability Learn and adjust as AI evolves.
Across the AI lifecycle
- Materiality and risk assessment At inception and after.
- Selection Models chosen against needs and risk.
- Data governance Data fit for purpose.
- Explainability and transparency Or compensating controls.
- Performance management Testing and monitoring.
- Human oversight Matched to risk and autonomy.
- Cyber and ICT risk ICT: information and communication technology.
- Third-party AI risk Including concentration and continuity.
Proportionality, scaling the effort to size and risk, runs through all twelve. Large, complex or highly connected institutions, and AI in critical functions, may need stronger practices. Smaller institutions and lower-risk uses may apply only the relevant practices, or adapt them.
What changed from the June draft?
The FSB’s overview of responses lists the main changes:
- Clearer roles for the board and senior management, with routes for smaller institutions to use existing roles and outside experts.
- Documentation that supports traceability and the reconstruction of actions, especially for agentic AI.
- Third-party risk widened to embedded AI (AI inside a vendor tool not sold as AI), sub-outsourcing, concentration, continuity and exit plans.
- New agentic AI considerations, which the FSB says were not fully consulted on and were distilled from responses.
Risks to the financial system as a whole stay outside this report; the FSB will keep monitoring them in its regular vulnerability assessments.
Who is affected, and from when?
All types of financial institutions. Its case studies run from banks and insurers to a lending fintech. Boards and senior management are “strongly encouraged” to reference the practices when they build and refine AI governance, risk management and control frameworks.
As guidance, it carries no compliance date. Any binding requirement would come from a national authority’s own rules.
Points to watch
The FSB calls practices for agentic and multi-agent AI nascent, and says they may get fuller treatment later; it will update the practices as needed. The report also suggests finance-specific transparency tools, such as sector-specific model cards, built with authorities and AI providers.
Legal basis
| Status | FSB Charter: activities not binding (report, inside cover); practices non-binding (Executive summary). |
| Practices | 1 to 4: Section 2. 5 to 12: Section 3. List: Annex. |
Key facts
| Authority | Financial Stability Board |
|---|---|
| Instrument | Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report |
| Issue date | 15 October 2026 |
| Effective date | No effective date; non-binding guidance available from publication |
| Applies to | All types of financial institutions; boards and senior management are encouraged to reference it |
| Status | Final; non-binding guidance, not an international standard |
| Official source | fsb.org, Publications, 15 October 2026 |
| Last verified | 20 October 2026. Report page, PDF and press release opened on fsb.org |
Frequently asked questions
Are the FSB’s AI sound practices binding on banks?
No. The report says they do not constitute a binding international standard. Binding rules would come from national authorities, and local legal requirements on AI still apply.
How are the 12 sound practices grouped?
Practices 1 to 4 cover organisation-wide AI governance. Practices 5 to 12 cover risk management across the AI lifecycle.
What if an AI vendor will not share enough information about its model?
The institution uses compensating controls, such as more testing and closer oversight. If none brings the risk within appetite, it may decide not to use that model.
Does the final report cover agentic AI?
Yes. It adds considerations for agentic AI, distilled from consultation responses, and says practices in this area are still nascent.
Sources (official)
- FSB, Final report, 15 October 2026 https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/
- FSB, Final report, PDF https://www.fsb.org/uploads/P151026-1.pdf
- FSB, Press release, 15 October 2026 https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/
- FSB, Overview of consultation responses https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-overview-of-consultation-responses/
- FSB, Consultation report, 10 June 2026 https://www.fsb.org/2026/06/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-consultation-report/
- FSB, About the FSB https://www.fsb.org/about/
- FSB, AI and machine learning in financial services, 2017 https://www.fsb.org/2017/11/artificial-intelligence-and-machine-learning-in-financial-service/
- FSB, Financial stability implications of AI, 2024 https://www.fsb.org/2024/11/the-financial-stability-implications-of-artificial-intelligence/
- FSB, Third-party risk management toolkit, 2023 https://www.fsb.org/2023/12/final-report-on-enhancing-third-party-risk-management-and-oversight-a-toolkit-for-financial-institutions-and-financial-authorities/
- Global
- Financial Stability Board
- Artificial intelligence
- AI governance
- Third-party risk
- Banking Regulations
Book a demo to see how each regulatory change becomes an executable action list, with immediate, safer compliance as well.
Agentic AI Built Exclusively for BFSI
Neurasix delivers rule-aligned agentic workflows – from regulatory intelligence to audit-ready outputs