Twelve practices, two groups, one message for bank boards: know what your AI is doing. The Financial Stability Board has published its final report on responsible AI adoption in finance, and the bottom line is that governance now sits with senior management, not the IT department.
The report follows a consultative draft released in June 2026 and reflects the public feedback on it. The FSB, which coordinates financial regulators and standard-setters across 24 countries and jurisdictions, says the practices are meant to let institutions capture the benefits of AI without weakening the resilience of the financial system. They also aim to encourage information-sharing among institutions, supervisors and other stakeholders, within and across borders. The board and senior management of financial institutions are strongly encouraged to use them when building or refining their AI governance, risk management and control frameworks.
Group one: governance across the organization
The first set of practices puts the board and senior management in charge of keeping AI adoption in line with the institution’s business model, risk appetite and strategy. Investors will note the specifics. Firms should keep a governance framework with clearly defined roles and responsibilities, fold AI risks into their wider risk management framework, and document how AI is used. The fourth item is continuous learning and adaptation.
Group two: risk across the AI lifecycle
The second set covers the full life of an AI system, from development and deployment to monitoring. The figure that matters here is the number of checkpoints, eight in all:
Firms should assess the materiality and risks of each use case at inception and again afterward, choose suitable AI technologies, and apply sound data governance. They should be able to explain how different types of AI reach their outputs, and weigh compensating controls where explanation falls short. Performance of each use case should be evaluated, and human oversight should be appropriate and effective. The last two items deal with AI-related cyber and information and communication technology risks, and with risks from third-party AI dependencies. That last one matters for any bank that buys its models rather than building them.
Built to be adapted
The FSB describes the practices as a toolkit that institutions can tailor to their own context and risk profile. They can be folded into existing frameworks, including those for cyber and third-party risk. The report adds case studies showing the benefits firms have reported and how some practices have been applied proportionately. The FSB says they build on, and are broadly compatible with, work by itself and other standard-setting bodies.
The FSB also published an overview of the responses to its June consultation, and it says it will monitor developments and update the practices as AI technologies and applications evolve.
Sources
- Artificial intelligence
- FSB finalises sound practices for the responsible adoption of artificial intelligence (AI)
- What My Son Is Learning From Artificial Intelligence
Photo: European Commission – Photographer: Aurore Martignoni (CC BY 4.0)
