FSB Sets Out Sound Practices for AI Adoption

The Financial Stability Board (FSB) has finalized 12 sound practices for responsible AI adoption by financial institutions, emphasizing organization-wide governance, board and senior management accountability, and risk management throughout the AI lifecycle.

The first four practices focus on governance. Boards and senior management are encouraged to align AI adoption with the institution’s business model, strategy, and risk appetite; establish clear roles and responsibilities; incorporate AI risks into existing risk management frameworks; and ensure the organization continues to build the skills and capabilities needed as the technology evolves. The FSB stresses that the practices are non-prescriptive and should be applied proportionately according to an institution’s size, complexity, and risk profile, as well as the materiality of individual AI use cases.

The remaining practices address AI across its lifecycle, including materiality and risk assessment, technology selection, data governance, explainability, performance monitoring, human oversight, cyber risk, and third-party dependencies. The FSB says institutions should maintain documentation and lifecycle records sufficient to support accountability, assurance, and auditability, with more extensive records for higher-risk uses. For agentic AI, this can include unique identifiers and records showing what triggered an agent’s actions, what information and tools it accessed, and whether it remained within its permissions.

The FSB says human oversight should reflect the materiality, autonomy, complexity, and explainability of different AI systems. The report discusses approaches ranging from “human-in-the-loop” review to “human-in-command” oversight for highly autonomous systems, as well as mechanisms such as kill switches and customer contestability. For agentic AI, the FSB emphasizes combining human oversight with technical controls that restrict permissions, require approval for consequential actions, and allow agents to be paused or overridden.

The FSB also stresses that institutions remain accountable when AI is supplied by third parties. Firms should assess provider risks, seek appropriate transparency and assurance, monitor concentration across the AI supply chain, and use compensating controls where information is limited. If those measures cannot bring the risks within the institution’s risk appetite, the institution may decide not to use the third-party system.