Analysis
Banks, insurers and payment firms have used AI for years, but the FSB says rapid advances in generative AI, which produces text and other content, and agentic AI, which can act toward goals with some autonomy, have drawn new interest. The report is guidance rather than a rule, so its effect will depend on how national supervisors and individual firms choose to use it.
What the FSB published
The Financial Stability Board published the final version of "Sound Practices for Responsible Adoption of Artificial Intelligence (AI)" on October 15, 2026 [1]. The FSB coordinates international work among national financial authorities and standard-setting bodies; its members include authorities from 24 countries and jurisdictions, and it is chaired by Andrew Bailey, Governor of the Bank of England [2]. The report follows a consultation draft the FSB released on June 10, 2026, which was followed by a virtual workshop and public comments in the summer [1][2].
The FSB says financial institutions have long used AI tools, but that rapid advances, particularly in generative AI and agentic AI, have generated significant interest [1]. The report sets out 12 sound practices that institutions are encouraged to consider to support responsible adoption, and it strongly encourages boards and senior management to refer to them when weighing business strategy, technology adoption and risk management [1].
The 12 practices
The FSB groups the practices in two sets. The first four concern organisation-wide governance: boards and senior management aligning AI use with the firm's business model, risk appetite and strategy; clear roles and responsibilities; including AI risks and documentation of AI use in the firm's risk management framework; and adjusting oversight and capabilities as AI evolves [1].
The remaining eight describe managing risk across the AI lifecycle, from development to deployment [1]. They call for assessing how material and risky each AI use case is at the start and afterward; weighing business needs and risks when choosing a model or system; keeping the data used to train, test and run AI accurate, complete, consistent, reliable and secure; understanding differences in how explainable various AI types are, and using more or compensating controls where appropriate and feasible; evaluating performance in proportion to materiality and risk through testing and monitoring; managing cyber and technology risks; and managing risks from third-party AI dependencies, including supply chain and concentration risks and business continuity [1].
Practice 10 covers human oversight. It calls for "appropriate and effective" oversight that is relevant to the materiality, risk, autonomy, complexity and of different AI use cases [1].
Guidance, not a rule
The FSB's language is advisory: institutions are "encouraged to consider" the practices [1]. In its June consultation draft, the FSB said the practices were not meant to set an international standard or impose a prescriptive approach, and that they were intended for all types of financial institutions [2]. The FSB itself does not make binding rules; it develops and promotes policies that national authorities may then apply in their own jurisdictions [2].
What remains uncertain
This account rests on the FSB's final-report web page. The final report's full text was not reviewed for this story, so details beyond that page, including how the final version differs from the June draft, are not described here. Statements about the scope and non-binding nature of the practices come from the June consultation materials.