The Financial Stability Board has finalized 12 nonbinding sound practices to help financial institutions adopt artificial intelligence while managing risks to their operations, customers and financial stability. Following its June 2026 consultation, the FSB strongly encourages boards and senior management to use the practices when developing or refining AI governance, risk management and control frameworks. The toolkit is intended to be applied proportionately based on an institution’s size, complexity and interconnectedness, as well as the materiality and risk of each AI use case. The first four practices address organization-wide governance, including strategic oversight, clear accountability, integration of AI risks and documentation into existing risk frameworks, and continued adaptation as technology evolves. The remaining eight cover the AI lifecycle, including materiality and risk assessments, technology selection, data governance, explainability and transparency, performance monitoring, human oversight, cyber and information and communication technology risk, and third-party dependencies. Changes made after consultation include clearer board and senior management roles, additional documentation guidance, greater transparency for higher-risk and higher-materiality uses, broader third-party risk coverage, and further consideration of agentic AI and multi-agent systems. The practices can be integrated into existing frameworks, including those for cyber and third-party risk, and are designed to support coordination and information-sharing across institutions, supervisors and jurisdictions. The FSB will monitor developments and update the toolkit as AI technologies and associated risks evolve.
Financial Stability Board finalizes 12 sound practices for responsible AI adoption by financial institutions
The Financial Stability Board has finalized 12 nonbinding sound practices covering organization-wide AI governance and risk management throughout the AI lifecycle. The proportionate toolkit addresses areas including documentation, data, explainability, performance, human oversight, cyber risk and third-party dependencies, with expanded consideration of agentic AI following consultation. Boards and senior management are strongly encouraged to incorporate the practices into existing governance and control frameworks.