The Financial Stability Board has issued nonbinding guidance for financial institutions adopting artificial intelligence, pairing board-level accountability with lifecycle risk controls.

What the FSB published

The Financial Stability Board (FSB) published its final report, Sound Practices for Responsible Adoption of Artificial Intelligence (AI), on October 15, 2026. The report is aimed at all types of financial institutions, rather than only banks or the largest technology users. It sets out 12 practices that institutions are encouraged to consider as they adopt, use and innovate with AI. The FSB’s publication page provides the report date and the full list of practices in its summary of the final report.

Fact: The framework is nonbinding, non-prescriptive and non-exhaustive. It is not a new, globally enforceable AI law. The report does not displace national or regional statutes, supervisory requirements, data-protection rules, existing model-risk controls or other local law. Institutions and authorities must continue to apply the rules that govern them in their own jurisdictions.

Recommendation: The FSB strongly encourages boards and senior management to use the practices when considering business strategy, technology adoption and risk management. The degree of implementation is intended to be proportionate to an institution’s size, business model, the materiality of a use case and its risk. That proportionality is significant: a small, narrowly scoped internal tool need not receive exactly the same controls as a system that affects customers, markets, payments or critical operations.

The final report follows a public consultation whose response period closed on July 22, 2026. The FSB received around 160 responses. Those figures describe the consultation process, not a vote or a measure of industry compliance. The report’s publication date and the consultation’s closing date are separate events.

A two-part framework

The FSB organizes the 12 practices into two related groups. The first covers organization-wide AI governance. It asks whether the institution has a direction, accountability structure and risk framework capable of overseeing AI as it becomes part of business operations.

The second covers risk management across the AI lifecycle, from a use case’s inception and selection through development, deployment and monitoring. The report notes that there is no single standard lifecycle for every AI system. A statistical model used for a limited internal task, a generative assistant and an autonomous agent may require different checkpoints and controls.

This structure avoids treating “AI” as one uniform risk. The FSB identifies benefits such as efficiency, lower costs and wider access, while noting that AI can amplify familiar risks or introduce new ones. Less explainable systems can complicate model risk; autonomous systems can take unauthorized or erroneous actions. AI can support cyber defense but also increase the speed, frequency or impact of attacks. Institutions therefore need to assess both adoption and non-adoption without assuming every use case has the same profile.

The 12 sound practices

1–4: organization-wide governance

1. Strategic direction and oversight: Boards and senior management should align AI adoption and governance with the institution’s business model, risk appetite and strategy.

2. Governance and accountability: Institutions should define roles and responsibilities and maintain a framework that makes ownership of decisions, controls and escalation clear.

3. Risk management and documentation: AI risks should enter the risk-management framework, with documentation of AI use and processes for assessing materiality and risk. The report does not prescribe one inventory format.

4. Organizational adaptability: Oversight, capabilities and controls should evolve as AI evolves; one governance design may not remain adequate as systems and use cases change.

5–10: lifecycle controls

5. Materiality and risk assessment: Institutions should assess an AI use case at inception and thereafter. Its potential effect on customers, markets, safety and resilience should shape the controls.

6. Selection process: When choosing a model or system, institutions should consider business objectives, technical and operational needs, and materiality and risk. Selection is more than a performance benchmark: it includes whether the system can be governed in context.

7. Data governance: Data used to train, test and operate AI should be accurate, complete, consistent, reliable and secure. This remains relevant when a third party supplies the model.

8. Explainability and transparency: Institutions should understand differences among AI types and, where appropriate and feasible, choose more explainable systems or use compensating controls. Transparency should fit different stakeholders; the report does not promise full explanations for every system.

9. Performance management: Performance should be assessed, tested and monitored in proportion to materiality and risk. A launch-time test is not enough when data, conditions or behavior change.

10. Human oversight: Oversight should reflect materiality, risk, autonomy, complexity and explainability. Depending on the use case, it may involve review, approval, intervention, escalation, contestability, override or a stop mechanism.

11–12: cross-cutting technology and supplier risks

11. Cyber and ICT risk management: Institutions should manage AI-related cyber and ICT risks, including, where appropriate, AI cyber scenarios in tests and exercises, relevant information sharing and AI tools for cyber and ICT risk management.

12. Third-party AI risk management: Institutions should manage external AI dependencies with attention to performance, transparency, data quality, supply-chain and concentration risks, and business continuity. Buying a system does not remove operational responsibility.

What changed on agentic AI

Agentic AI receives attention in the final guidance, but it is one part of a wider framework rather than the report’s sole subject. In its October 15, 2026 coverage of the final guidance, Reuters reported that the FSB strengthened its recommendations on human oversight for agents that can plan and execute tasks with limited human supervision. In higher-risk uses, more intensive oversight is described as critical, and firms are advised to establish clear, risk-based triggers for when an agent must seek human approval. See Reuters’ report; the Reuters publication date is distinct from the report’s underlying consultation and drafting history.

Fact about the final text: Reuters also reported that the FSB removed draft wording that would have described AI as “synthetic employees.” The final approach instead recognizes that AI agents do not reason like humans and may interpret predefined goals unexpectedly. That change matters because it frames oversight around system behavior, permissions and outcomes rather than an analogy to a human worker.

Recommendation, not a universal ban: The final guidance does not say that every agent must receive the same approval workflow or that institutions must avoid agentic systems. A risk-based trigger could be linked to the value of a transaction, a change in permissions, contact with a customer or an attempted action outside a defined boundary. The exact trigger is for an institution to design under applicable law and supervision, with intensity matched to the risk.

What it means for institutions

For boards and senior managers, the practical implication is to connect AI strategy to existing governance rather than treat deployment as an isolated technology purchase. A proportionate review might identify material use cases, assign owners, record dependencies, define escalation paths and map each use case to data, performance, explainability, human-oversight, cyber and third-party controls.

For risk, compliance, technology and procurement teams, the report offers a lifecycle vocabulary: ask how a system is selected, tested, monitored and changed, and whether external providers create concentration, supply-chain, data-quality, transparency or continuity concerns. A system acceptable at inception may need new controls after its data, model, autonomy or operating environment changes. The report does not set one testing frequency, documentation template or safe-product designation.

For customers and market participants, it may sharpen questions about AI-assisted decisions and operations. It does not guarantee an explanation, a human appeal or a particular result; those depend on implementation, supervision and applicable law.

Limits and open questions

The final report is a supervisory reference point, not an empirical performance study. Its case studies are illustrative scenarios, not measured outcomes or evidence that a control reduced losses, bias, incidents or costs. The approximately 160 consultation responses show engagement, but not consensus, adoption or compliance.

The FSB’s language is flexible and non-exhaustive. National authorities may translate it into more specific expectations, other laws may impose additional duties, and future AI capabilities may test today’s controls. That is why adaptability and ongoing monitoring appear in the framework.

The central policy question is therefore implementation: how institutions document use cases, classify risk, set human decision points, test systems, supervise providers and respond to incidents. The FSB has supplied a structured set of recommendations. It has not supplied a single global rulebook or a guarantee that responsible outcomes follow automatically from using the checklist.

FAQs

Is the FSB guidance legally binding?

No. The 12 practices are recommendations that the FSB says financial institutions are encouraged to consider. They are nonbinding, non-prescriptive and non-exhaustive. Local law and applicable supervisory requirements still apply, and a jurisdiction may set more specific or demanding obligations.

Which financial institutions are covered?

The report is intended for all types of financial institutions. The practices should be applied proportionately to an institution’s size, business model, the materiality of an AI use case and its risk. The final report does not create an identical control burden for every firm.

Does the report focus only on agentic AI?

No. Agentic AI is discussed because autonomous planning and execution create distinctive oversight questions, and the final guidance strengthens recommendations for human approval in higher-risk situations. The 12 practices also cover governance, risk assessment, data, explainability, performance, cyber and ICT risk, and third-party dependencies across AI use cases.

What does human oversight mean under the recommendations?

It means oversight appropriate to the system’s materiality, risk, autonomy, complexity and explainability. Depending on the use case, it could include approvals, monitoring, escalation, intervention, contestability, overrides or a stop mechanism. The report does not set one universal human-in-the-loop design.

Do the case studies prove that the practices work?

No. The case studies are illustrative, not measured outcome studies. They show possible applications of the practices and should not be read as independent evidence of lower losses, improved accuracy or successful deployment across the sector.

References