Part of the AI Regulation News hub.
The Financial Stability Board has finalised 12 non-binding sound practices that encourage financial institutions to govern AI adoption across the board and across each use case's lifecycle
This is international supervisory guidance, not a rule. On the FSB's account, institutions are encouraged to consider the practices and to tailor them to their context and risk profile.
Bottom line: The report is non-binding. The FSB's page says the 12 sound practices are ones financial institutions are encouraged to consider, and its press release says the FSB strongly encourages boards and senior management to reference them. Neither text says the report creates a legal duty, and the FSB does not say it displaces national requirements. Whether any national supervisor adopts it is a separate question.
Who this affects: Boards, senior management, risk and compliance leads, technology and third-party risk teams at financial institutions, and the supervisors who oversee them. The sound practices are written for financial institutions generally, not for one sector.
Issue date: 15 October 2026, the date on the FSB page and on its press release (Ref: 14/2026). The final report follows a consultation report of 10 June 2026. No compliance deadline is stated on the pages we read.
What changed: The FSB finalised the consultation draft into 12 sound practices in two groups: four on organisation-wide AI governance, and eight on managing risk through the AI lifecycle. It said the final report reflects public feedback on the June 2026 consultative version, and published an overview of the consultation responses the same day.
Analysis: Our inference: the practical use of a document like this is as a reference point in supervisory dialogue and internal frameworks, since it says it can be tailored and integrated into existing cyber and third-party risk frameworks. Practice 8 on explainability is the most flexible in wording: it points to compensating controls where more explainable AI is not appropriate or feasible.
Primary sources: FSB, Sound Practices for Responsible Adoption of AI: Final report (publication page) · FSB press release, 15 October 2026
- Instrument (EN)
- Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report
- Authority
- Financial Stability Board (FSB)
- Jurisdiction
- International. The FSB coordinates national financial authorities and international standard-setting bodies
- Status
- Final report, published 15 October 2026 after a June 2026 consultation. Tagged on fsb.org as a report to the G20
- Bindingness
- Non-binding. Institutions are encouraged to consider the practices; the FSB strongly encourages boards and senior management to reference them
- Issue date / next deadline
- 15 October 2026. No deadline stated on the pages we read. The FSB says it will monitor developments and update the practices as necessary
- Structure
- 12 sound practices in two groups: organisation-wide AI governance, and risk management throughout the AI lifecycle
- Companion document
- Overview of consultation responses, published the same day
- Primary source
- https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/
What did the FSB finalise, and how binding is it?
On 15 October 2026 the Financial Stability Board published the final version of its Sound Practices for Responsible Adoption of Artificial Intelligence. The consultation report came out on 10 June 2026. The FSB says the final report reflects the public feedback it received on that consultative version.
Read the verbs. The report page says the 12 sound practices are ones financial institutions are encouraged to consider, and the press release says the FSB strongly encourages boards and senior management to reference them when developing and refining their AI governance, risk management and control frameworks. That is guidance language.
The FSB brings together national authorities and international standard-setting bodies, so its output matters to supervisors. But the pages we read describe the report as a practical toolkit that institutions can tailor, not as a standard that supervisors are told to apply. Any binding effect would come from how an individual national authority uses it.
What are the two groups of practices?
The first group, practices 1 to 4, is about governance across the organisation. Practice 1 addresses the role of the board and senior management in aligning AI adoption and governance with the institution's business model, risk appetite and strategy. Practice 2 asks for clear roles and responsibilities and an appropriate governance framework. Practice 3 asks for risk management frameworks that address AI risks, including documentation of AI use and processes for materiality and risk assessment. Practice 4 asks institutions to learn and adjust their oversight and capabilities as AI evolves.
The second group, practices 5 to 12, follows a use case through its life: materiality and risk assessment at inception and afterwards, selection of models and systems, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.
What do the lifecycle practices ask for?
Practice 5 asks for an effective and systematic approach to assessing the materiality and risk of AI use cases at the inception stage and thereafter. Practice 6 says that, when selecting AI models or systems, institutions consider business objectives, operational and technical needs, and the materiality and risks of the use case.
Practice 7 covers data governance: data that is fit for purpose for training, testing and using AI, which the FSB glosses as accurate, complete, consistent, reliable and secure. Practice 8 asks institutions to understand differences in explainability between types of AI and, where appropriate and feasible, to adopt more explainable AI or consider compensating controls, with transparency tailored to different stakeholders.
Practice 9 asks for performance evaluation proportionate to materiality and risk, through assessments, testing and ongoing monitoring. Practice 10 asks for human oversight relevant to the materiality, risk, autonomy, complexity and explainability of each use case.
Practice 11 covers AI-related cyber and ICT risk, including, where appropriate, building AI scenarios into tests and exercises, sharing relevant information, and using AI tools in cyber and ICT risk management. Practice 12 covers third-party AI dependencies, with a focus on performance, transparency, data quality, supply chain and concentration risks, and business continuity.
How do the practices meet existing frameworks?
The press release calls the sound practices a practical toolkit that institutions can tailor to their context and risk profile and integrate into existing frameworks, including those for cyber and third-party risk. It also says they build on, and are broadly compatible with, existing and ongoing work by the FSB and other standard-setting bodies. It adds that the report includes case studies showing benefits reported by institutions and how some practices have been applied proportionately.
Our inference, not the FSB's: for an institution already running cyber and outsourcing frameworks, practices 11 and 12 are likely to be mapping exercises against what exists, while practices 3, 5 and 10 are where AI-specific inventory, materiality tiers and oversight criteria would be new work. We have not compared the practices line by line with any particular national rulebook.
The FSB also states a goal beyond institutions: the practices aim to promote coordination, cooperation and information-sharing among institutions, supervisors and other stakeholders within and across jurisdictions.
What the FSB says comes next
The only forward-looking statement on the pages we read is that, as AI technologies and applications evolve, the FSB will monitor developments and update the sound practices as necessary. No implementation review date, peer review or deadline is given there.
The introduction notes that rapid advances, particularly in generative AI and agentic AI, have generated significant interest. We did not read the body of the report, so we do not state how it treats agentic AI in any particular practice.
What we did not verify
What we opened: the FSB's publication page for the final report, which lists all 12 practices in full, and the FSB's press release of 15 October 2026 (Ref: 14/2026). We confirmed the 15 October 2026 date from the page's published time and the release's heading, and the count of 12 practices from the list itself.
What we did not open: the full PDF of the final report with its explanatory text and case studies, the overview of consultation responses, and the June 2026 consultation report. So we cannot say what changed between the consultation draft and the final, how the report treats agentic or multi-agent AI beyond the introduction's mention, or what the case studies show.
What we refuse to claim: that any national supervisor has adopted or will adopt the practices, that the report sets a standard that displaces local obligations, or that any institution is out of step with it. The publication page was fetched live for this piece; the press release was served from a cache dated 4 November 2026. Published times and bodies agree with the sweep notes.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
For a financial institution using AI, the FSB report gives a 12-point checklist to hold its own governance against: board alignment, roles, risk framework and documentation, then per-use-case materiality, data, explainability, monitoring, human oversight, cyber and third-party risk. It binds nobody directly, so the useful step is a gap map against existing frameworks before a national supervisor asks for one.
Source File
Open the FSB publication page and confirm the 15 October 2026 date, the introductory sentence on practices institutions are encouraged to consider, and the list of Sound Practices 1 to 12. Then open the 15 October press release (Ref: 14/2026) and confirm the wording on tailoring, existing cyber and third-party frameworks, and monitoring and updating.
This report sets out 12 sound practices financial institutions are encouraged to consider to facilitate their responsible adoption of AI. ยท Financial Stability Board, final report page, 15 October 2026
FAQ
Is the FSB's AI report binding?
No. The FSB's page says the 12 sound practices are ones institutions are encouraged to consider, and its press release says it strongly encourages boards and senior management to reference them. Neither states a legal duty.
How many sound practices are there?
Twelve. Practices 1 to 4 cover organisation-wide AI governance. Practices 5 to 12 cover risk management through the lifecycle of each use case, from materiality assessment to third-party AI risk.
When was it published, and what came before it?
On 15 October 2026. A consultation report was published on 10 June 2026, and the FSB published an overview of the consultation responses on the same day as the final report.
Does the report mention agentic AI?
The introduction on the FSB page says rapid advances, particularly in generative AI and agentic AI, have generated significant interest. We did not read the full report, so we do not state how it handles agentic AI within individual practices.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.