Summary

• The FSB has finalised 12 sound practices, divided between four organisation-wide governance measures and eight covering risks throughout the AI lifecycle.
• Institutions are encouraged to assess AI use cases, maintain effective human oversight, evaluate performance and manage supplier dependencies.
• The practices are voluntary and designed to complement existing regulatory, supervisory and institutional risk frameworks.

The Financial Stability Board has finalised 12 recommended practices for the responsible use of artificial intelligence by financial institutions, calling for stronger accountability, effective human oversight and better management of risks arising from the technology and its suppliers.

The guidance, published on 15 October following a consultation launched in June, divides its recommendations between organisation-wide governance and the management of individual AI applications throughout their development and operation. It is intended to provide a common reference for banks, insurers and other financial businesses operating across different markets.

Although the FSB encourages boards and senior management to use the practices when reviewing their existing arrangements, the document does not create a new binding regulatory regime. Institutions are expected to apply the recommendations proportionately, taking account of their business models, risk profiles and existing obligations.

The finalisation follows growing use of generative and more autonomous AI within financial services. Applications that produce reports or analyse information can raise questions about accuracy and confidentiality, while systems authorised to complete connected tasks introduce additional concerns about permissions, operational responsibility and the ability to intervene.

Accountability stays with financial institutions

The first four practices address governance across an organisation. They cover the alignment of AI adoption with business strategy and risk appetite, clearly defined responsibilities, incorporation of AI into existing risk management arrangements, and continuous learning as the technology develops.

Under this approach, deciding to use AI is not solely a technical matter. A system that influences lending assessments, customer communications or internal risk analysis can affect established business processes, making its operation relevant to the people responsible for the institution’s wider controls.

Financial firms already use statistical models and automated software, but advanced AI systems can behave differently from applications whose decision rules are explicitly programmed. Their outputs may depend on patterns learned during training, on changing input data or on information retrieved while a task is being performed.

Consequently, conventional testing and approval processes may need to account for the way a particular application operates, rather than treating every product carrying an AI label as equivalent. A document summarisation tool and a system authorised to initiate financial transactions would not necessarily warrant the same controls.

The FSB recommends that institutions document AI use and assess whether applications remain consistent with the risks they are prepared to accept. Governance also needs to adapt as technology is modified or deployed in different circumstances, because an earlier assessment may no longer describe the system’s actual operation.

Testing continues after deployment

The remaining eight practices cover the AI lifecycle, beginning with assessments of individual use cases and the selection of appropriate technologies. They also address data governance, explainability, performance evaluation, human oversight, cybersecurity and reliance on external technology providers.

Data quality can affect an AI system’s results even when its underlying software is operating correctly. In financial services, incomplete, outdated or unrepresentative information may influence analysis, so institutions need to understand how relevant information is selected and processed.

Explainability presents another difficulty. Some AI systems cannot provide a simple account of why a particular output was produced, especially when results emerge from complex statistical relationships. The FSB recognises that compensating controls may be appropriate where direct explanation is limited.

Those controls depend on the risks associated with the application. Restrictions on what a system is permitted to do, additional testing and independent review may help manage uncertainty, but none automatically establishes that its outputs are reliable in every setting.

Performance monitoring must also continue after deployment. Changes to input data, external services or a model’s configuration can alter results, while failures may emerge only when a system encounters circumstances absent from its original testing.

For financial institutions, the practical challenge is connecting technical monitoring to people with authority to investigate concerns and restrict or suspend an application. Detecting abnormal behaviour has limited value if responsibility for responding to it remains unclear.

Autonomous agents make intervention harder

The expanding use of agentic AI increases the importance of the FSB’s recommendation for effective human oversight. These systems may undertake sequences of actions, draw information from multiple sources and interact with software tools without seeking approval at every step.

Such capabilities could automate parts of existing financial workflows, although they also increase the consequences of incorrectly assigned permissions or inadequate supervision. An error in a generated draft may be corrected before anyone acts on it, whereas a system authorised to alter records or trigger transactions could affect an operational environment directly.

Human oversight therefore involves more than placing an approval requirement somewhere within a process. Institutions need to consider whether staff can understand the actions being taken, identify when intervention is necessary and exercise meaningful control before a problem spreads.

The FSB does not prescribe identical intervention arrangements for every use case. Its recommendations are intended to help organisations choose safeguards proportionate to the risks and operational characteristics of the systems they deploy.

Supplier relationships remain a vulnerability

Many financial institutions obtain AI functionality from cloud providers, software vendors or external model developers. Those relationships create dependencies involving service availability, data processing, security and changes to technology over which the financial institution may have limited direct control.

When AI functionality is incorporated into an established enterprise application, a supplier can change the available capabilities without the customer replacing its underlying software. Governance consequently depends on maintaining an accurate understanding of third-party services rather than relying only on the checks performed when a contract was first signed.

The FSB includes the management of AI-related cybersecurity and information technology risks among its sound practices. Connections between AI applications and existing systems may expose sensitive information or operational functions, particularly where automated tools have broad permissions.

Across Europe, financial institutions must also consider requirements such as those arising under the Digital Operational Resilience Act. The FSB’s practices are compatible with existing regulatory work, but they do not replace national or regional rules governing resilience and outsourcing.

The FSB received approximately 160 responses to its consultation and has published a separate account of the feedback and changes made before finalisation. It says the resulting framework can be integrated with existing controls and will be updated as AI capabilities evolve.

Its publication establishes a set of international expectations rather than proof that financial institutions have implemented effective safeguards. Boards and management teams still need to determine where AI is operating, what authority it has and whether the organisation can maintain control when the technology produces an unexpected result.