The Financial Stability Board’s final guidance calls for board-level accountability, lifecycle risk controls and closer scrutiny of third-party AI tools as adoption accelerates across financial services.
The Financial Stability Board has published final guidance on how banks, insurers and other financial firms should govern artificial intelligence, as regulators move to set clearer expectations for a technology that is spreading quickly through trading, risk analysis, customer service and internal controls. The report sets out 12 sound practices intended to help institutions capture the advantages of AI while keeping its risks in check, according to the FSB.
Released on 15 October 2026, the final report reflects work that began with a consultation paper in June, when the FSB asked for feedback on proposed principles for responsible AI adoption. The board said the final version is designed to support financial institutions as AI use expands, while also strengthening cooperation and information-sharing among firms, supervisors and other stakeholders across jurisdictions.
At the centre of the framework is board-level accountability. The first four practices focus on organisation-wide governance, including alignment with business strategy and risk appetite, clear roles and responsibilities, documentation of AI use and the ability to adjust oversight as systems evolve. The FSB also stresses that firms should not treat AI governance as a separate silo, but should integrate it into existing risk and control structures.
The remaining eight practices address risk management across the full AI lifecycle, from the first assessment of a use case through to retirement of a model or system. They cover materiality checks, model selection, data governance, explainability, performance monitoring, human oversight, cyber and information-technology risk management, and controls over third-party dependencies. In practical terms, that means firms should assess how material a use case is, test it properly, and understand how much confidence they can place in vendor-built tools.
The FSB says the framework is intentionally non-prescriptive and should be applied in proportion to a firm’s size, complexity, interconnections and the importance of the AI application itself. Larger and more connected institutions, particularly where AI is used in critical functions, may need more robust controls, while smaller firms and lower-risk use cases may warrant a lighter touch. The message from the board is that responsible AI adoption should be tailored, not uniform, but it should be anchored in the same basic discipline: governance, documentation, oversight and resilience.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
