Publication date: 16 October 2026
The Financial Stability Board has finalised 12 sound practices for financial institutions adopting artificial intelligence. The guidance is non-binding, but its significance lies in turning broad calls for “responsible AI” into a supervisory framework that boards, risk teams and technology leaders can apply to real systems.
The report covers governance, risk assessment, technology selection, data quality, explainability, performance evaluation, cyber resilience and third-party dependencies. It also places explicit emphasis on effective human oversight as generative AI evolves into agentic systems capable of pursuing goals and initiating actions.
That shift matters in finance because autonomy changes the speed and shape of failure. A conventional model may score a loan or flag a transaction. An agent can chain together tools, retrieve data, communicate with other systems and act repeatedly. A mistake can therefore propagate before a human reviewer encounters a single decision.
Accountability cannot be delegated to the model
The FSB’s framework begins with boards and senior management. Institutions are expected to define responsibility, align AI use with risk appetite and maintain enough expertise to challenge how systems are selected and operated. Human oversight is not presented as a decorative approval step; it must be appropriate to the materiality and autonomy of the use case.
For lower-risk tools, monitoring and retrospective review may be sufficient. For agents able to move money, change customer records or alter access rights, meaningful control may require transaction limits, real-time alerts, separation of duties and a reliable way to stop the system. The relevant question is not simply whether a person is “in the loop,” but whether that person has the information, time and authority to intervene.
The guidance also treats AI as a lifecycle risk. Institutions should assess materiality at the start and revisit it as models, data, user behaviour and external conditions change. That is crucial for systems supplied by third parties, where an update can materially alter performance without the customer rebuilding the model.
A global baseline without a new rulebook
The FSB has deliberately issued technology-neutral practices rather than a prescriptive global regulation. That makes the document adaptable across banks, insurers and other financial firms, but it leaves national supervisors to decide how strongly to embed it in examinations and enforcement.
Its influence is likely to come through convergence. When an international standard setter identifies board accountability, traceability, cyber controls and third-party concentration as sound practice, firms will find it harder to argue that those controls are optional. Internal audit teams and regulators gain a common vocabulary for asking whether an institution can explain, test and stop an AI system.
The leadership implication is practical: financial institutions should build evidence, not merely policies. They need inventories of AI use cases, named owners, testing records, incident procedures and documented intervention thresholds. An agent should not receive more authority simply because its output appears fluent or its vendor is well known.
The FSB’s standard does not settle every question about autonomous finance. It does establish an important default: as machines gain the ability to act, human accountability must become more explicit, not less.