On 15 October 2026, the Financial Stability Board (FSB) published a final report setting out 12 sound practices to facilitate responsible artificial intelligence (AI) adoption by financial institutions. The final report includes case studies illustrating the benefits that financial institutions have reported and how some sound practices have been applied proportionately.
Sound practices
The 12 sound practices are organised into two groups.
The first four sound practices emphasise the importance of organisation-wide AI governance as financial institutions adopt AI. The subsequent eight sound practices set out a comprehensive framework for managing risks throughout the AI lifecycle, from inception to retirement.
The sound practices are:
- Sound Practice 1 (Strategic direction and oversight): The board and senior management align AI adoption and governance with the financial institution’s business model, risk appetite and strategy.
- Sound Practice 2 (Governance and accountability): Financial institutions define clear roles and responsibilities and maintain an appropriate governance framework to enable responsible AI adoption.
- Sound Practice 3 (Incorporation of AI risks into risk management framework and effective documentation of AI use): Financial institutions adopt risk management frameworks that effectively address AI risks and include processes for documentation of AI use, as well as for materiality and risk assessment.
- Sound Practice 4 (Organisational adaptability): Financial institutions learn, adapt and adjust their oversight, governance, risk management practices and capabilities as AI evolves.
- Sound Practice 5 (Materiality and risk assessment): Financial institutions implement an effective and systematic approach to assess the materiality and risk of AI use cases at the inception stage and thereafter.
- Sound Practice 6 (Selection process): When selecting AI models or systems, financial institutions consider business objectives, operational and technical needs, as well as the materiality and risks of AI use cases.
- Sound Practice 7 (Data governance): Financial institutions establish appropriate data governance to maintain data that is fit-for-purpose for training, testing and using AI (i.e. accurate, complete,
- consistent, reliable, secure).
- Sound Practice 8 (Explainability and transparency): Financial institutions understand differences in the explainability of various types of AI. If appropriate and feasible, financial institutions adopt more explainable AI or consider compensating controls. Financial institutions also provide appropriate transparency tailored to different stakeholders.
- Sound Practice 9 (Performance management): Financial institutions evaluate the performance of AI use cases proportionately to their materiality and risk, including through performance assessments, testing and ongoing monitoring.
- Sound Practice 10 (Human oversight): Financial institutions implement appropriate and effective human oversight relevant to the materiality, risk, autonomy, complexity and explainability of different AI use cases.
- Sound Practice 11 (Cyber and ICT risk management): Financial institutions manage AI-related cyber and ICT risks, including, where appropriate, by incorporating AI cyber and ICT risk scenarios into tests and exercises, sharing relevant information and using AI tools in cyber and ICT risk management.
- Sound Practice 12 (Third-party AI risk management): Financial institutions appropriately manage risks from third-party AI dependencies with a focus on performance, transparency, data quality, supply chain and concentration risks and business continuity.
Next steps
The sound practices are non-prescriptive and do not constitute a binding international standard. Instead they serve as a practical toolkit that financial institutions can tailor to their specific context and risk profile, and integrate into existing frameworks where appropriate, including those for cyber and third-party risk. The FSB encourages boards and senior management of financial institutions to reference the sound practices when developing and refining their institution’s AI governance, risk management and control frameworks, including as AI adoption expands over time.