The Financial Stability Board’s final set of 12 AI practices connects board-level decisions with the work of selecting, deploying and monitoring individual systems. Published on 15 October, the framework includes agentic AI while keeping responsibility with the financial institution using it.[1][2]
The practices are guidance, not a new globally binding law. They are intended to be applied in proportion to a use case’s materiality and risk, including its autonomy, complexity and explainability. That lets a firm distinguish a low-consequence drafting tool from a system involved in customer outcomes or important operations.[1][2]
Four practices establish ownership; eight follow the system
The first group concerns the organisation: strategic oversight, clear accountability, risk management and documentation, and the ability to adapt as AI changes. The second covers the lifecycle, from assessing a use case and choosing technology through performance, human oversight, cyber risk and third-party dependencies.[2]
The 12 practice areas
| Area | Practical focus |
|---|---|
| 1. Strategic direction and oversight | Align AI use with the institution’s strategy and risk appetite |
| 2. Governance and accountability | Assign clear roles and responsibilities |
| 3. Risk management and documentation | Record AI use and incorporate its risks into existing frameworks |
| 4. Organisational adaptability | Keep governance and capabilities responsive to change |
| 5. Materiality and risk assessment | Assess consequences at inception and as use evolves |
| 6. Selection | Choose technology suited to the objective and constraints |
| 7. Data governance | Maintain data fit for training, testing and use |
| 8. Explainability and transparency | Provide appropriate understanding and stakeholder information |
| 9. Performance management | Evaluate, test and monitor the use case |
| 10. Human oversight | Match oversight to risk and autonomy |
| 11. Cyber and ICT risk | Address threats and operational technology risks |
| 12. Third-party risk | Manage supplier performance, concentration and continuity |
The supplier question continues after procurement
The Bank of England and FCA survey published on 26 October gives the third-party practice immediate context. Its respondents reported that external implementations account for 39% of AI systems and 53% of highly material systems. The three largest providers accounted for 79% of reported cloud and compute relationships.[3]
The same survey found that 37% of 169 reported cloud and compute relationships were both highly critical and hard to substitute. Only 35% of that group had tested exit plans. These findings concern the surveyed relationships, not the whole global financial system, but they show why a model purchase cannot be evaluated only on accuracy and price.[3]
A provider can change a model, suffer an outage or become difficult to replace. The FSB’s framework places those questions alongside performance and data quality, making them part of continuing risk management. The connection is practical: a firm needs to know both whether a system works and whether the service can continue if its supplier changes.[2][3]
Oversight should identify the consequential decision
The human-oversight practice is proportionate rather than a requirement for approval of every trivial step. A firm can define where an agent’s authority ends—for example, preparing a proposed action for review before a consequential transaction. That example illustrates how the principle might be implemented; the precise boundary depends on the use case.[2]
The framework is useful as a connected record: who owns the system, why it was selected, which data and suppliers it depends on, how its performance is monitored and when a person must intervene. Those relationships make a problem traceable to an accountable decision instead of leaving governance as a separate document written at launch.[2]
Sources & further reading
- FSB finalises sound practices for the responsible adoption of artificial intelligence Financial Stability Board · 15 Oct 2026 · Accessed 27 Oct 2026
- Sound Practices for Responsible Adoption of Artificial Intelligence – final report Financial Stability Board · 15 Oct 2026 · Accessed 27 Oct 2026
- Artificial intelligence in UK financial services — 2026 Bank of England and Financial Conduct Authority · 26 Oct 2026 · Accessed 27 Oct 2026