TL;DR
The Financial Stability Board has released the final version of its report on responsible AI adoption, dated 15 October, setting out 12 sound practices for banks, insurers and other financial institutions and urging boards to use them when building their AI governance and controls. Bank of England governor Andrew Bailey chairs the FSB, and this week he told an IMF panel that the AI debate comes down to “trust in technology” and human control. For UK firms, the practices land as the Bank and the ECB press lenders on AI risk.
The report follows a consultation launched in June 2026, and the FSB has published an overview of the responses alongside it. It describes the practices as a toolkit that institutions can scale to their own size and risk profile, and fold into the frameworks they already run for third-party and cyber risk, rather than a new rulebook.
The 12 practices
The first group is about running AI as an organisation-wide matter. It asks boards and senior management to keep AI adoption in line with strategy, risk appetite and the business model; to maintain a governance framework with clear roles; to bring AI risks inside the existing risk management framework and document where AI is used; and to keep learning as the technology changes.
The second group covers the lifecycle of each use case. Institutions should assess materiality and risk at inception and keep reassessing; choose technologies suited to the task; govern the data; address explainability, with compensating controls where a model cannot explain itself; evaluate performance; keep human oversight effective; manage AI-related cyber and ICT risk; and handle dependence on third-party AI providers.
The report carries case studies of proportionate application. The FSB says it will monitor developments and revise the practices as AI use evolves, and wants it to encourage information-sharing between firms and supervisors across borders.
The UK line
The FSB brings together financial authorities from 24 jurisdictions, and its chair is the Bank of England governor. Speaking in Bangkok this week during the IMF and World Bank annual meetings, Bailey said the heart of the AI question was trust in technology and “human control to achieve that trust”, and argued that the tools criminals use can equally “arm the defence”. On Tuesday the IMF counted a major cyber-attack among the factors lifting its assessment of global financial-stability risk to “elevated”.
Earlier this week we reported that the Bank of England and ECB were pressing lenders on how AI figures in their risk and recovery planning.
Looking forward
In our view the practices are most useful to UK firms as a checklist against which a supervisor could ask questions, because the governor who chairs the FSB also runs the UK’s central bank. Practices on third-party dependence and human oversight of agentic systems map directly onto the concentration and control concerns UK regulators have been voicing, and a board that cannot show its AI inventory and materiality assessments against this list should expect questions.