Key Takeaways #
- On 15 October 2026, the FSB published 12 final sound practices for responsible AI adoption by financial institutions, following a consultation that drew around 160 responses.
- The practices cover organisation-wide governance and controls across the AI lifecycle: materiality, model selection, data, explainability, performance, human oversight, cyber and third-party dependencies.
- The FSB calls them a toolkit to tailor to each institution’s context and risk profile. They are recommendations, not a new binding rulebook.
- For UK firms, the FCA’s 19 October examples of good and poor practice offer a timely domestic companion. The FCA says existing rules already apply to firms’ AI use.
- A useful production gate is whether the firm can name the accountable owner, show proportionate evidence, intervene when needed, and keep the service safe when a model or supplier changes or fails.
“We have a model card” is not the same as “we are ready to put this into production”. A financial institution needs to know why the use case fits its strategy, who owns the risk, whether the data and technology are suitable, how performance is checked, when a person must intervene, and what happens if the service or supplier fails.
The Financial Stability Board’s final report, published on 15 October, gives firms a common structure for asking those questions. Its 12 sound practices apply across the AI lifecycle, from choosing a use case to monitoring a deployed system. The report followed a consultation whose overview records around 160 responses.
For UK firms, the timing is useful. Four days later, on 19 October, the FCA published examples of good practice and areas for improvement in AI use, drawing on supervisory work and industry engagement. Read together, the FSB report supplies a broad governance map; the FCA examples show how familiar UK expectations around consumers, accountability and operational resilience meet real deployments.
What the 12 practices ask firms to establish #
The FSB groups its practices into two layers. The first sets the direction and accountability for AI across the institution. The second gives teams a lifecycle control framework. The practical interpretation below turns each practice into a production-readiness question; it does not replace the report’s full wording.
| FSB practice | Question to answer before and during production |
|---|---|
| 1. Strategic direction and oversight | Can leaders explain how the use case fits the firm’s business model, strategy and risk appetite? |
| 2. Governance and accountability | Are decision rights, owners, escalation routes and oversight forums clear across the lifecycle? |
| 3. Risk management and documentation | Are AI risks reflected in the firm’s risk framework, with a current record of use cases and their materiality? |
| 4. Organisational adaptability | Can governance, skills and controls change as the technology, use case or evidence changes? |
| 5. Materiality and risk assessment | Has the firm assessed impact and risk at approval, and set triggers for reassessment after material change? |
| 6. Selection process | Does the selected model or system meet the business, technical and operational need at an acceptable level of risk? |
| 7. Data governance | Is the data fit for purpose: accurate, complete, consistent, reliable and secure for training, testing and use? |
| 8. Explainability and transparency | Can the firm explain what matters to relevant users and stakeholders, or show compensating controls where the model is less explainable? |
| 9. Performance management | Are performance, failure modes and changes tested and monitored in proportion to the use case’s materiality and risk? |
| 10. Human oversight | Can trained people understand when to review, challenge, override or stop the system, with authority to do so? |
| 11. Cyber and ICT risk management | Do security scenarios and resilience exercises account for AI-specific threats and dependencies? |
| 12. Third-party AI risk management | Can the firm assess provider performance, transparency, data quality, supply-chain and concentration risks, continuity and exit? |
The first four are organisational capabilities. The next eight place practical controls around an individual use case. That distinction matters: a strong model review cannot compensate for unclear accountability, and a mature policy cannot show that a particular model is safe for a particular job.
Why this is a UK finance story #
The FSB coordinates international financial policy; it is not the UK’s conduct or prudential regulator. Its report encourages institutions to use the practices as they refine governance and risk controls. It does not create UK legal duties. Firms should continue to determine their obligations under the rules that apply to their activities.
The FCA’s new examples make that boundary concrete. The regulator says existing frameworks apply to AI use and points firms to areas including consumer outcomes, governance, senior-management accountability, operational resilience, outsourcing and critical third parties. Its examples are illustrative and non-exhaustive; they do not prescribe one model or create new requirements. That makes the FSB checklist most useful as a way to organise evidence against the firm’s real obligations.
It also gives senior teams a way to join up work that can otherwise sit in separate queues: model risk, data protection, cyber, outsourcing, consumer duty and change approval. A single inventory of AI use cases and providers can support all of these teams, provided it captures materiality, business owner, affected decisions, dependencies, controls and review dates.
Turn the practices into a production gate #
Firms do not need 12 new committees. Start with the highest-impact live use cases and put an evidence-based gate around them:
- Inventory and rank. Record deployed, pilot and staff-facing AI separately. Rank each use case by the decision it influences, people affected, autonomy, reach and ability to reverse an outcome.
- Name the accountable owner. Connect the product or process owner to risk, compliance, data, security and senior oversight. Make clear who can or constrain the system.
- Set the evidence bar. Before release, record the intended use, data suitability, model limitations, tested failure cases, performance thresholds, human escalation points and supplier dependencies. Scale the depth of evidence to materiality.
- Exercise failure and change. Test what happens when the model degrades, returns an unsafe output, is updated, or becomes unavailable. For third-party services, verify fallback and exit plans rather than accepting assurances on paper.
- Keep checking after launch. Monitor outcomes and incidents against thresholds, review changes, and reassess materiality when the model, data, users or process changes. Close the loop by feeding incidents and near misses back into governance.
This is especially relevant when AI influences a consumer outcome, performs a control, or takes actions across multiple systems. “Human in the loop” is only meaningful if the person has enough context, time and authority to intervene. A click-to-approve step does not create effective oversight if the reviewer cannot see the basis of the recommendation or stop an unsafe action.
What leaders should do this quarter #
Use the FSB report as a short diagnostic, not a paperwork programme. Select a few high-materiality use cases and ask the owners to demonstrate the controls using actual evidence: test results, monitoring records, escalation exercises, supplier documentation and change history. Gaps that recur across cases belong in the firm-wide framework; gaps specific to one deployment belong in its release and operating plan. Then compare that evidence with the FCA’s examples and the rules that govern the activity. Record which points are legal or regulatory obligations, which are supervisory guidance, and which are internal controls chosen to manage risk. This keeps the work proportionate and gives boards a clearer view of where production readiness is proven, assumed or still missing.
The FSB’s contribution is not a new compliance checklist to file away. It is a way to test whether the institution can govern AI as a live service, with clear ownership and controls that still work when models, suppliers and operating conditions change.
Sources #
- FSB, Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report , 15 October 2026.
- [FSB, final report announcement](https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/) , 15 October 2026.
- [FSB, overview of consultation responses](https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-overview-of-consultation-responses/) , 15 October 2026.
- FCA, AI in financial services: good practice and areas for improvement , published 19 October and updated 20 October 2026.
We follow UK AI policy and governance as it develops. Get new posts by email.
← All posts Editorial note, 22 October 2026: This article interprets the FSB’s 12 practices as a production-readiness aid. The FSB report is international, non-binding guidance; it does not determine a UK firm’s legal obligations.