FSB sound practices for responsible AI adoption: a voluntary menu for the global financial sector

On 10 June 2026 the Financial Stability Board (FSB) — the G20 body that coordinates financial regulation across jurisdictions — published a consultation report titled Sound Practices for Responsible Adoption of Artificial Intelligence (AI). It proposes 12 sound practices that financial institutions can apply to their AI governance and to the way they manage AI across its lifecycle. The consultation is open until 22 July 2026.

This is not law and it is not a standard. The FSB is explicit that the report is "not intended to establish an international standard" and does not impose a prescriptive approach; it is a menu from which institutions of all types — banks and nonbanks alike — can draw, proportionate to how, and at what scale, they use AI. That framing matters: the FSB has no binding rule-making power, and its instruments work by becoming the common reference that national supervisors and firms converge on.

Why a financial-stability body is writing about AI

The report is the deployment-facing companion to the FSB's earlier work. In October 2025 the FSB published Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector, which set out direct and proxy indicators authorities can use to track AI uptake and the vulnerabilities it creates — third-party concentration, model correlation, data-quality dependence, and operational fragility. The 2026 sound practices turn that supervisory lens around and ask what individual institutions should be doing. The animating concern is systemic: when many firms lean on the same small set of model providers and cloud platforms, an individual governance failure can become a sector-wide one.

The 12 practices, in three layers

The press release groups the practices into three areas:

• Organisation-wide governance (practices 1-4). The board and senior

management set the overall approach and provide oversight, so that AI adoption is aligned with the institution's business model, risk appetite and strategy — before, not after, a use case is built or bought.

• Managing AI risk across development and deployment (practices 5-10).

Performance assessment, testing and ongoing monitoring proportionate to a use case's materiality and risk; and human oversight calibrated to the materiality, risk, autonomy, complexity and explainability of each use case — language that quietly concedes that uniform "human in the loop" rhetoric does not survive contact with high-volume automated systems.

• Cyber, ICT and third-party risk (practices 11-12). Building AI cyber and

ICT risk scenarios into tests and exercises, sharing information with key stakeholders, and — where appropriate — using AI tools in cyber and ICT risk management itself.

What it deliberately leaves out

Two boundaries are worth noting, because both push back on secondary coverage that has over-read the report. First, the FSB states the practices were not developed to address the risks of frontier AI models, even if some may help. Second, the consultation does not assume it has solved emerging AI: one of its questions asks respondents whether the practices adequately cover newer and more complex forms of AI, such as generative AI and agentic AI. The report opens the question rather than answering it.

Where it sits for European institutions

For a bank or insurer in the EU, the FSB practices arrive on top of a binding stack rather than instead of it. DORA already governs ICT and third-party risk for the same institutions, and the AI Act designates AI for creditworthiness assessment and for life- and health-insurance pricing as high-risk. The FSB's practices 11-12 map almost one-to-one onto DORA's ICT-third-party regime, and its governance layer rhymes with the AI Act's quality-management and human-oversight duties. The value of the FSB text is not a new obligation but a shared vocabulary in which a globally active institution can describe one AI governance system to supervisors in many jurisdictions at once.

It also slots into the soft-law layer alongside two instruments already in this knowledge base: the United States' NIST-derived approach (see the NIST AI Risk Management Framework, the basis for the US Treasury's financial-services adaptation) and the G7's Hiroshima AI Process Reporting Framework. Read together, they show a financial sector being governed twice over — once by binding regional law, and once by a thickening web of voluntary international practice that increasingly speaks the same language. The FSB consultation is the moment that web reaches the prudential core of the system. The broader picture of international AI governance explains why bodies without rule-making power keep setting the terms anyway.