FSB AI Sound Practices: Bank Boards Now Own AI Risk

On AI risk in finance, the Financial Stability Board has chosen to address the boardroom before the system as a whole.

In October 2026 the FSB delivered its final report to the G20, setting out 12 sound practices for the responsible adoption of AI^[1]. The practices are voluntary. The report asks boards and senior management to treat them as a reference for strategy, technology choices and risk management.

The report responds to fast progress in generative AI and agentic AI, meaning systems that carry out multi-step tasks on their own. The practices fall into two groups. The first deals with enterprise-wide governance. The second deals with risk management across the whole life of a model.

The ABA Banking Journal^[2] reported on the final version, which was completed after a public consultation and a workshop.

My reading is clear. For now, the response to AI risk takes the form of internal governance at each bank. This is the phase that comes before rules, and the history of Basel shows the pattern in detail.

Basel, 1974: principles first, capital later

On 26 June 1974, German authorities closed Bankhaus Herstatt in the middle of the trading day. Its dollar counterparties were left exposed. By the end of that year, the G10 central bank governors had set up the Committee on Banking Supervision in Basel.

The committee's first output was the 1975 Concordat. It was a voluntary text with no legal force. It divided responsibility for supervising foreign branches between home and host countries.

Capital rules came thirteen years later.

In July 1988 the Basel Accord set a minimum ratio of 8% between capital and risk-weighted assets. Banks had to comply by the end of 1992. Individual countries then wrote the standard into national law.

The second case is closer to today's topic. In January 2013 the Basel Committee published the BCBS 239 principles on risk data aggregation, aimed at the boards and senior management of global systemically important banks.

Banks were expected to comply by 2016. In May 2024 the ECB published a guide that turns those principles into specific supervisory expectations.

Both cases follow the same pattern. First comes a text aimed at the people who run the bank. Then comes a rule that supervisors enforce.

Where we are in the cycle

The FSB's 12 practices sit in the first stage of this pattern.

The verbs in the text make this plain. The board "aligns". The firm "defines", "documents" and "assesses". This is the language of governance, the same language used in 1975 and 2013.

• Practice 1: the board ties AI adoption to the business model, risk appetite and strategy.
• Practice 3: the firm documents every use of AI within its risk management framework.
• Practice 5: each use case is assessed for materiality and risk at the outset and on an ongoing basis.
• Practice 8: some types of AI are less explainable than others, and the firm adds compensating controls where needed.

The pattern is structural and has held for decades. Every new source of banking risk, from foreign exchange in the 1970s to data after 2008, has gone through the same sequence.

Why it starts with the board

Regulators write system-wide rules once they can measure the risk. For AI, that measurement does not exist yet.

Authorities know little about how many models banks use, who they buy them from and which tasks they run. That is why the first step asks banks to count and document their AI use. The resulting inventory becomes the data on which a supervisor can later build a requirement.

The second reason is time. Agreeing requirements across G20 jurisdictions takes years. A voluntary text sets a common vocabulary straight away.

This is where I see the document's weakness.

The practices look inside each individual bank. The risk that concerns me lies in the shared links, because many banks use the same few models and the same cloud providers. Practice 6, on model selection, talks only about the objectives and technical needs of the individual firm.

Good governance at every bank still leaves this shared dependency in place. Systemic risk starts there.

Three implications for capital allocators

1. Within 24 months, AI governance will become part of supervisory inspections. Banks that already keep a model inventory will spend less when supervisors ask for evidence. Investors in listed banks can ask management whether that inventory exists and who signs it off.
2. Within 36 months, vendor dependency will become the focus of the second phase. Current risk models give little weight to dependence on a small number of AI providers. It makes sense to model a scenario in which a major provider goes down for several days across many banks at once.
3. Starting now, the investor story needs revisiting. A company that presents AI purely as a cost-cutting tool will have to revise its numbers once compliance costs arrive. It is better to budget now for spending on governance, data and controls.

A code of conduct that paves the way for regulation

My position is this. The 12 practices open the phase that leads to requirements. Anyone who treats them as the end point misreads the history of supervision.

I would change my view if any of the following happened.

• The FSB or the Basel Committee declares its AI work finished for the next few years.
• The ECB and the PRA (the Bank of England's Prudential Regulation Authority) cite the practices as a sufficient standard, with no binding follow-up.
• The data banks collect shows low, fragmented dependence on model providers.

Three signals to watch

• The FSB's next work programme for the G20: I am looking for a chapter on third-party dependency for AI.
• Supervisory guidance from the ECB and the PRA: I am counting how many documents reference the 12 practices.
• Annual reports of the large banks: I am checking whether they include a board-approved inventory of AI use cases.

The inventory comes before the rule. Banks that keep one today will decide how much the rule costs them tomorrow.