FSB AI SOUND PRACTICES
Responsible AI adoption is an architecture of judgment, not a checklist.
The Financial Stability Board’s final report sets out 12 sound practices for the responsible adoption of AI by financial institutions.
Its significance goes beyond a list of AI risks. The report connects board direction, accountability, documentation, lifecycle management, human oversight, cyber controls, and third-party dependencies as parts of one operating structure.
This page is an independent interpretation of the FSB’s public report from Insynergy’s practical perspective. It does not represent an official view of the FSB.
FSB report:
PUBLIC REFERENCE
Four organisation-wide practices. Eight lifecycle practices.
The first four practices address organisation-wide AI governance. The following eight address the management of AI from inception to retirement.
The report is not a binding international standard. It is a practical toolkit to be applied proportionately to the institution’s size, complexity, interconnectedness, and the materiality and risk of each AI use case.
ORGANISATION-WIDE AI GOVERNANCE
- Strategic direction and oversight
- Governance and accountability
- AI risk management framework and effective documentation
- Organisational adaptability
AI LIFECYCLE MANAGEMENT
- Materiality and risk assessment
- Selection process
- Data governance
- Explainability and transparency
- Performance management
- Human oversight
- Cyber and ICT risk management
- Third-party AI risk management
FINAL REPORT
The final report moves AI governance closer to evidence-bearing operations.
Following the June 2026 consultation, the final report strengthens several areas:
- clearer roles for boards and senior management;
- documentation and lifecycle records that support auditability, traceability, and accountability;
- stronger transparency expectations for higher-risk and higher-materiality uses;
- broader treatment of third-party AI dependencies; and
- additional controls for agentic AI and multi-agent systems.
The direction is clear: AI governance must extend beyond principles into approvals, records, monitoring, intervention, and re-evaluation.
TWELVE PRACTICES
Translate each sound practice into an operational judgment question.
Operational questions are Insynergy’s interpretation. Practice names are shortened for readability. Scroll horizontally to read all columns.
| # | FSB sound practice | Operational question |
|---|---|---|
| 1 | Strategic direction and oversight | Who defines the intended outcomes, prohibited uses, and risk tolerance for AI adoption? |
| 2 | Governance and accountability | Who owns the outcome, who challenges it independently, and who can stop the use case? |
| 3 | AI risk management and documentation | What must be approved, recorded, and capable of later verification? |
| 4 | Organisational adaptability | How do incidents, near misses, drift, and external changes return into governance? |
| 5 | Materiality and risk assessment | How are materiality and risk distinguished, and when are they reassessed? |
| 6 | Selection process | Who can explain why this model, system, or delivery model was selected? |
| 7 | Data governance | Which data may be used, for what purpose, under whose authority, and for how long? |
| 8 | Explainability and transparency | What must be explained, to whom, and what compensating controls are required? |
| 9 | Performance management | What counts as acceptable performance, and how are degradation, drift, and deviation detected? |
| 10 | Human oversight | When must a human approve, override, pause, reject, or terminate an AI action? |
| 11 | Cyber and ICT risk management | What may the AI access, and how is access constrained, monitored, revoked, and recovered? |
| 12 | Third-party AI risk management | What accountability remains with the institution when the AI is externally provided? |
HUMAN OVERSIGHT
A human being present is not the same as human oversight working.
The FSB frames effective oversight as meaningful intervention rather than nominal review. Humans need the ability, authority, and incentive to act.
A functioning oversight design therefore requires more than placing a person at the end of a workflow. It requires:
- access to the information needed to assess the AI output and its limitations;
- defined conditions for approval, override, rejection, escalation, and shutdown;
- actual authority to intervene;
- incentives that counter automation bias and passive acceptance;
- records of human overrides and the reasons for them; and
- fallback operations when the AI is unavailable or unsafe.
From Insynergy’s perspective, human oversight is the design of the conditions under which judgment authority returns to a human or organisation.
DOCUMENTATION
Documentation is evidence architecture, not administrative residue.
The report calls for documentation of the AI use case, including its purpose, design, governance arrangements, risk assessments, approvals, and key lifecycle decisions. It also calls for records generated through development, deployment, operation, monitoring, and incident management.
For agentic AI, the evidence requirement becomes more granular:
- which agent acted;
- what triggered the action;
- which data, tools, APIs, or systems it accessed;
- which intermediate steps and decisions it took;
- whether it remained within its permissions;
- where it escalated to a human; and
- what the human approved, changed, or rejected.
The objective is not to accumulate logs. It is to preserve enough evidence to reconstruct authority, rationale, intervention, deviation, and outcome.
MATERIALITY AND RISK
A low-materiality task is not necessarily a low-risk task.
The FSB treats materiality and risk as related but distinct.
A task may be operationally minor yet create substantial harm if an autonomous agent has broad permissions, access to sensitive data, or the ability to interact with external systems.
At minimum, institutions need two separate assessments:
- Materiality: impact on critical operations, legal obligations, customers, and business continuity.
- Risk: autonomy, permissions, complexity, explainability, cyber exposure, third-party dependencies, and the feasibility of human oversight.
Both assessments must be revisited when permissions expand, use scales, models change, performance degrades, or incidents occur.
AGENTIC AI
Agentic AI shifts the unit of control from outputs to chains of action.
Traditional AI governance often focuses on whether an output is accurate or appropriate. Agentic AI can plan multiple steps, invoke tools, access systems, and act on the external environment. The control object therefore becomes the full chain of action.
The FSB report points to controls including:
- deterministic controls that prohibit actions in code;
- least agency, granting only the minimum permissions required;
- human approval triggers before high-value or irreversible actions;
- decomposition of goals into controlled steps with gating conditions;
- continuous runtime monitoring and records of anomalous behaviour;
- kill-switch mechanisms to pause, limit, override, or remove access;
- oversight of sub-agents and agent-to-agent interactions; and
- individual identity, registration, authentication, and permission management for agents.
Technical constraints do not determine accountability by themselves. Each agentic use case still requires a documented human or organisational owner for its actions and outcomes.
FROM PRACTICE TO IMPLEMENTATION
Convert the sound practices into operational artifacts.
The artifacts below are Insynergy’s implementation proposals, not documents prescribed by the FSB.
AI Use Case Inventory
Record purpose, scope, materiality, risk, ownership, third-party dependencies, and lifecycle status.
Materiality / Risk Assessment
Assess materiality and risk separately, then calibrate approvals, controls, monitoring, and assurance.
Accountability and Authority Map
Define who approves, who independently challenges, who operates, and who has authority to stop.
Decision Boundary Map
Show what may be delegated to AI, when authority returns to a human, and when escalation to higher authority is mandatory.
Human Oversight Matrix
Assign human-in-the-loop, human-on-the-loop, human-in-command, kill-switch, and contestability mechanisms by use case.
Decision Log / Lifecycle Records
Preserve AI outputs, evidence, human interventions, approvals, rejections, exceptions, changes, and incidents as traceable records.
Agent Identity and Permission Register
Maintain agent identifiers, purpose, accessible data and tools, prohibited actions, approval triggers, and permission changes.
Third-Party Responsibility and Exit Plan
Translate change notification, audit and information rights, data use, performance degradation, liability, continuity, switching, and termination into contracts and operations.
INSYNERGY READING
The centre of the FSB framework is not merely Human-in-the-Loop. It is Human Authority by Design.
This is Insynergy’s interpretation, not the FSB’s terminology.
The decisive question is not whether a human appears at the end of the process.
It is who holds judgment authority, under what conditions that authority is delegated to AI, when it returns to a human or higher organisational level, what evidence is preserved, and who can later account for the decision.
The 12 sound practices can be read as a reference architecture for designing those conditions across strategy, lifecycle governance, execution controls, and third-party dependencies.
SOURCE
Source report
Financial Stability Board, Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report, 15 October 2026.