Regulation & Policy
The Financial Stability Board’s 12 practices put responsibility for AI with senior management—and extend scrutiny from initial design to suppliers and human oversight.
By Margaret Lund, US Business Correspondent · · 6 min read
The Financial Stability Board (FSB) is urging financial institutions to adopt 12 practices for governing artificial intelligence and managing its risks. According to Computer Weekly, the recommendations put boards and senior managers at the centre of oversight, with controls extending throughout an AI system’s lifecycle. They are presented as an adaptable toolkit, not a new legislative requirement.
The FSB, which monitors the global financial system and makes recommendations about it, has divided its practices into two groups. Four concern organisation-wide governance; eight address risks associated with developing and deploying AI. Together, they treat adoption as a management responsibility rather than a matter to be delegated entirely to technology teams.
The governance recommendations begin with boards and senior management aligning AI adoption with the institution’s business model, strategy and appetite for risk. They also call for clearly assigned responsibilities, integration of AI risks into existing risk-management arrangements, documentation of AI use, and continuous learning and adaptation.
That allocation of responsibility has a practical consequence. A proposal to automate work should not be judged solely on whether the software performs the task. Senior management must also consider whether the resulting exposure fits the business it intends to run. A technically successful deployment can still be a poor strategic choice.
The lifecycle practices cover assessment of an application’s significance and risks, technology selection, data governance, explainability, performance evaluation, human oversight, cyber and information-technology risks, and dependence on third-party AI providers. Risk assessment is expected both at inception and subsequently. Approval at launch is therefore a starting point, not a lifetime pass.
The FSB says institutions can tailor the practices to their circumstances and risk profiles, incorporating them into existing arrangements, including those for cyber security and third-party risk. This favours extending established controls rather than constructing an entirely separate AI bureaucracy. It does not remove the need to establish who is responsible when an application crosses several existing departments.
The FSB is chaired by Bank of England governor Andrew Bailey. It brings together national financial-stability authorities, international financial institutions, regulators, supervisors and committees of central-bank experts. Its stated purpose for the practices includes promoting coordination, cooperation and information-sharing as financial institutions adopt AI rapidly.
That international composition matters for institutions operating across borders. The recommendations offer a shared vocabulary for discussing AI risk, although the source does not establish a common legal obligation or enforcement mechanism. For UK and US businesses, a recommendation from an international body should not be mistaken for a newly enacted domestic rule.
The commercial backdrop is a widening range of banking applications. Computer Weekly reports that banks are using AI to reduce human intervention beyond the automation of laborious processes. Our earlier coverage of NatWest’s voice-AI test for customer spending queries illustrates how experimentation is reaching customer interactions, not merely internal paperwork.
Different applications bring different stakes. Preparing material for a meeting and acting in financial markets may both use AI, but their consequences are not interchangeable. The FSB’s emphasis on assessing each use case’s materiality makes the application—not simply the underlying technology—the relevant unit of scrutiny. Buying one model does not settle the risk assessment for everything built with it.
Third-party dependence adds another layer. The practices explicitly include risks arising from outside AI suppliers alongside internal data, performance and oversight controls. Outsourcing a capability therefore cannot, under the recommended approach, mean excluding it from the institution’s risk framework. Supplier selection becomes part of AI governance, rather than a procurement decision made after the interesting technical work is finished.
The FSB’s position is deliberately practical: institutions should adapt the toolkit to their own context and connect it to existing controls. Its inclusion of continuous learning, repeated assessment and future revisions also acknowledges that governance cannot be fixed once while the technology changes around it.
The industry ambitions described by Computer Weekly are considerably less modest. Michael Roberts, head of HSBC’s investment bank, says AI agents could replace people trading in financial markets within a few years. He links that prospect to advances in AI, quantum computing and distributed-ledger technology. This is an executive’s forecast, not evidence that autonomous traders have already displaced human ones.
Computer Weekly also reports that HSBC recently announced cuts to human wealth managers, with plans to replace them with AI. The distinction between an announced workforce plan and a successful operational substitution matters. The report supplies no performance results from those planned replacements against which to judge service quality or control effectiveness.
Bahadir Yilmaz, ING’s chief analytics officer, describes a more immediate supporting role in dealmaking. Teams of 10–20 people can work on a deal for many months, he says, and AI can already undertake preparation for early client meetings. His example concerns a component of investment-banking work, not the demonstrated automation of an entire transaction.
Neither executive’s remarks are presented as a direct response to the FSB’s recommendations. They instead reveal the breadth of the commercial agenda to which those recommendations would apply: assistance with preparation at one end, potential substitution for decision-makers at the other. Claimed capability, planned staffing changes and measured business value remain different categories of evidence—a distinction also central to our coverage of the AI value-measurement gap.
The FSB says it will monitor developments and update the practices when necessary. The report specifies no implementation deadline. The immediate development is therefore a recommended approach to governance, not a dated compliance exercise with a finish line.
For institutions adopting the practices, the combination of documented AI use and assigned responsibilities would make applications easier to locate within existing control structures. The consequential question is which management function owns the risk—not merely which department bought the software. That distinction becomes particularly important when a single supplier serves several business units.
Explainability is another area requiring judgement. The FSB recommends considering both the explainability of different types of AI and compensating controls. Its approach does not assume every system can be understood in the same way. Nor does it treat limited understanding as a reason to dispense with safeguards.
Performance evaluation and effective human oversight are listed separately. That separation is useful: evidence that a system performs well does not establish that people can supervise its use effectively. Likewise, a human approval step says little on its own about technical reliability. Our examination of the evidence gap in AI benchmarks addresses the related difficulty of turning model scores into purchasing confidence.
The remaining uncertainty is implementation. Computer Weekly’s account does not establish how consistently institutions already meet the practices, what closing any gaps would cost, or how supervisors will use them. Those omissions limit any claim about their immediate commercial effect. The recommendations describe what institutions should consider; they do not demonstrate that the necessary controls are already operating.
For UK and US business owners selling AI to financial institutions, these recommendations make the product only part of the commercial proposition. Buyers following the FSB’s approach would also need to assess data governance, performance, human oversight and supplier dependence. Those considerations can affect procurement scrutiny and the work required to support a deployment. For financial firms themselves, the stakes include management accountability: forecast labour savings do not answer questions about acceptable risk or effective supervision. The toolkit offers no guarantee of compliance or profit. It does identify responsibilities that an attractive demonstration, or an ambitious staffing plan, cannot discharge.
Original reporting by AI Business Reality Check. Primary source: Computer Weekly.
Regulation & Policy
Police uploaded personal information to a retail-crime platform without formal approval. The regulator’s findings expose the gap between useful software and lawful deployment.
By Siobhan Clarke · 17 Oct 2026 · 6 min read
Regulation & Policy
Britain’s competition regulator is examining AI choice, security bundles and cloud licensing. Its proposed designation is not a finding of wrongdoing—or an immediate remedy.
By Eleanor Whitcombe · 17 Oct 2026 · 6 min read
Regulation & Policy
The reported investigation targets security incidents, safeguards and marketing claims. Washington’s enthusiasm for AI does not necessarily protect its suppliers from existing consumer law.
By Margaret Lund · 16 Oct 2026 · 6 min read
Cyber Resilience
A survey of 500 US security leaders found strong demand for AI defences and ambitious spending plans. It did not establish whether those investments pay.
By Daniel Okafor · 15 Oct 2026 · 6 min read
