The Financial Stability Board published its final report on Sound Practices for Responsible Adoption of Artificial Intelligence on October 15. It sets out 12 practices for financial institutions. Four cover governance and eight cover the AI lifecycle, ending with cyber risk and third-party AI risk. The practices are not binding, but U.S. agencies sit on the FSB and help write its reports.
The third-party sections read like a vendor checklist. “Providers of cloud infrastructure, hardware, and AI foundation models are often highly concentrated and, in some cases, vertically integrated,” the report says. It also warns that “Third-party providers might also change the underlying models powering their AI systems without adequate notice.”
Reuters reported that the final version strengthens the June draft on agentic AI with risk-based triggers for when an agent must seek human approval. The report tells firms to recognise “that AI agents do not reason like humans and may interpret pre-defined goals in unexpected ways.”
- Add a model-change notice clause to AI vendor contracts. The FSB names silent model swaps as a risk in its own words.
- Use the 12 practices as a gap check on your AI policy before examiners bring their own framework.
This is for information only and is not legal advice. Verify the practices against the linked report before acting.