Executive summary

The Financial Stability Board (FSB) identifies 12 sound practices designed to help financial institutions harness the benefits of artificial intelligence (AI) while managing associated risks. Rapid innovation in AI is currently transforming business models and improving efficiency, but it may also amplify existing risks or introduce new ones, such as less explainable models undermining transparency. Some advanced models may also materially increase the speed and scale of cyber-attacks. The practices are non-prescriptive and intended to be applied proportionately based on an institution’s size, complexity, and the materiality of its AI use cases. They are organised into two groups: organisation-wide governance and management of the AI lifecycle.

Introduction

Financial institutions have a long history of using AI tools, but recent advances in generative AI (GenAI) and agentic AI have generated significant interest. AI is being adopted across a wide range of activities, including credit risk assessment, trading, fraud prevention, and customer service. While AI improves efficiency and reduces costs, it also presents challenges such as reduced competitiveness for non-adopters and a diminished ability to detect certain threats. Responsible adoption enables institutions to understand these opportunities and risks while responding with appropriate strategies and guardrails to maintain financial stability.

An overview of the use of AI in the financial system

AI adoption is accelerating across banking, insurance, capital markets, and payments. In credit risk management, a large regional bank used machine learning (ML) to identify over 95% of non-performing SME loans at least three months before businesses faced repayment issues, allowing over 80% of at-risk borrowers to avoid default. Another commercial bank developed an ‘AI Approver Assistant’ that reduced credit proposal generation time from over a day to just 15 minutes, matching manual performance in identifying fraud signals. In the insurance sector, one large insurer eliminated approximately 400,000 manual processing instances in 2025 by automating underwriting quotes, reducing turnaround time from several days to 45 seconds. Coding assistants have also delivered productivity gains, with one firm writing six million lines of code in 2025 through an 80% developer adoption rate.

However, these benefits are accompanied by significant risks. Inadequate governance can lead to ‘shadow AI’, where employees use unauthorised tools. Ineffective data governance may perpetuate biases present in input data, while explainability challenges make it difficult to distinguish causality from correlation or detect model drift. Furthermore, agentic AI introduces risks of unauthorised or erroneous actions if goals are misaligned or if systems act outside intended boundaries.

Organisation-wide AI governance

Governance practices must ensure that the board and senior management take responsibility for aligning AI adoption with the institution’s business model and risk appetite. They are encouraged to maintain clear roles and responsibilities, often employing a three-lines-of-defence model where first-line functions assess business outcomes and second-line functions provide independent validation of AI performance. Financial institutions should maintain a centralised AI inventory to provide visibility over their AI footprint and the risks arising from it. Continuous learning is also prioritised, with institutions offering ‘master classes’ for board members and foundational AI training for all staff to foster a risk-aware culture and prevent automation bias.

AI lifecycle management

The report outlines a seven-stage AI lifecycle: inception, design and development, verification and validation, deployment, operation and monitoring, re-evaluation, and retirement. Systematic materiality and risk assessments are required at inception and thereafter, considering factors like the financial importance of the use case and its potential for customer harm. Data governance is essential to maintain data that is fit-for-purpose, with institutions expected to track ‘data lineage’ to facilitate auditability and remediation.

Explainability should be treated as a continuum; while limited explainability may be acceptable for some fraud detection cases, activities with high customer impact, such as credit decisioning, warrant greater transparency. Where explainability is constrained, institutions must deploy compensating controls like challenger models or stricter limits on permissible use. Human oversight remains a critical pillar, taking forms such as ‘human-in-the-loop’ for approvals or ‘human-in-command’ for autonomous systems. Cyber and ICT risk management must also adapt to address direct attacks like ‘poisoning’ or ‘jailbreaking’. Finally, institutions must manage third-party AI dependencies by conducting rigorous due diligence and securing contractual rights for monitoring and auditing to mitigate concentration risks and ensure business continuity.