The FSB Describes Effective Human Oversight of AI at Financial Institutions as Meaningful, Not Nominal

On October 15, 2026, the Financial Stability Board published "Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report." The board coordinates the work of national financial authorities and international standard-setting bodies at the international level. Its release says the final report reflects public feedback on a consultative version published in June 2026. The report sets out 12 sound practices for financial institutions. Parts of it follow, not the whole.

"The sound practices are non-prescriptive and do not constitute a binding international standard," the report says. They are not exhaustive, it says, and should be applied proportionately. Its case studies "are illustrative in nature and are not intended to prescribe a specific approach to AI adoption nor do they represent expected outcomes or benchmarks for any financial institution."

As adoption expands in scale and sophistication, the report says, AI "may also amplify existing risks and introduce new ones, with implications for financial stability." Among its examples, less explainable models "can undermine transparency," while "highly autonomous agentic AI systems may act unpredictably or outside intended boundaries, potentially resulting in unauthorised or erroneous actions, data security incidents and disruption to connected systems."

Twelve Practices in Two Groups

The first four practices concern governance across the whole institution: the role of the board and senior management in aligning the use of AI with the institution's business model, risk appetite and strategy; a governance framework with well-defined roles and responsibilities; bringing AI risks into the risk management framework, with effective documentation of AI use; and continuous learning and adaptation. The other eight cover the AI lifecycle, "from inception to retirement": assessing materiality and risk, selecting AI technologies, data governance, explainability and compensating controls, evaluating performance, human oversight, cyber and ICT risks, and risks from third-party AI dependencies.

The board and senior management of financial institutions, the report says, "are strongly encouraged to reference these sound practices" when developing and refining their governance, risk management and control frameworks for AI.

The Record of AI Use

Sound Practice 3 asks that financial institutions "adopt risk management frameworks that effectively address AI risks and include processes for documentation of AI use, as well as for materiality and risk assessment." Documentation, the report says, "describes the AI use case, including its purpose, design, governance arrangements, risk assessments, approvals and key lifecycle decisions." A footnote to that sentence adds that documentation "may not involve documenting every single AI use case to the extent described, especially those that are much less material." Lifecycle records, including logs and other records from development, deployment, operation, monitoring and incident management, capture key information across the use case's life. "Together, documentation and lifecycle records support accountability, verification, assurance and auditability."

What those records can include runs to a list. Among its items are the underlying models or systems and the rationale for their selection; whether the use case was developed in-house, uses open-source tools, or was acquired from a third-party AI provider; "key assumptions and limitations about the AI use"; the data sources used during inference and, if developed in-house, the data used for training; the owner of the use case and other key roles; and "findings from testing, ongoing monitoring and performance assessment."

Institutions, the report adds, protect these records "from unauthorised manipulation (modification or deletion) and, if possible, make them immutable or keep immutable copies especially if they contain critical information."

Meaningful, Not Nominal

Sound Practice 10 calls for "appropriate and effective human oversight relevant to the materiality, risk, autonomy, complexity and explainability of different AI use cases." Effective oversight, the report says, is "meaningful, i.e. it involves humans having sufficient ability, authority and incentive to intervene," as opposed to oversight that is nominal or driven by what it calls tick-the-box compliance.

Earlier, among the risks of adopting AI, the report lists misconceptions that can undermine human oversight. They include the assumptions "that AI models or systems nearly always produce correct output" and "that human involvement ensures effective oversight." Human oversight "may be weakened by over-reliance and/or automation bias," it says, and over time sustained reliance on AI "may also diminish staff expertise, judgement and challenge capability."

Its practice on oversight includes preventing automation bias "by creating incentive alignment for thorough, thoughtful review, such as by incorporating performance metrics that reward quality of oversight decisions." It includes tracking when humans override AI recommendations and analyzing the patterns, and "assessing whether human overseers are providing effective oversight." The common forms of oversight it lists "are not mutually exclusive." Among them are human approval of all decisions made by AI, which "might be appropriate in situations where accuracy is more important than speed of decision-making"; high-level human oversight aimed at AI with high levels of autonomy, such as agentic AI; and mechanisms enabling human intervention to halt or constrain AI operations.

Institutions, the report says, "allocate responsibility for monitoring an AI use case after deployment to staff who were not part of design and development to promote objectivity."