Sound Practices for Responsible Adoption of Artificial Intelligence (AI): final report

What it contains

The final report, published on 15 October 2026, sets out 12 sound practices to help all types of financial institutions harness the benefits of artificial intelligence and manage its risks. It starts from the premise that adoption is growing in scale and sophistication and that AI can amplify existing risks and create new ones: less explainable models that reduce transparency, highly autonomous agentic systems that may act outside intended boundaries, and advanced models that increase the speed and scale of cyber attacks. It also recalls the risk of not adopting AI, such as lost competitiveness and a reduced ability to detect fraud and cyber threats.

The first four practices deal with organization-wide governance: the role of the board and senior management in aligning AI with the business model, risk appetite and strategy; a governance framework with defined roles; incorporation of AI risks into the risk management framework, with documentation of AI use; and continuous learning and adaptation. The next eight walk through the lifecycle of each use, from inception to retirement: materiality and risk, selection of technologies, data governance, explainability, performance, human oversight, cyber and ICT risk, and third-party dependencies.

Compared with the June consultation version, the report expands the description of benefits and risks, recognizes AI as a technology that augments human work and warns of the risk of staff deskilling. It details the documentation needed for auditability and traceability, clarifies the roles of the board and senior management, with considerations for smaller institutions, and gives more weight to transparency for higher-risk uses and to the risk of third parties that provide AI. It adds considerations for agentic AI and multi-agent systems, an area the FSB itself still regards as nascent. The practices are not an international standard and do not prescribe how to adopt AI, and applying them does not relieve institutions of their local legal and regulatory obligations.

Resumen elaborado por el Club de Gestión de Riesgos de la República Dominicana a partir de la lectura del documento original, con fuente verificada el 15 de octubre de 2026. No sustituye la lectura del texto oficial ni constituye asesoría.

See all publications