FSB issues 12 AI governance practices: humans must retain control

The FSB's 12 practices for responsible AI in finance emphasize human oversight, data governance, cybersecurity and third-party dependencies.

Main report

On October 15, 2026, the Financial Stability Board published its final report containing 12 practices for responsible AI adoption by financial institutions. The report followed a public consultation launched in June and around 160 responses. Reuters highlighted a central requirement: as AI agents gain the ability to plan and act, firms need effective human oversight.

Twelve practices across the AI lifecycle

The framework covers organization-wide governance and controls from development through deployment and operation. It addresses use-case materiality and risk assessment, technology selection, data governance, explainability, performance evaluation, human oversight, cyber and ICT risk, and dependence on third-party AI providers.

These are risk-based sound practices rather than a claim that every institution must use an identical control model. Implementation should reflect the use case and the institution's circumstances.

Analysis

Human oversight of AI agents must be operational

A human being nominally in the loop is not enough if that person cannot understand or stop the system's actions. Practical controls define what data an agent may read, which tools it may call, transaction limits, mandatory approval points and a safe shutdown process.

Four useful control layers

• Least privilege: grant only the data and actions required for the task.
• Approval gates: financial, legal or customer-impacting actions wait for an authorized person.
• Complete logs: retain inputs, intermediate decisions, tool calls and outcomes.
• Stop and recovery controls: disable the agent, reverse actions where possible and switch to a manual process.

The same principles matter outside finance when agents connect to email, CRM, payments or customer data.

What to watch

Where businesses should begin

Create an inventory of AI use cases, classify them by the impact of failure and assign an accountable owner. Test agents in constrained environments with non-sensitive data and explicit stop thresholds. Evaluate not only accuracy but intervention rates, unauthorized actions, traceability and recovery time.

This is a satellite article in TBN Grow's enterprise AI-agent cluster. Read the pillar article on Gemini Agent and cross-application work before designing the governance layer.

Verified sources: the FSB final report announcement, the FSB consultation response overview and Reuters, all dated October 15, 2026.