Skip to content
PrivacyBuilt

Regulatory Pulse

FSB finalises AI sound practices: governance, sensitive data and supplier dependencies

Final guidance gives financial institutions a proportionate framework for AI oversight, lifecycle controls and third-party risk.

International financial-sector guidance; applicable local obligations remain separate
AI governance, sensitive-data discovery, operational resilience and vendor risk
Guidance
Official source reviewed

PrivacyBuilt Editorial · Source published Final nonbinding guidance · Reviewed 16 October 2026 · 6 min read

LinkedInShare on X WhatsApp

The 60-second summary

The FSB published its final AI sound-practices report on 15 October 2026. Its 12 practices address organisation-wide governance and the AI lifecycle. They are non-prescriptive and do not constitute a binding international standard. The final materials give particular attention to documenting autonomous actions and understanding embedded AI and supplier dependencies. Use them to assess assurance gaps alongside applicable local law and supervisory expectations.

Timeline that matters

  1. 10 June 2026

  2. 22 July 2026

  3. 15 October 2026

  4. 23 October 2026

What changed

The consultation has progressed to a final report.The response overview explains added emphasis on agentic-AI traceability, embedded AI and supplier-chain dependencies.

Who should care

Boards and senior management of financial institutionsAI, privacy, security and model-risk teamsProcurement and third-party assurance ownersSuppliers supporting financial-sector AI services

Why this matters for global organisations.

AI assurance depends on knowing which information systems and suppliers can access, how decisions and actions are traced, and who can intervene. Join data discovery with tested oversight and practical continuity plans.

13 actions to start now

  1. Inventory AI use cases, including features embedded in purchased software.
  2. Assign accountable business and technical owners.
  3. Document materiality, autonomy and foreseeable harm for each use case.
  4. Map sensitive information entering prompts, retrieval stores, training and outputs.
  5. Assess data origin, permissions, suitability and intended reuse.
  6. Apply proportionate access and retention controls and verify them.
  7. Record supplier dependencies, subcontracting and change-notification arrangements.
  8. Request evidence that addresses the use case rather than relying only on generic assurances.
  9. Test how authorised staff can pause or constrain consequential actions.
  10. Retain a proportionate trace of material inputs, decisions, actions and overrides.
  11. Combine performance monitoring with privacy and security incident escalation.
  12. Exercise fallback and exit plans against realistic service limitations.
  13. Report residual gaps, approvals and review triggers to accountable management.

Evidence worth retaining

  • AI and embedded-feature inventory
  • Use-case risk and ownership records
  • Sensitive-data flows and provenance reviews
  • Access, retention and supplier-use restrictions
  • Validation and intervention-test results
  • Supplier dependency and change records
  • Incident exercises, exit tests and residual-risk approvals

Questions to take to counsel or your conformity team

These are discussion prompts, not legal advice or conclusions.

  • Which local rules and supervisory expectations independently apply?
  • Can material actions be reconstructed without collecting excessive logs?
  • What visibility is missing from supplier assurances?
  • Can people intervene in time and with real authority?
  • Which fallback or substitution assumptions remain untested?

Official sources

PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.

PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.

LinkedInShare on X WhatsApp