The Financial Stability Board's new "Sound Practices for Responsible AI Adoption" tells banks, insurers, and asset managers to govern AI inside existing risk programs — not a side project.
For two years, most financial institutions treated AI governance as an innovation-team concern: interesting, promising, and safely quarantined from the risk function. The Financial Stability Board (FSB) has now closed that door. Its newly published framework reframes AI adoption as a matter of financial stability — and puts AI risk squarely inside the enterprise risk, cyber, and third-party programs that regulators already know how to examine.
Because the FSB coordinates standards across the US, EU, UK, and Japan, this is not a single-jurisdiction rule you can wait out. It is a global baseline that supervisors in each of those markets will translate into their own expectations. If you run a regulated financial institution, the practical question is no longer whether to govern AI — it's whether your existing risk machinery can absorb it.
What the framework actually says
The FSB guidance is deliberately not a new standalone rulebook. Its core message is integration: AI risk must be identified, measured, and managed through the same enterprise processes that already govern credit, operational, and cyber risk. Building a parallel "AI governance" silo, in the FSB's view, is itself a governance failure.
Several themes stand out for compliance and risk leaders:
- AI is a source of systemic, not just operational, risk. Concentrated reliance on a small number of foundation-model providers, cloud platforms, and data vendors creates correlated exposure across the entire sector. If one provider fails or degrades, many institutions fail together.
- Third-party and concentration risk are front and center. Most institutions do not build their own models; they consume them. The FSB expects firms to understand — and monitor — the vendors, sub-processors, and model supply chains behind every AI capability they deploy.
- Existing risk taxonomies must be extended, not replaced. Model risk management, cyber resilience, operational resilience, and outsourcing frameworks already exist in regulated firms. The framework asks you to map AI into them explicitly rather than invent something new.
- Boards and senior management own it. Accountability cannot be delegated to a data-science team or a vendor. This mirrors recent guidance from other regulators making clear that firms cannot outsource legal responsibility for AI outputs.
Why "integrate, don't isolate" is harder than it sounds
The instruction to fold AI into existing risk programs is sensible — and quietly demanding. Most enterprise risk registers were not designed to describe a system that changes behavior with each model update, draws on third-party data of uncertain provenance, and can be embedded in dozens of workflows without a formal procurement event.
To integrate AI risk honestly, you first need to know what you have. And that is where most institutions stumble. You cannot map AI into your third-party risk program if you don't have a complete inventory of which AI systems are running, who supplies them, what data they touch, and which business processes depend on them.
This is the gap between aspiration and evidence. A supervisor asking "how are you managing AI concentration risk?" expects a defensible answer backed by records — not a workshop deck. The firms that will struggle are the ones whose AI footprint lives in scattered spreadsheets, expensed SaaS subscriptions, and pilot projects no one formally tracked.
A practical response for regulated firms
You don't need to wait for your national supervisor's implementing guidance to start. The FSB framework rewards firms that can demonstrate a running, evidence-producing program. Four moves get you most of the way:
- Build a complete AI systems inventory. Every model, vendor, embedded feature, and internal tool — including the ones procured outside formal channels. Capture the provider, the data it processes, and the business function it supports. This is the foundation for every other control.
- Track AI spend and concentration. Map how much of your AI capability depends on a handful of providers or a shared cloud platform. Concentration you can't see is concentration you can't manage, and it's exactly what the FSB flags as systemic.
- Extend existing risk programs rather than duplicate them. Add AI-specific criteria to your model risk, third-party, operational-resilience, and cyber assessments. Reuse the governance forums and escalation paths your supervisors already recognize.
- Measure maturity and prioritize the gaps. Assess where your AI governance stands across dimensions like inventory, risk management, third-party oversight, transparency, and accountability — then turn the weakest areas into funded, owned initiatives with deadlines.
The bigger signal
The FSB's move is part of a broader convergence. Prudential regulators, the EU AI Act, US enforcement agencies, and national safety institutes are all arriving at the same conclusion from different directions: AI is now a governed asset class of risk, and the burden of proof sits with the deployer.
For financial institutions, the FSB framework removes any remaining ambiguity about ownership. AI risk belongs to the risk function, reported to the board, evidenced on demand. The organizations that treat this as a control-plane problem — one continuous inventory, one maturity baseline, one prioritized backlog — will answer supervisory questions with records instead of reassurances.
The rest will discover that "we're still figuring out our AI strategy" is not an acceptable answer once the regulator considers AI a stability issue.