FSB Finalizes 12 AI Practices for Financial Institutions

The Financial Stability Board has finalized 12 sound practices for responsible AI adoption by financial institutions, giving credit unions a concrete crosswalk for testing whether strategy, data, human review, cyber resilience and vendor controls work as one system. The document is not a new NCUA rule. Its immediate value is as a board and risk-management benchmark that can expose gaps between a high-level AI policy and evidence from individual use cases.

The FSB said on October 15 that its final report reflects roughly 160 responses to a June consultation. It encourages boards and senior management to align AI adoption with the institution's business model, risk appetite and strategy, then carry that direction through materiality assessment, technology selection, data governance, explainability, performance management and human oversight.

The final two practices address cyber and information-technology risk and third-party AI dependencies. The FSB says institutions should incorporate relevant AI scenarios into tests and exercises and manage vendor risks including performance, transparency, data quality, supply-chain concentration and continuity.

Treat the 12 practices as four connected workstreams

For a credit union, the list is easier to operate as four linked workstreams. The first is direction: the board and senior management set boundaries, accountability and the relationship between AI use and risk appetite. The second is intake: each use case receives a documented materiality assessment, an accountable owner and a rationale for the selected model or system.

The third is evidence: data must be fit for purpose; transparency must match the audience; performance must be tested and monitored; and human oversight must be effective for the use case's autonomy, complexity and consequence. The fourth is resilience: cyber scenarios, recovery, vendor dependencies and continuity controls must be tested rather than assumed.

That structure helps prevent a common governance failure in which risk teams maintain a central inventory while business teams run separate vendor pilots, performance dashboards and exception processes. The FSB's emphasis is organization-wide: those records must connect.

A final practice is not a final control design

The FSB describes the practices as a toolkit that institutions can tailor to their context and risk profile. That proportionality matters. A low-risk internal summarization tool does not need the same decision authority or monitoring as an agent that changes member communications, pricing or account access. But proportionality still requires a documented reason for the lighter or stronger control set.

Credit unions should also distinguish the final framework from a binding supervisory mandate. The FSB coordinates financial authorities internationally, but the report does not itself amend U.S. credit-union regulation. Existing U.S. obligations and NCUA expectations continue to control. The framework is most useful when mapped to those obligations, internal policies and actual system evidence.

The timing reinforces the resilience point. On October 16, Reuters reported that G7 finance leaders approved tabletop exercises for AI-enabled cyberattacks. The FSB practice on cyber scenarios turns that international concern into an institution-level question: can the credit union detect, contain, recover and communicate when an AI-assisted attack affects a core service or critical provider?

Start with one end-to-end evidence test

A practical first step is to choose one material AI use case and trace it across all 12 practices. The evidence set should identify the business objective, owner, approved authority, risk tier, training and operating data, performance thresholds, human checkpoints, exceptions, cyber scenario, vendor dependencies and recovery path. Missing evidence should become a dated remediation item rather than a narrative assurance.

The test should end with a decision: continue under current controls, restrict the use case, redesign a control or stop it. Our coverage of agentic-AI shutdown controls shows why authority and recovery need proof before autonomous behavior expands. The AI inventory and change-control playbook provides a record structure for connecting versions, tests, approvals and retirement.

The strongest use of the FSB framework is not to add 12 statements to an AI policy. It is to make the institution demonstrate that one use case can be reconstructed from strategy through operation, monitoring and recovery.