After 160 objections, FSB changed only one practice: third-party risk at the individual bank
The Financial Stability Board published its final "Sound Practices for Responsible Adoption of Artificial Intelligence" on 15 October 2026 — twelve non-binding practices for responsible use of AI in the financial industry. The report itself names the risks of many banks using the same models and a handful of vendors, but the consultation overview states that "no changes have been made to address broader systemic risks." Responsibility for concentration risk thus rests, in practice, with the individual institution — and with the banks signing AI vendor contracts right now.
What the framework actually requires
The twelve practices are divided into two parts, according to Forkast: the first four concern organization-wide AI governance, the remaining eight risk management across the AI lifecycle.
The centrepiece is Sound Practice 10, which requires robust human oversight. The FSB is explicit that the intensity of oversight must scale with the type of use — its materiality, the risk level, and the degree of autonomy. In practice, that means routine low-risk tasks can run more automatically, while high-risk scenarios should have risk-based triggers requiring human approval.
Forkast describes the report as "the first attempt by global regulators to create a unified framework" for agentic AI systems in finance. That is the publication's own hallmark — not an FSB formulation — and should be read as one outlet's characterization.
The global scope is real: according to Forkast, the work was coordinated across 24 jurisdictions, including the US Federal Reserve, SEC, CFTC, OCC and Treasury, and was delivered to the G20 Finance Ministers and Central Bank Governors by FSB Chair Andrew Bailey. These details rest, for now, on a single secondary source.
Why agentic AI worries the FSB
It is not general machine learning that triggered the report, but agentic systems — AI that does not merely answer questions but acts: executing tasks, calling tools, and moving money or data through systems without constant human intermediation.
The report warns, according to CTOL Digital Solutions, that highly autonomous systems "may act unpredictably or outside intended boundaries, potentially resulting in unauthorised or erroneous actions, data security incidents and disruption to connected systems."
One change in language from the draft says something about how contentious the field is. The June 2026 draft referred to AI agents as "synthetic employees." After industry pushback, the FSB dropped the term entirely, Forkast reports. The final report uses a more precise framing: AI agents do not reason like humans, and they interpret predefined goals in ways that can be deeply unexpected. The difference is not cosmetic — the "employee" language implied a responsible party, while the report's actual framing points to a system that can misinterpret the mission it was given.
The consultation: 160 responses and one concrete answer
The FSB received roughly 160 responses to the June draft. Several respondents asked, according to CTOL, for a discussion of macroprudential concerns — risks to the system as a whole, such as correlated behaviour from use of the same models, or concentration among vendors.
The report itself names precisely these risks: reliance on common AI models "can lead to correlated behaviours across financial institutions," while concentrated vendors "create systemic third party dependencies."
But the FSB's consultation overview states that "no changes have been made to address broader systemic risks," and that the final report "does not address them."
The final answer to the criticism was instead firm-specific. Sound Practice 12, on third-party risk, was changed — "especially by adding language on how individual financial institutions could manage risks from third party AI providers," as the overview puts it. The additions concern contract terms, continuity planning, exit strategies and review of subcontractors.
What it means in practice
For banks, the consequence is concrete: because no international mechanism captures the risk of an entire industry buying the same models from a few vendors, the tools available to a single institution are contractual. A bank signing with an AI vendor today must, under the framework, negotiate terms, plan for continuity if the vendor disappears, maintain an exit strategy, and review the subcontractor's subcontractors.
How far that reaches is an open question. An exit strategy from a dominant model vendor looks straightforward on paper — in practice it can collide with the alternative being worse, more expensive, or nonexistent. The framework contains no mechanism that creates alternatives; it assumes the individual bank can stand alone in negotiation.
It is worth noting that the overview, according to CTOL, says the agentic considerations were not fully consulted on, but distilled from the public consultation responses. A report meant to govern technology that "can act unpredictably or outside intended boundaries" is thus partly built on input that was not designed to cover exactly this.
The FSB itself says this is not an endpoint. According to Forkast, the board will update the practices as the technology evolves, with the recognition that the pace of development quickly renders any official rulebook outdated.
Caveats and open questions
This story rests on secondary sources. Neither the FSB's final report nor the consultation overview is in the documentary record this story is based on; all FSB quotations are reproduced through Forkast and CTOL. That means the wording of the quotations is credibly reported, but not independently verified against the original documents.
Three questions remain open. The first is whether the FSB will later move concentration risk into the framework — companies have already flagged it, and the board has promised updates. The second is whether national regulators — the SEC, central banks, the European supervisors — will impose stricter macroprudential requirements locally, something the framework's non-binding status leaves room for. The third is the most practical: whether banks actually gain enough bargaining power to use contracts as a risk tool against a concentrated vendor market. The framework points them there, but offers no support when they arrive.