CQ | 12 FSB Best Practices for Responsible AI Adoption in Financial Institutions: A Practical Guide to Risk Management

The adoption of artificial intelligence in the financial sector promises efficiency and innovation, but comes with complex risks, ranging from ethical to operational and compliance-related. The Financial Stability Board has synthesized 12 best practices that can turn these challenges into competitive advantages, if applied correctly.

Amid regulatory pressures and rising expectations for technological responsibility, financial institutions must move beyond ad-hoc approaches and adopt a robust framework for AI governance and risk management. This article details the 12 FSB best practices and provides concrete recommendations for their effective integration into organizational processes.

FSB Standards and the Need for Best Practices in Financial AI

The Financial Stability Board (FSB) published its final report in 2024 on Sound Practices for Responsible Adoption of Artificial Intelligence (AI), providing a reference framework for financial institutions seeking to adopt AI responsibly. Unlike other fragmented initiatives, the FSB’s recommendations are the result of an international consultative process and cover both technical aspects as well as governance and compliance.

Adopting AI without a solid framework of best practices exposes institutions to systemic risks, including:

• Ethical risk: biased automated decisions, lack of explainability, algorithmic discrimination;
• Operational risk: model errors, lack of data control, excessive reliance on automated systems;
• Security risk: vulnerabilities to adversarial attacks, exfiltration of sensitive data;
• Compliance risk: failure to meet audit, traceability, and regulatory requirements.

The 12 FSB Best Practices: Explanations and Applicability

The FSB groups best practices into four key areas: governance, risk management, transparency/explainability, and ongoing monitoring. Below, we present each practice, emphasizing its relevance for risk management:

1. Clear governance for AI: Defining responsibilities and decision-making structures for AI projects, including at the board and executive management levels.
2. AI strategy aligned with risk appetite: AI adoption should reflect the institution’s risk profile and be integrated into the overall risk management strategy.
3. Robust due diligence processes: Rigorous evaluation of vendors, data, and AI models prior to implementation, to prevent “black box” risks.
4. Data quality control: Implementing processes and tools for validating, cleaning, and continuously monitoring the data used to train AI models.
5. Documentation and traceability: Maintaining detailed documentation on the development, testing, and modifications of models to ensure auditability and traceability of automated decisions.
6. Explainability and interpretability: Developing and using methods that allow for the interpretation of AI decisions, especially in areas with significant impact on clients or financial stability.
7. Rigorous model testing and validation: Continuous testing of model performance and robustness, including under adverse scenarios or with unusual data.
8. Post-implementation monitoring: Ongoing supervision of AI model behavior in production to detect deviations or performance degradation.
9. Third-party risk management: Assessing and monitoring risks associated with AI technology vendors and critical dependencies.
10. AI incident response plans: Developing procedures for identifying, reporting, and remediating AI-related incidents, including ethical or security issues.
11. Regulatory compliance: Ensuring alignment with legal and regulatory requirements for AI, including GDPR, DORA, EBA Guidelines, etc.
12. Internal skills development: Investing in team training on AI risks and best practices to reduce reliance on external expertise and increase organizational resilience.

Applied Example: Integrating AI into the Credit Scoring Process

Implementing an AI model for credit scoring, for example, involves detailed documentation (5), bias and explainability testing (6), ongoing validation on new data (7, 8), as well as clear procedures for responding to errors or complaints (10). Without these elements, the risk of biased decisions or non-compliance with regulations increases exponentially.

Integrating Best Practices into Risk Management and Governance Processes

Adopting the 12 best practices should not be seen as a one-time compliance exercise, but as a transformation of how the institution manages technological risks. Concrete recommendations include:

• Updating risk management policies to include AI and ML-specific risks;
• Creating multidisciplinary committees for AI governance, involving IT, risk, legal, and business functions;
• Automating monitoring and alerting processes for critical AI models;
• Developing adversarial testing scenarios and operational continuity plans for AI incidents;
• Periodic internal audits focused on traceability, explainability, and adherence to ethical principles;
• Ongoing training programs for teams involved in AI development, implementation, and oversight.

Conclusion: Next Steps and the Importance of AI Governance

Financial institutions that treat AI as a mere technological tool miss both the opportunities and the systemic risks this technology brings. Integrating the 12 FSB best practices into governance and risk management processes is essential to ensure not only compliance, but also the resilience and scalability of AI adoption.

The next steps involve assessing the current maturity of AI governance, prioritizing the implementation of relevant best practices, and creating a continuous monitoring framework adapted to technological dynamics and regulatory requirements. Only in this way can AI become a sustainable competitive differentiator in the financial sector.

(This material was assisted by an AI tool and reviewed by our team before publishing).