FSB's final AI guidance gives boards a role in four governance practices out of 12

The reading that boards now answer for AI risk at every stage of a model's life stretches the text. Four of the 12 practices cover company-wide governance ^[4], a third of the set (4 of 12 is 33%) ^[18], and that is where the board and senior management sit, with a role in "setting the overall approach and providing oversight so that AI adoption is aligned with the financial institution's business model, risk appetite and strategy" ^[5]. FinTech Global adds that the board is also meant to monitor that fit over time ^[8]. The eight lifecycle practices are subjects to be managed: materiality assessment at the outset and on a continuing basis, data governance, explainability, performance evaluation and human oversight among them ^[7].

Whether a supervisor will hold any firm to the 12 is the open part. FinTech Global describes the FSB as the international body behind global financial stability standards ^[15], and the FSB says it will track how AI technologies develop and revise the practices where necessary ^[16]. Neither report describes a penalty or an examination step.

We think the first supervisory use of the text will fall on the four governance practices, because they are the ones that say who answers. The counter-case is easy to state: the practices are broadly aligned with completed and ongoing work by the FSB and other standard-setting bodies ^[10], so a national authority could fold them into existing cyber and third-party reviews and the board would meet no new question. We would call our view wrong if, by the time the FSB revises the text, no supervisor has cited the 12 in a rule or an examination letter.

The agent language is where the text gets specific. The FSB said banks should understand that "AI agents do not reason like humans" and could interpret pre-defined goals in unexpected ways, PYMNTS reported ^[11]. The report also said that "highly autonomous agentic AI systems may act unpredictably or outside intended boundaries, potentially resulting in unauthorized or erroneous actions, data security incidents and disruption to connected systems" ^[12], and that "the actions and capabilities of agents can also change over time, especially if they gain access to new tools or receive new prompts" ^[17]. In our view that makes a one-time board approval a weak control for an agent, since the system approved may not be the one running later. The practice on continuing assessment is where a supervisor would look ^[7].