The FSB’s 12 AI practices need an owner-and-evidence matrix

The final report is a toolkit, not a compliance certificate

The Financial Stability Board published its final Sound Practices for Responsible Adoption of AI on 15 October after a June consultation. The 12 practices cover four organisation-wide areas—strategy, accountability, risk documentation and adaptability—and eight lifecycle areas from materiality assessment and selection to data, explainability, performance, human oversight, cyber risk and third parties.

The status is important. The report says the practices are non-prescriptive, do not create legal rights or obligations and are not a binding international standard. It urges boards and senior management to reference them and tailor them to the institution's context and risk profile. More robust treatment may suit critical functions and highly connected institutions; lower-risk uses or smaller institutions may justify a modified subset.

That proportionality is useful but creates an evidence problem. A firm can say it “follows the 12 practices” without showing which practice changed which decision. CMS's independent legal update accurately describes the report as a framework institutions are encouraged to consider; it does not turn the toolkit into Polish or EU law. The FSB's consultation record also matters because the final report reflects stakeholder feedback, but the case studies remain illustrative rather than expected outcomes or benchmarks.

The NIST AI Risk Management Framework provides separate method context. Its core calls for clearly defined roles, periodic review, documented accountability and measurement linked to deployment context. It is voluntary and cross-sector, not evidence that an FSB practice is implemented or that financial risk is reduced. The overlap supports using owners, review dates and traceable results as operating fields rather than treating the 12 headings as a scored checklist.

Convert the list into an operating matrix

Start with use cases, not the 12 headings. For each AI use, record business owner, affected process, materiality, autonomy, explainability limits, data classes, customer or employee impact, third-party dependencies and failure consequence. Then mark every practice as applicable, modified or not applicable, with a short rationale.

For each applicable cell, name one accountable owner and one inspectable evidence object. Strategic direction may point to a board-approved risk appetite and portfolio decision. Accountability may point to a RACI and escalation path. Materiality may point to the initial and periodic assessment. Selection may point to a documented comparison. Data governance may point to lineage and quality checks. Performance may point to task-specific evaluation and ongoing drift results. Human oversight may point to authority boundaries and sampled interventions. Third-party management may point to concentration, exit and continuity tests.

Add a status that describes evidence rather than aspiration: missing, designed, operating, sampled or independently challenged. Do not roll those states into one maturity score. A control can be well designed and still have no operating sample; another can be working while its owner and review date are unclear. Record exceptions beside the affected use case, with expiry and compensating control, so a local gap cannot disappear inside an enterprise average. This also gives internal audit a traceable population instead of a principles narrative.

Avoid one owner for the whole matrix. The board sets direction, but product, risk, data, security, procurement and operations own different controls. One evidence object may support several practices, yet every practice needs a route to a current artefact. Version the matrix when the model, data, tools, autonomy, jurisdiction or business consequence changes.

The counterargument is that mapping 12 practices to every use case will overload low-risk experiments. Apply the report's own proportionality. A summarisation pilot with public data may have a short matrix and several reasoned exclusions. An agent affecting payments or customer decisions needs deeper performance, oversight, cyber and third-party evidence. “Not applicable” is a decision that should expire when scope changes.

This extends the newsroom's earlier agent control-plane evidence into a financial-sector governance view. The immediate decision is to replace a generic principles attestation with a use-case matrix that joins practice, owner, artefact, review date and reopening trigger. The FSB gives institutions a common vocabulary; operating evidence determines whether that vocabulary changes behaviour in routine decisions and exceptions.