AI governance in financial services needs evidence from the work

On 15 October 2026, the Financial Stability Board published its final report on responsible AI adoption, setting out 12 sound practices for financial institutions. The FSB coordinates national financial authorities and international standard-setting bodies. Its framework is non-binding: these are international sound practices, not new FCA rules or immediately enforceable UK obligations.

The first four practices concern organisation-wide governance; the remaining eight address the AI lifecycle. The announcement encourages institutions to refine existing arrangements, with controls tailored to their circumstances.

For compliance leaders, the consequential distinction is between adopting AI, assigning responsibility for it and establishing that it performs the intended work reliably. A firm can buy a capable model and document an elaborate governance framework while knowing remarkably little about the quality of the decisions its application supports.

The application has to earn its own confidence

Imagine a mortgage lender introducing an AI reviewer for financial promotions. The underlying model performs well on general evaluations and the application can retrieve FCA requirements. Neither fact establishes whether it can assess the lender’s communications correctly.

The reviewer needs to identify which requirements apply, interpret them in context and understand the actual product. It must recognise unsupported claims and misleading implications, including cases where individually accurate statements create an unbalanced overall impression. It also needs to recognise missing evidence and distinguish a clear problem from a question requiring specialist interpretation.

Those capabilities belong to the complete application: its instructions, source selection, product information, model and review workflow. Testing the model alone leaves the relationships between those components largely unexamined. An accurate answer about a mortgage rule is different from a dependable assessment of a rendered advertisement.

The FSB’s fifth, seventh and ninth practices connect risk assessment, suitable data and performance evaluation. Applied to this hypothetical lender, a proportionate evaluation could use representative promotions alongside difficult examples: an obsolete rate, a qualification separated from its claim or evidence supporting a different product. Teams could agree evaluation criteria before testing and reserve unseen cases for validation.

Existing UK obligations remain distinct. Where the Consumer Duty applies, the FCA’s consumer understanding rules address clear, fair and not misleading communications and appropriate testing and monitoring. A successful AI review does not itself demonstrate that customers understand the communication.

Match authority to consequences

An assistant preparing an internal marketing brief might need approved source material, confidentiality controls and ordinary editorial review. Calling the task internal does not automatically make it low risk: the brief might contain sensitive information or shape a consequential campaign. Its actual use matters.

A reviewer recommending corrections to a promotion carries a different responsibility. Evaluation should examine whether it identifies material problems without burying specialists in unnecessary warnings. Reviewers need enough supporting evidence to challenge its findings and a workable route for resolving uncertainty.

An agent authorised to approve or publish the communication changes the exposure again. An error can reach customers before anyone intervenes. Restricted permissions, tested stopping mechanisms and explicit escalation boundaries become more consequential, particularly where actions are difficult to reverse.

These are operating examples, not FSB-mandated categories. The tenth practice supports oversight calibrated to the activity. As explored in the human test for financial-services AI governance, a reviewer’s presence means little without the information and authority to intervene. Proportionality can mean fewer routine approvals alongside stronger controls at consequential decision points.

Explanation has to support challenge

A fluent account of why an advertisement is acceptable can be reassuring while remaining wrong. For a compliance reviewer, the useful question is whether a specialist can inspect the applicable requirement, supporting evidence and assumptions, then challenge the recommendation without rebuilding the investigation.

The eighth practice recognises differing explainability and the possible role of compensating controls. Limited explainability may justify narrower permitted uses, stronger testing or closer oversight. If the remaining risk is unacceptable, a different solution may be necessary.

That does not require every model to provide a complete account of its internal reasoning. Nor should a generated explanation be treated as a faithful record merely because it sounds coherent. Source references can be checked; assertions about the model’s own reasoning require separate scrutiny.

Documentation helps reconstruct what happened. It cannot establish, on its own, that the interpretation was sound or the control effective. A comprehensive log of an incorrect recommendation is evidence of the error, rather than evidence that the process succeeded.

Performance has to survive change

Before deployment, the lender needs an account of acceptable performance. Detection quality should include material issues missed as well as acceptable communications incorrectly flagged. The severity of a missed misleading claim matters more than an undifferentiated accuracy score. Teams should also assess interpretation, recognition of missing information and appropriate escalation.

Agreement with historical reviewers is an incomplete benchmark. Humans can disagree or approve something incorrectly. Evaluation therefore needs reasoned criteria, independent challenge where appropriate and a way to adjudicate disputed cases. Otherwise, the system may reproduce yesterday’s inconsistency more efficiently.

The report’s developmental-testing case study describes a bank postponing deployment after testing exposed inconsistent performance and training data that did not represent production conditions. Such cases are illustrative, not controlled evidence that a particular governance approach guarantees results. Their useful lesson is that testing needs the authority to change the deployment decision.

Once live, the reviewer’s findings should remain connected to current regulations, guidance and product information. A model update, revised policy or withdrawn claim can invalidate an earlier evaluation. Preserving the conditions of expert judgement helps distinguish reusable reasoning from an approval whose assumptions have expired.

Monitoring could track recurring errors, overrides and the quality of escalations, with targeted retesting after material changes. Overrides are signals for investigation, not automatic proof that the human was right. The organisation should know who investigates deterioration and when use must be restricted or paused.

Third-party evidence belongs in this assessment. The twelfth practice addresses dependencies, including those hidden inside wider services. For the lender, useful supplier evidence would cover relevant evaluation results and limitations, data handling, underlying dependencies and notice of material changes. Continuity planning should establish what happens when a provider degrades or fails. A general benchmark or certification can support due diligence without settling suitability for this workflow.

Governance should change the work

The consultation overview records around 160 responses, including concerns about implementation burdens and limited vendor transparency. These were stakeholder submissions, not a representative survey. The final report retained proportionality and expanded discussion of independent validation, human oversight and third-party dependencies. Its additional agentic-AI considerations remain emerging and were not fully consulted on.

For compliance teams, the practical opportunity is to make assurance part of ordinary review. A finding can arrive with its authoritative source, current product facts and missing evidence visible. A specialist can resolve ambiguity, preserve the reasoning and feed recurring problems into evaluation. The organisation can examine whether these controls actually improve decisions rather than count completed forms.

AI can create value within that arrangement before it can act autonomously. Reducing repetitive investigation can give experts more time for difficult interpretations. Greater autonomy should depend on evidence that the whole process remains dependable as conditions change. Good governance earns that confidence through decisions that withstand challenge, while allowing routine work to proceed efficiently.