The FSB 12 AI Practices for Indian Banks and NBFCs

The FSB AI practices turn broad principles into a plan for banks and other lenders. The Financial Stability Board sets out twelve practices for AI use. They help firms manage risks as AI moves from tests into decisions that affect customers, markets, and balance sheets. These practices do not create a new rulebook.

For Indian banks and non-banking financial companies (NBFCs), the timing matters. The Reserve Bank of India's FREE-AI framework puts trust, fairness, and sound controls at the center of AI use. The FSB adds a practical lens. Boards need to know where firms use AI, who owns each system, and how staff control it. Buying a tool from a vendor does not remove that duty.

The FSB practices combine firm-wide governance with controls across the AI lifecycle.

How FSB AI practices connect principles and action

The twelve practices work together. Four cover governance across the firm. Eight cover risks throughout the AI lifecycle, from the first review of a use case to checks after launch.

This matters because many firms still run AI as a set of pilots. A business team buys a tool, data scientists train a model, or a vendor adds a new AI feature. Each project may pass a local review. Yet the firm may lack a full view of its risk. The FSB approach starts with that full view, then matches controls to each use case.

FSB AI practices: the governance layer

1. Board and senior management oversight

Boards should know how AI serves the firm's strategy and where high-impact systems operate. They also need to know which risks could harm customers or the firm. However, an annual policy sign-off is not enough. Reports should show key systems, incidents, falling performance, exceptions, and gaps in controls.

Indian boards need enough AI knowledge to challenge management. For example, they should ask about customer outcomes, resilience, supplier concentration, and the costs and gains of adoption. AI belongs in the same discussion as credit, market, and conduct risk.

2. Clear roles and responsibilities

Each key AI system needs a business owner, control teams, and a clear path for raising concerns. Define who approves it, who tests it, and who tracks its results. Staff must also know who can stop it and who answers a customer or regulator.

Ownership can blur when the model, data, and workflow come from different vendors. Therefore, map duties across the business, technology, risk, compliance, legal, security, and audit teams. Cover all three lines of defense without leaving gaps.

3. AI within enterprise risk management and documentation

AI risk belongs in the firm's existing risk framework. Include it in risk appetite, controls, incident handling, and audit plans. This helps leaders see how AI changes risks they already manage.

For example, a lending model may affect credit, conduct, model, and reputation risk at once. A service agent may create privacy or mis-selling risks. Keep records of each system's purpose, data, limits, tests, approvals, changes, and incidents. Such records let an independent team check why the firm trusted the system.

4. Continuous learning and adaptation

As AI changes, firms need to update staff skills and controls. Review incidents, share lessons, and adapt the framework when new risks emerge. Good records help preserve that learning when staff or vendors change.

Documentation also helps teams respond to incidents and reuse controls that work. However, records alone are not enough. Teams must use what they learn to improve how they build, approve, and run AI.

FSB AI practices across the lifecycle

5. Materiality assessment

Not every AI feature needs the same scrutiny. First, assess the harm an error could cause. Consider the customers affected, the system's freedom to act, data sensitivity, legal effects, and the scope for human intervention.

Therefore, review the use case before launch and again when its model, data, purpose, or scale changes. For example, a low-risk drafting tool may become high risk if its output starts driving regulatory filings.

6. Technology selection

Choose technology to fit the task and its risks. The newest or largest model may not be the best choice. Check accuracy, speed, cost, security, robustness, and how well staff can explain and control its output. Also assess where data sits and how the firm could switch providers.

A simpler model may suit a high-stakes decision because it is easier to test and monitor. Where a more complex model adds value, record why that gain justifies the added risk. Our guide to building, buying, or partnering for financial AI explores these choices.

7. Data governance

The FSB AI practices call for sound data governance. Firms should know where data came from, how they may use it, and whether it fits the task. Check its quality, coverage, and path through the system. At the same time, protect personal and confidential data, respect rights, and set retention rules.

For Indian lenders, language and regional differences matter. An average score can hide poor results for a language, region, job type, or customer group. Therefore, test outcomes for groups as well as the whole dataset.

8. Explanations and compensating controls

An explanation should fit its audience and the effect of the decision. Developers, auditors, managers, and customers need different detail. The goal is to let people review and challenge an outcome.

When a model cannot explain enough, use other safeguards. For instance, narrow its role, test it more closely, check its answers against other evidence, or require stronger human review. Some uses may need a ban on fully automated action.

9. Performance evaluation

Testing before launch is only the start. After launch, track accuracy, stability, bias, overrides, complaints, and business outcomes. Therefore, set clear points that trigger review, repair, restricted use, or a stop.

Checks must also reflect the real workflow. A model can look accurate while staff trust it too much or customers learn to game it. As a result, teams need both technical measures and evidence of customer outcomes.

10. Human oversight

Human review helps only when staff have the time, skills, information, and power to challenge AI. A routine approval click can give false comfort if the reviewer cannot judge the answer.

Define when people must step in, raise a concern, record an override, or stop a system. As AI gains freedom to act, humans must oversee its goals, access, limits, and overall behavior. That requires more than checking one answer at a time.

11. Cybersecurity and technology risk

When applying the FSB AI practices, firms must address new routes for attack through prompts, data, model interfaces, plugins, and automated actions. Address data leaks, prompt injection, model tampering, unsafe links between systems, access controls, logs, and recovery.

Test AI as part of the firm's resilience work as well as model review. In particular, plan for a provider outage, an unexpected model change, or a need to stop automation. Critical customer services need a workable fallback.

12. Third-party dependencies

Using a vendor does not transfer accountability. Review providers, secure needed information and audit rights, and track service and model changes. Also, understand subcontractors, shared dependencies, and exit options.

Because many firms rely on a small set of cloud and model providers, one failure can affect several services at once. A policy change or price rise can have similar effects. Procurement must therefore assess shared risks as well as the product itself.

Applying FSB AI practices to agentic systems

AI agents can plan and act, rather than only suggest. An agent may call tools, start payments, change records, or contact customers. The risk then moves from one wrong answer to a wrong chain of actions.

Banks and NBFCs should treat permissions as a core control. Give each agent a verified identity, a clear purpose, and only the access it needs. Set time and transaction limits, protect logs, monitor activity, and provide a reliable kill switch. The firm should know who authorized each agent and what it may do.

FSB AI practices: a practical 90-day plan

Firms do not need to wait for a new rule to start. Use this sequence to turn the FSB AI practices into operating routines.

How FSB AI practices can speed up adoption

The practices should not slow every AI project. Often, uncertainty causes delay because teams do not know which approvals they need. Risk teams lack a common standard, while boards cannot see the full portfolio.

A framework matched to risk can remove that uncertainty. For example, low-risk uses can follow a lighter path. Experts can then focus on systems that could cause serious harm.

For Indian banks and NBFCs, access to the same models as their peers will not be enough. Their advantage will come from their own data, sound workflows, and strong governance. Firms that can show where AI operates, why they trust it, and how to stop it will have a firmer basis to scale.

Source

Financial Stability Board, FSB finalises sound practices for the responsible adoption of artificial intelligence, October 15, 2026.