When an AI system can recommend, decide, or act, “a human is in the loop” is too vague to be a control. Which action needs review? Who can stop it? What evidence survives afterward?
That is the useful operator question in the Financial Stability Board’s final Sound Practices for Responsible Adoption of Artificial Intelligence, published October 15, 2026. It addresses financial institutions, not every business using AI. It offers 12 sound practices for responsible adoption; it does not itself create a new law or a universal banking mandate.
What the FSB actually says
The report asks boards and senior management to align AI use with business strategy and risk appetite, define accountable roles, document AI use, assess each use case at inception and over time, and manage data, testing, cyber, and third-party risks. Its tenth practice calls for human oversight proportionate to an AI system’s materiality, risk, autonomy, complexity, and explainability.
That wording matters. A chatbot summarizing a public report and an agent initiating a financial transaction should not share the same approval path. The former may need source checking; the latter may need a named approver, transaction limits, logging, and a reliable stop mechanism. Those examples are my operational interpretation, not a list of technical requirements imposed by the FSB.
A practical oversight test
- Define the action boundary. List what the system may read, draft, recommend, change, or send. “Use AI responsibly” is not a permission model.
- Set escalation triggers. Review should rise with financial impact, reversibility, sensitive data, external recipients, and the system’s autonomy. Some actions should remain blocked until a person approves the exact proposed change.
- Keep a usable record. Capture the request, source material, decision, approval, and outcome so a reviewer can reconstruct what happened. Logging alone is not oversight if no one can interpret it.
- Reassess after deployment. A use case can change as the model, tools, data, or vendor changes. Revisit the approval boundary rather than treating the launch review as permanent.
The FSB’s guidance also emphasizes performance monitoring and third-party dependencies. That is a reminder that a “human approval” button cannot compensate for a poorly evaluated system or an opaque vendor supply chain.
What this does—and does not—mean outside banking
Financial institutions are the report’s audience. A school, nonprofit, or small business should not describe these sound practices as regulations that automatically apply to it. But the design question travels well: match a system’s autonomy to the harm it could cause, and make accountability specific before the first consequential action.
The practical takeaway: pick one agent workflow and write down its highest-impact action. If you cannot name the approval trigger, accountable owner, and evidence of the final outcome, the oversight design is incomplete.
From the field
My rule is simple: when an AI action falls outside its approved guardrails or governance boundaries, a human should review and approve it before it proceeds. The boundary needs to be explicit, so the system and the person overseeing it know when to stop and escalate.
Sources
News note: This article explains the FSB publication as checked October 17, 2026. The examples above are operational interpretation, not legal advice or a claim that the sound practices are binding requirements.