Summary of document history
Financial institutions have long used AI tools, but rapid advances – particularly in generative AI (GenAI) and agentic AI – have generated significant interest.
This report sets out 12 sound practices financial institutions are encouraged to consider to facilitate their responsible adoption of AI.
The 12 sound practices are organised into two groups which:
- emphasise the importance of organisation-wide AI governance as financial institutions adopt AI.
- set out a comprehensive framework for managing risks throughout the AI lifecycle, from development to deployment.
The board and senior management of financial institutions are strongly encouraged to reference the sound practices as they consider business strategy, technology adoption, and risk management in an increasingly AI-enabled environment.
List of Sound Practices for financial institutions’ responsible AI adoption
Sound Practice 1 (Strategic direction and oversight): The board and senior management align AI adoption and governance with the financial institution’s business model, risk appetite, and strategy.
Sound Practice 2 (Governance and accountability): Financial institutions define clear roles and responsibilities, and maintain an appropriate governance framework to enable responsible AI adoption.
Sound Practice 3 (Incorporation of AI risks into risk management framework and effective documentation of AI use): Financial institutions adopt risk management frameworks that effectively address AI risks, and include processes for documentation of AI use, as well as for materiality and risk assessment.
Sound Practice 4 (Organisational adaptability): Financial institutions learn, adapt and adjust their oversight, governance, risk management practices, and capabilities as AI evolves.
Sound Practice 5 (Materiality and risk assessment): Financial institutions implement an effective and systematic approach to assess the materiality and risk of AI use cases at the inception stage and thereafter.
Sound Practice 6 (Selection process): When selecting AI models or systems, financial institutions consider business objectives, operational and technical needs, as well as the materiality and risks of AI use cases.
Sound Practice 7 (Data governance): Financial institutions establish appropriate data governance to maintain data that is fit-for-purpose for training, testing, and using AI (i.e. accurate, complete, consistent, reliable, secure).
Sound Practice 8 (Explainability and transparency): Financial institutions understand differences in the explainability of various types of AI. If appropriate and feasible, financial institutions adopt more explainable AI, or consider compensating controls. Financial institutions also provide appropriate transparency tailored to different stakeholders.
Sound Practice 9 (Performance management): Financial institutions evaluate the performance of AI use cases proportionately to their materiality and risk, including through performance assessments, testing, and ongoing monitoring.
Sound Practice 10 (Human oversight): Financial institutions implement appropriate and effective human oversight relevant to the materiality, risk, autonomy, complexity, and explainability of different AI use cases.
Sound Practice 11 (Cyber and ICT risk management): Financial institutions manage AI-related cyber and ICT risks, including, where appropriate, by incorporating AI cyber and ICT risk scenarios into tests and exercises, sharing relevant information, and using AI tools in cyber and ICT risk management.
Sound Practice 12 (Third-party AI risk management): Financial institutions appropriately manage risks from third-party AI dependencies with a focus on performance, transparency, data quality, supply chain and concentration risks, and business continuity.
