A crosswalk
The MAS AIRG and the FSB's Sound Practices for Responsible AI
The Financial Stability Board's twelve sound practices for responsible AI adoption, issued final on 15 October 2026, mapped to the final MAS AI Risk Management Guidelines. Where they align, and where they differ.
The Financial Stability Board (FSB) is the international body that monitors the global financial system and coordinates financial regulation across jurisdictions. Its Sound Practices for Responsible Adoption of Artificial Intelligence is a non-binding, internationally agreed baseline for financial institutions. Firms are adopting AI quickly, which brings real benefits but can amplify existing risks and create new ones, from less explainable models to autonomous agents acting outside their intended boundaries, with implications for financial stability. The report sets out twelve sound practices, drawn from what leading institutions already do, to help firms capture the benefits while managing the risks responsibly, and it adds considerations for the authorities that supervise them.
On 15 October 2026 the Financial Stability Board issued the final Sound Practices for Responsible Adoption of Artificial Intelligence, distilling twelve non-binding practices across the AI life cycle. Eight days earlier, MAS issued the final AI Risk Management Guidelines (AIRG). I developed the AIRG while leading AI risk supervision at MAS, and now work independently, so take this as an informed but independent reading. The short version: a firm that meets the AIRG already meets the FSB's twelve practices at the firm level; what the FSB adds is the system-wide and authority-facing lens a national, firm-level guideline does not carry.
Not much changed from the June 2026 consultation to the final. Both set out the same twelve practices across organisation-wide governance and the AI life cycle, so the architecture is unchanged. Some practice titles were refined. The final version expands its description of AI's benefits and risks and adds case studies of how firms have applied the practices proportionately.
Organisation-wide governance (FSB Section 2)
FSB Practice 1 · Strategic direction and oversight
The board and senior management align AI adoption and governance with the institution's business model, risk appetite and strategy, and oversee AI adoption.
AIRG: the whole of Section 3 (AI Oversight), which sets out how the board (3.4) and senior management (3.5) oversee AI adoption, approve and review the governance approach, and put AI into the risk appetite. Direct match.
FSB Practice 2 · Governance and accountability
Financial institutions define clear roles and responsibilities and maintain an appropriate governance framework for responsible AI adoption.
AIRG: Section 3 (board and senior management roles), 3.5(d) (the three lines of defence), and the designated control functions in 4.3, 4.9 and 4.13. Direct match.
FSB Practice 3 · AI risks in the risk management framework, and documentation
Risk management frameworks effectively address AI risks and include documentation of AI use, and materiality and risk assessment.
AIRG: the whole of Section 4 (the key AI risk management systems: identification, inventory and risk materiality) and 5.17 (development documentation for reproducibility and auditability). Direct match; the materiality assessment within Section 4 is detailed under Practice 5 below.
FSB Practice 4 · Organisational adaptability
Institutions learn, adapt and adjust their oversight, governance, risk management and capabilities as AI evolves, sustaining AI expertise and a risk-aware culture.
AIRG: Section 3.4(e) and 3.5(b) (regular review and revision of the approach) and Section 6 (AI capability, capacity and culture, reviewed regularly). Direct match, framed by the AIRG as periodic review plus capability.
AI lifecycle management (FSB Section 3)
FSB Practice 5 · Materiality and risk assessment
Institutions assess the materiality and risk of AI use cases at the inception stage and thereafter.
AIRG: Section 4.10 to 4.13 (the use-case risk materiality assessment, inherent and residual, before deployment and periodically). Near-identical, down to assessing each use case.
FSB Practice 6 · Selection process
When selecting AI models or systems, institutions weigh business objectives and technical needs against the materiality and risks of the use case.
AIRG: Section 5.12 and 5.13 (selection of systems, models and features with a documented rationale; newer or less understood AI weighed against the ability to mitigate). Direct match.
FSB Practice 7 · Data governance
Institutions establish data governance so data is fit for purpose for training, testing and use: accurate, complete, consistent, reliable and secure.
AIRG: Section 5.4 (data management: fit for purpose, representative, quality, security, privacy and lineage). Direct match.
FSB Practice 8 · Explainability and transparency
Institutions understand explainability differences, adopt more explainable AI or compensating controls where feasible, and give transparency tailored to stakeholders.
AIRG: Section 5.5 and 5.6 (transparency and explainability, proportionate to context and materiality, audience-appropriate, with notice and redress). Direct match.
FSB Practice 9 · Performance management
Institutions evaluate AI performance proportionately through assessments, testing and ongoing monitoring.
AIRG: Section 5.14 and 5.15 (evaluation and testing) and 5.23 and 5.24 (post-deployment monitoring and re-validation). The AIRG splits what the FSB holds under one practice across testing and monitoring.
FSB Practice 10 · Human oversight
Institutions implement human oversight relevant to the materiality, risk, autonomy, complexity and explainability of the use case.
AIRG: Section 5.9 (human oversight proportionate to materiality, with roles, escalation, the ability to intervene, and guards against automation bias). Direct match.
FSB Practice 11 · Cyber and ICT risk management
Institutions manage AI-related cyber and ICT risks, including AI cyber scenarios in testing, information sharing, and using AI in cyber risk management.
AIRG: Section 5.16 and 5.22 (technology and cyber controls, secure environments, vulnerability and penetration testing, with existing technology risk management applying). The AIRG leans on existing TRM; the FSB additionally encourages AI-specific cyber scenarios and using AI for cyber defence.
FSB Practice 12 · Third-party AI risk management
Institutions manage third-party AI dependency risks, focusing on performance, transparency, data quality, supply chain, concentration and business continuity.
AIRG: Section 5.10 and 5.11 (third-party AI management: accountability, independent certification, supply chain, concentration and contingency) and 4.2 (identification reaching embedded and third-party AI). Direct match, and both single out concentration.
Where they differ
The alignment at the firm level is close to complete. The differences are about level and audience, not substance.
- The FSB adds the systemic lens. It frames AI as a financial-stability question, treating third-party and model concentration as a system-wide vulnerability and flagging correlated behaviour across firms. The AIRG is firm-level and does not address system-wide concentration.
- The FSB speaks to authorities too. It includes considerations for supervisors and regulators, such as monitoring adoption, closing data and information gaps, and cross-border coordination. The AIRG is purely firm-facing supervisory expectations.
- The AIRG is more operational and granular. It runs to detailed clauses, a basic and a full regime calibrated by materiality, independent pre-deployment validation, change management, and fairness as a distinct control area. The FSB is a higher-level, non-binding, internationally agreed baseline of twelve practices.
- Fairness. The AIRG has a dedicated fairness area (Section 5.7 and 5.8); the FSB folds fairness into data and performance rather than a standalone practice.
The net: the AIRG is a firm-level implementation of the same responsible-AI baseline the FSB sets out internationally, with more operational depth. A firm that meets the AIRG is already in step with the FSB's twelve practices. The one thing the AIRG does not do, by design, is look across the system, which is the FSB's job.
Sources: the MAS AI Risk Management Guidelines (final, 7 October 2026) and the FSB's Sound Practices for Responsible Adoption of Artificial Intelligence (final, 15 October 2026). Interpretation by Gary Ang, who developed the AIRG; it is not regulatory guidance.
I train and advise financial institutions and regulators on the AIRG and the international frameworks around it. See the courses and workshops, or get in touch.