What the FSB's AI sound practices ask of a private lender.

The Financial Stability Board published its final Sound Practices for Responsible Adoption of Artificial Intelligence on 15 October 2026. For a private lender, the FSB AI sound practices change less about which tools you may use than about what each tool must leave behind. The report sets out 12 practices. The ones that bite on a credit team are about records, human oversight and vendor terms.

This guide answers for the compliance lead or COO at a private credit fund or non-bank lender running AI in its monitoring cycle. The report has no jurisdiction: it is a global, non-binding document addressed to all financial institutions. So this guide is specific about the mechanism instead. Our reading is that its most useful pages for a lender are the ones on what an AI agent's record should contain.

The FSB AI sound practices are not binding, but they still reach a private lender.

The practices bind nobody. The report says they are non-prescriptive and do not constitute a binding international standard. It also says applying them does not absolve a firm of its local legal and regulatory obligations. Boards and senior management are strongly encouraged to reference them when building or refining AI governance.

They still matter to a lender for two reasons. First, the report is written for all financial institutions, not only banks, and applies proportionately to size and to how material each AI use is. Smaller firms may apply only the relevant practices, and may bring in external experts to support the board. Second, it draws on supervisors' own work. Its references include APRA's April 2026 letter to industry on AI, the IOSCO supervisory toolkit for capital markets and the MAS consultation on AI risk management.

One case study is close to home. A global asset manager built an application that turns private markets investment memoranda into an initial risk assessment. Its outputs link to the mandate rules and source documents. It does not approve or reject anything, and accountability stays with the risk manager.

What records an AI agent should leave behind.

Section 2.3 asks firms to keep documentation and lifecycle records of each AI use. Documentation covers the purpose, the model and why it was chosen, the owner, the data sources used at inference, and the dependencies on vendors. Lifecycle records are the logs from deployment, operation and monitoring. Records are to be protected from modification or deletion and, where possible, kept immutable when they hold critical information.

For agents, the report goes further. It asks for each agent's actions to be attributable to that agent through two properties.

In a monitoring cycle, that is a specific record. Which agent read the borrower's pack, which pages it drew each spread figure from, and which covenant test it ran. Then who reviewed the result and what they changed. A cycle that produces a finished note but not that chain falls short of this practice.

Where a person has to stand in the monitoring cycle.

Sound Practice 10 asks for human oversight that is meaningful rather than tick-the-box. The report names several forms. Human-in-the-loop means a person approves every decision. Human-on-the-loop means intervention only where needed, such as a low-confidence output. Human-in-command means setting the autonomy and the guardrails. A kill switch halts or constrains the AI.

For agents, the report pairs oversight with deterministic controls written into the system. Three map directly onto loan monitoring.

Our position is that a monitoring note should be human-in-the-loop at sign-off. The steps under it can run on the loop. The report also asks that monitoring after deployment sit with staff who were not part of the design. It asks firms to track when people override AI recommendations and to learn from the pattern. That is the same separation FSC Standard No. 30 asks for between origination and valuation approval.

What a lender should ask its AI vendor under Sound Practice 12.

Section 3.9 notes that smaller institutions may be mainly deployers of third-party AI rather than builders. So their assurance depends on what the vendor discloses. The report lists what contracts should cover.

Two further points are easy to miss. Firms should find AI embedded in tools not sold as AI, such as the loan system or the document portal. And an AI certification such as ISO/IEC 42001 may not, by itself, satisfy a firm's due diligence. Where a vendor cannot give enough assurance, the report expects compensating controls, such as limiting early use to low-risk work. For what retention terms actually cover, see our guide to zero data retention.

What changes for a private lender in practice.

Nothing in the report stops a lender automating its monitoring cycle. It does change what a lender should be able to produce on request. Keep an inventory of each AI use with a named owner. Give each agent an identity and a trace of what it read and did. Store the record where nobody can quietly edit it. Name the person who signs off, and evidence that they did.

That is the same record an SEC examiner would ask a registered adviser for under the 2027 exam priorities. A lender that builds it once answers the FSB, its auditors and its investors with the same evidence. Where that record comes from is the real buying question. A tool that produces a finished note but no reconstructable trail leaves the lender to build the evidence by hand.

Primary sources: the FSB's Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report of 15 October 2026, and the FSB press release of the same date. This guide is general information, not legal advice. The practices are non-binding, and how a supervisor applies them depends on the jurisdiction and the firm.