The Fed Drew the Blueprint. The FSB Filed It in 24 Jurisdictions.

The Financial Stability Board published its consultation report on sound practices for responsible AI adoption on June 10, 2026. The FSB coordinates financial stability policy across 24 countries and jurisdictions and reports to the G20. What it published is a judgment framework — not a checklist, not a specification. The same posture SR 26-2 established domestically in April, codified internationally in June. The wall is the same height everywhere. And the sequencing is more specific than it first appears.

The Sequence That Matters

SR 26-2 was issued April 17, 2026, jointly by the Federal Reserve, OCC, and FDIC. It replaced SR 11-7 after fifteen years and established a judgment-based model risk management framework that explicitly carved generative and agentic AI out of its published scope. The FSB consultation report followed on June 10 — fifty-four days later. It proposes twelve sound practices organized across governance, the AI lifecycle, and cyber and third-party risk. Explicitly non-prescriptive: not intended to establish an international standard or impose a prescriptive approach. Same framing as SR 26-2. Same operating condition for the institution: here is the outcome required, not the method for achieving it.

The standard read is that US domestic regulators and the international coordination body independently arrived at the same judgment-based framework. That read is incomplete. Michelle Bowman — Federal Reserve Vice Chair for Supervision — chairs the FSB Standing Committee on Supervisory and Regulatory Cooperation, the committee that produced this report. She oversees SR 26-2 domestically and chaired the FSB workstream that translated that posture internationally. In her published statement, Bowman described the October 2026 final report as a US G20 deliverable.

SR 26-2 and the FSB framework are not parallel developments that converged on the same conclusion. They are sequential outputs from the same regulatory leadership. The judgment framework is not a domestic artifact the FSB happened to mirror. It is a deliberate architectural posture designed domestically in April and exported internationally in June. The wall is the same height everywhere because it was drawn by the same architect.

The FSB’s Version of the Judgment Requirement

Three of the twelve sound practices land directly on the ground the first dispatch staked out.

• Sound Practice 5 — Requires institutions to implement an effective and systematic approach to assess the materiality and risk of AI use cases at inception and on an ongoing basis. The FSB does not specify what that approach looks like. It requires that it exist, be applied consistently, and hold up to supervisory scrutiny. This is the FSB’s version of SR 26-2’s four-driver materiality framework — inherent risk, exposure, purpose, use — without the definitional precision SR 26-2 provides. The judgment requirement is higher, not lower.
• Sound Practice 8 — Requires institutions to understand differences in explainability across AI types and either adopt more explainable forms or implement compensating controls. The standard is not explainability. The standard is defensibility. The FSB explicitly acknowledges that explainability methods have limitations, can introduce additional uncertainty, and may themselves rely on additional models. An institution cannot satisfy this practice by deploying an explainability tool. It must demonstrate considered judgment about what level of explainability is appropriate — and produce an auditable evidence chain to support that judgment.
• Sound Practice 10 — Requires appropriate and effective human oversight calibrated to the materiality, risk, autonomy, complexity, and explainability of each AI use case. For agentic AI specifically — systems that execute sequential decisions with limited human intervention — the FSB notes that oversight approaches may need to be fundamentally different from those designed for traditional models. It does not say what those approaches should look like. It says they must exist, must be calibrated to the system’s actual operating characteristics, and must be defensible. That is the harness problem stated in international regulatory language.

The FSB’s Version of Footnote 3

The most structurally significant element of SR 26-2 was Footnote 3: generative AI and agentic AI models are novel and rapidly evolving and are not within the scope of the guidance, but a banking organization’s risk management and governance practices should still guide controls for those systems. No published specification. Self-governance is the operating condition. The compliance obligation survives the carve-out.

The FSB report contains its own version of that statement, placed in the introduction and repeated in the scope framing: the sound practices are not developed to address recent risks that have emerged related to frontier AI models, although some sound practices would help financial institutions respond to such risks.

Two documents. One from US banking regulators in April. One from the 24-jurisdiction coordination body in June, chaired by the same Fed official. Same statement. The tools institutions are racing to deploy sit outside the published specification. The expectation that controls exist and are defensible does not go away. The mechanism for satisfying that expectation is institutional judgment, not regulatory compliance.

This is not a regulatory gap waiting to be filled. It is a deliberate posture. The FSB was explicitly asked whether it would address frontier AI. It chose not to. The same official who oversaw SR 26-2’s domestic scope decision chaired the FSB committee that made the identical international scope decision. The judgment gap is architectural. It was drawn on purpose.

What the Coordination Means for the Assurance Argument

The first dispatch framed the assurance opportunity as a trust-accumulation problem — domestic, US-examiner-specific. The FSB report extends it geographically and institutionally. Every institution operating across FSB member jurisdictions — 24 countries directly, approximately 70 additional through the FSB’s Regional Consultative Groups — is now operating under the same judgment framework, with the same absence of published specification for agentic AI governance, with the same expectation that controls exist and are defensible.

The assurance question the first dispatch left open — what is the architecture that closes the harness problem — is not a US question. It is the central question in FSI model governance globally. And it now has a deadline. The FSB final report publishes in October 2026 as a US G20 deliverable. That report will not contain a specification for agentic AI governance. Bowman said so directly. It will contain a judgment framework with higher expectations and no template.

This is where assurance enters as a discipline, not just a posture. The judgment gap does not close itself. The regulatory frameworks — SR 26-2 domestically, the FSB framework internationally — have defined the operating condition: defensible institutional judgment, no published specification, examiner-accepted evidence chains. What fills the gap between that requirement and an institution’s current capability is not more compliance. It is governance infrastructure built to produce auditable evidence of sound judgment at runtime — decision trace, authorization chain, continuous record of autonomous action and the policies that governed it. That is assurance infrastructure. And it is the architectural work that the compliance substrate, by design, does not provide.

The Wall in October

When the FSB final report publishes in October 2026 as a US G20 deliverable, the wall will be higher than it is today. The comment period closes July 22. The FSB asked specifically whether the practices are sufficiently flexible to accommodate newer types of AI. The answer from institutions that understand the architecture will be that the practices are appropriately flexible for traditional models and structurally silent on the tools that matter most. That response will not produce a specification. It will produce a final report with the same judgment posture and a formal G20 imprimatur.