On this page
The Financial Stability Board finalised responsible AI sound practices on 15 October 2026. For a CAIA® Level II candidate, the useful connection is to operational due diligence: ask how an alternative investment manager governs an AI use case, validates its data and performance, keeps human oversight, and controls outside providers. These FSB practices are guidance to financial institutions; publication does not itself amend the CAIA exam syllabus or create a new binding rule for every manager.
What changed on 15 October
The FSB final report sets out 12 sound practices for financial institutions considering responsible AI adoption. The FSB groups them into organisation-wide governance and management of risks through the AI lifecycle, from development to deployment. Its accompanying 15 October announcement says the final report followed a June consultation and reflects feedback on that draft. The headline is a finalised international sound-practices report, not a domestic enforcement deadline.
That status matters. A sound practice is a reference point for governance and control, and the FSB says institutions can tailor the toolkit to their context and risk profile. An exam answer that says every alternative manager now has a legally mandated AI committee would go beyond the FSB source. Likewise, an answer that treats this publication as a direct CAIA syllabus update confuses an industry development with exam authority. CAIA Association says its own curriculum editions apply to the relevant exam year, and that candidates should use the official curriculum as the source of truth for what is tested.
The CAIA curriculum overview lists Level II due diligence, operational due diligence, risk management and global regulation among its topic areas for the published 2027 edition. The CAIA curriculum and study-tools page says Level II emerging-topic readings cover timely, evolving subjects and are required readings for that year. These facts explain why an AI governance report is a useful current example when practising risk and manager-diligence reasoning. They do not prove that the FSB report itself is an assigned reading or that a particular sentence from it will appear in an exam question.
Translate the practices into diligence evidence
A candidate evaluating an alternative manager should move from policy language to observable controls. First identify the actual use case. A tool that summarises public research notes has different materiality from one that proposes trades, scores illiquid loans or interacts with investors. The FSB’s sound practice on materiality and risk assessment calls for a systematic approach at inception and afterwards. In a diligence discussion, therefore, ask how the manager classifies the use case before deployment and what change would trigger reclassification. “We use AI” describes a technology, not the risk it introduces.
Governance comes next. The FSB’s initial group of practices addresses strategic direction, clear roles, documented AI use and organisational adaptation. For a manager, relevant evidence could include an inventory of live use cases, approval records, named owners for model changes, escalation paths and minutes showing that senior management challenged a material use case. Those are examples of evidence a diligent reviewer might request, not documents the FSB says every firm must maintain in precisely that form. The central question is whether responsibility can be located when outputs are wrong or controls fail.
Data governance is a separate test. The FSB’s practice calls for data fit for training, testing and use, including qualities such as accuracy, completeness, consistency, reliability and security. A private-markets manager might combine internally collected borrower data with vendor datasets. A compelling output can still be wrong if either source contains stale entries, duplicate borrowers or inconsistent definitions. Ask where the input came from, how it was cleaned, whether the test data resemble live cases, and how confidential client or portfolio information is protected. An attractive dashboard cannot substitute for a traceable data lineage.
Performance management requires evidence after launch as well as before it. The FSB calls for proportionate evaluation, testing and continuing monitoring. A manager could show a pre-deployment comparison against an agreed baseline, then monitoring for deteriorating accuracy or changing input patterns. The form of testing should match the use case: a research summariser may require citation checks and factual error rates, while a valuation aid may require comparisons with independently reviewed decisions and sensitivity to adverse assumptions. The candidate should avoid prescribing a single universal metric. The point is to ask whether the chosen metric can reveal a failure that matters to the manager’s actual process.
Human oversight has to be real rather than ceremonial. The FSB links oversight to the materiality, autonomy, complexity and explainability of the AI use case. A nominal “human in the loop” may add little if staff accept a generated recommendation without seeing its inputs or reasons. Diligence should ask what the reviewer can challenge, how overrides are recorded, whether people have time and expertise to intervene, and what happens when the output is uncertain. Explainability is connected: where an AI method is hard to interpret, the FSB asks institutions to consider more explainable technology when appropriate and feasible, or compensating controls. Neither phrase means that every model can be made perfectly transparent.
Outside providers add another boundary. The FSB specifically identifies third-party AI dependencies and focuses on performance, transparency, data quality, supply chain and concentration, and continuity. A manager might rely on the same external model as many peers, or on a provider that can change a model without the manager’s direct control. The diligence question becomes whether contracts, monitoring, contingency plans and change notices give the manager enough information and control for the use case. A vendor assurance letter is one input; it is not proof that the manager has mapped the dependency into its own risk framework.
An illustrative manager review
Consider an invented private-credit manager using an AI tool to draft borrower risk summaries. Analysts still make decisions; the tool reads loan documents and vendor financial data and generates a first-pass narrative. The case is illustrative and makes no claim about an actual firm. The manager says the system saves analyst time. A candidate should ask what evidence would justify using it when an erroneous summary could cause a borrower covenant or cash-flow weakness to be missed. The FSB framework helps structure that enquiry without dictating a pass-or-fail score.
At inception, the manager records the tool’s purpose, data sources and the consequences of a wrong or missing summary. It tests the tool against a set of documents that includes difficult cases: amended covenants, missing pages and conflicting figures. It records which errors were found, what changed before approval and who accepted the residual risk. If the tool later begins to ingest a new vendor feed, that is a material change requiring a fresh assessment, because a previously acceptable test no longer covers the live inputs. These are proposed diligence checks derived from the FSB themes; they are not a claim that the report prescribes this exact workflow.
In production, an analyst checks each extracted covenant against the original document and records material corrections. A supervisor reviews exceptions and asks whether certain borrower types are generating more errors. The manager also documents a fallback process if the vendor service fails during a reporting cycle. If the firm cannot show who reviews output or how errors feed back into testing, the candidate has found a control gap. If it can show repeated review evidence, the answer should say what that evidence demonstrates and where its limits remain. A written AI policy alone would be weaker evidence than a functioning process with dated tests and corrections.
Suppose the tool produces accurate summaries for ordinary loans but repeatedly misses amendments embedded in scanned attachments. The useful response is to narrow the authorised use case, require manual checking of attachments or improve the extraction method and retest before expansion. Simply quoting a high average accuracy score would obscure the specific failure mode. This illustrates why materiality, data quality, performance and human oversight must be considered together. The risk is the missed contractual term, not the mere presence of AI in the process.
What to write in a CAIA answer
State the dated development accurately: FSB finalised a set of voluntary sound practices on 15 October 2026 and encourages boards and senior management to use them when refining governance and controls. Then identify the syllabus connection at the level CAIA itself publishes: due diligence, operational risk, risk management and global regulation. Do not claim that the FSB report has become examinable reading. If the question asks about a manager, move from broad principles to evidence for a particular use case: inventory and ownership, risk classification, data lineage, pre- and post-deployment testing, human challenge, vendor dependency and continuity.
Qualify the inference. FSB sound practices are aimed at financial institutions generally and are to be tailored to context. A small manager using a low-impact research aid need not have the same process as a system making consequential decisions at scale. Proportionality does not excuse an inability to explain where data came from or who can stop a faulty process. The candidate’s task is to evaluate whether controls are appropriate to the use case and whether the supplied evidence supports that judgement. Omni’s CAIA program page locates the course, while the how-it-works page explains the learning format.
Finally, separate what was observed from what is proposed. The FSB publication and CAIA topic list are observed primary-source facts. The private-credit review above is an invented application designed to practise the reasoning. That separation protects an exam answer from overstating regulatory effect or pretending that a hypothetical control test was a real inspection. The enduring lesson is to turn a current standards development into a disciplined diligence question while keeping the official curriculum, the legal status of guidance and the evidence for any particular manager distinct.
Sources
- Sound Practices for Responsible Adoption of Artificial Intelligence: Final report | FSB · fsb.org · Retrieved
- FSB finalises sound practices for responsible adoption of AI | FSB · fsb.org · Retrieved
- Explore the Curriculum | CAIA Association · caia.org · Retrieved
- Curriculum and Study Tools | CAIA Association · caia.org · Retrieved
