FINMA Guidance 08/2024: governance and risk management when using AI

What it is

FINMA Guidance 08/2024, Governance and risk management when using artificial intelligence, was published by the Swiss Financial Market Supervisory Authority on 18 December 2024. FINMA guidance explains how FINMA applies the law and its existing supervisory practice to a current topic. This one draws on what FINMA observed in its ongoing supervision of how institutions use AI.

Switzerland has no AI-specific financial market law. FINMA’s position is that its existing requirements are technology neutral and principle based, and that they already cover AI. The guidance shows what that means in practice. In its announcement, FINMA said most financial institutions were still in the early stages, with governance and risk management structures still being set up.

Who it applies to

The guidance is addressed to institutions FINMA supervises, from banks and insurers to the other financial institutions under its supervision, that develop or use AI. It applies whether the AI is built in-house or bought from a third party, and whether it is a traditional machine learning model or a generative AI tool. Proportionality runs through it. The expected measures scale with the size and complexity of the institution and the materiality of each application.

What it requires

FINMA names the risks it is concerned with. They are model risks such as a lack of robustness, correctness, explainability or the presence of bias, data risks around security, quality and availability, IT and cyber risks, growing dependence on third parties, and legal and reputational risk. Its expectations fall into seven areas.

Governance. FINMA found that institutions often focused on data protection rather than model risk, that AI development was often decentralised, and that it could be hard to tell whether a purchased application contained AI. It expects clearly defined responsibilities for the development and use of each application, rules for model testing and documentation, training, and contract terms that settle the provider’s responsibilities where AI is outsourced.

Inventory and risk classification. Some institutions defined AI too narrowly and struggled to keep a complete inventory. FINMA expects a sufficiently broad definition of AI, a centrally managed inventory of AI applications, and criteria for identifying the applications that are material or carry specific risks.

Data quality. Institutions should have internal rules to ensure the data used by AI applications is complete, correct, of sound integrity and accessible.

Tests and ongoing monitoring. FINMA found weaknesses in the planning of tests and few performance indicators defined in advance. It expects testing to confirm that applications meet their objectives, defined performance indicators, regular checks of outputs, and controls that detect model and data drift after deployment.

Documentation. Material applications need documentation that covers their purpose, data selection and preparation, model selection, performance measures, tests and controls, risks and fallback arrangements, written for the people who use them.

Explainability. Results should be understandable and, as far as possible, reproducible, so that the institution can critically assess them and explain them to investors, clients or employees.

Independent review. For material applications, FINMA expects an independent review across the development cycle, giving an objective and unbiased opinion on whether the application is appropriate and reliable.

For an institution, the first practical step is the inventory. Every other expectation is applied application by application, and an institution that does not know where it uses AI cannot classify, test or document it.

Key dates

• 18 December 2024. FINMA Guidance 08/2024 published.

The Federal Council’s work on implementing the Council of Europe AI Convention, with a consultation draft due by the end of 2026, may lead to sector-specific changes in financial market law.

How it relates to other frameworks

The seven areas map closely to international AI risk frameworks. Institutions that structure their governance on ISO/IEC 42001 or the NIST AI RMF will find most of FINMA’s expectations covered, with the inventory, independent review and drift controls as the areas to check. Where an AI application makes decisions about clients, FADP Article 21 also applies. Swiss institutions serving EU markets may in addition fall under the EU AI Act, which classes AI used for creditworthiness assessment and for life and health insurance pricing as high risk.

A note on this page

This is Aicura’s reading of FINMA Guidance 08/2024. It is not legal or regulatory advice and it is not the guidance itself. Read the guidance published by FINMA, and take advice on how it applies to your institution.