FINMA Guidance 08/2024

Read the PDF edition (3 pages)

On 18 December 2024 FINMA published Guidance 08/2024 on governance and risk management when using artificial intelligence. The guidance does not create new rules. It describes FINMA's observations from supervision and explains how existing requirements on governance, risk management and internal control apply to artificial intelligence. FINMA identified operational risks, in particular model risks such as a lack of robustness, correctness, explainability or bias, together with data risks, IT and cyber risks, the growing dependence on third parties, and legal and reputational risks.¹ It found that "most financial institutions are still in the early stages of development" and that governance structures were "still being established".² The guidance then sets out its observations and expectations in seven areas:

● Governance: institutions focused "primarily on data protection risks, but less on model risks". FINMA expects a central overview, clear responsibilities and consistent standards across the institution.

● Inventory and risk classification: some institutions "defined AI narrowly". FINMA expects a sufficiently broad definition, a complete inventory and a classification of applications by materiality and by the probability that risks materialize.

● Data quality: institutions often lacked controls ensuring that data are complete, correct and of integrity, and that their availability and access are secured.

● Tests and ongoing monitoring: applications should be tested for accuracy, robustness and stability, with performance indicators, thresholds and the detection of "data drift".

● Documentation: documentation was often "not sufficiently detailed and recipient-oriented". For material applications it should cover purpose, data selection, model selection, performance measures, limitations and fallback solutions.

● Explainability: results "often cannot be understood, explained or reproduced". Where decisions must be justified to clients, investors or the supervisor, the institution must be able to explain them.

● Independent review: "only a few supervised institutions" carried out an independent review of material applications by qualified personnel.³ The guidance applies the principle of proportionality. A small Lugano asset manager that uses a chatbot for drafting does not need the model governance of a large bank. It does need to know which artificial intelligence applications it uses, to assess which of them are material and to ensure that their results are checked by a person with the necessary competence before they are used in decisions affecting clients or compliance.⁴ For banks, the legal basis of these expectations lies in the organizational requirements of the Banking Act and the Banking Ordinance, which require an organization appropriate to the business and an effective internal control system, and for portfolio managers and trustees in the corresponding provisions of the Financial Institutions Act.⁵

Notes

1. FINMA, "FINMA publishes guidance on governance and risk management when using artificial intelligence" (18 December 2024), https://www.finma.ch/en/news/2024/12/20241218-mm-finma-am-08-24/. ↩
2. FINMA news release of 18 December 2024 (above). ↩
3. FINMA, Guidance 08/2024 (above), sections 2.1–2.7 (quotations in English as in the official translation). ↩
4. FINMA, Guidance 08/2024 (above) (FINMA pursues "a technology-neutral, proportional and standardised approach" and refers to "the materiality of the AI applications used and the probability that the risks ... will materialise"). The illustration for a small asset manager is the author's application of the guidance. ↩
5. Federal Act on Banks and Savings Banks of 8 November 1934 (Banking Act, BankA), SR 952.0, Art. 3 para. 2 lit. a (business scope and an administrative organization corresponding to the business), https://www.droit-bilingue.ch/de-fr/9/95/952.0-3-10.html; Banking Ordinance of 30 April 2014 (BankO), SR 952.02, Art. 12 ("Funktionentrennung und Risikomanagement"), https://www.droit-bilingue.ch/de-fr/9/95/952.02-12-20.html; Federal Act on Financial Institutions of 15 June 2018 (FinIA), SR 954.1, Art. 9 ("Organisation") and Art. 21 (portfolio managers and trustees must have "ein angemessen ausgestattetes Risikomanagement und eine wirksame interne Kontrolle"), https://www.droit-bilingue.ch/de-fr/9/95/954.1-21-24.html. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.