FINMA’s supervisory expectations

From the Risk Monitor 2023 to Guidance 08/2024

FINMA has not issued a circular on artificial intelligence. It has chosen to formulate its expectations within the existing framework of governance and risk management, in line with its principles-based and technology-neutral approach. In its Risk Monitor 2023 it described four areas of expectation: governance and responsibility, robustness and reliability, transparency and explainability, and equal treatment. FINMA explained that its concern was that results generated by AI might not be understood or explained by humans, that errors or unequal treatment might creep in unnoticed, and that responsibility for AI-driven decisions might remain unclear. From the fourth quarter of 2023 FINMA carried out on-site reviews and supervisory dialogues with institutions that used AI extensively or in areas relevant to supervision.¹

On 18 December 2024 FINMA published Guidance 08/2024 on governance and risk management when using artificial intelligence. The guidance summarises FINMA’s observations from its supervision and states that most institutions were still at an early stage, with governance and risk management structures still being built. It identifies operational risks, especially model risks such as a lack of robustness, correctness or explainability and bias. It also lists data-related risks concerning security, quality and availability, IT and cyber risks, growing dependence on third parties, and legal and reputational risks.²

The content of the guidance

The guidance describes the measures that FINMA considers appropriate and against which it assesses institutions in its supervision. Institutions are expected to establish clear governance with defined responsibilities for the development, implementation, monitoring and use of AI. They should create an inventory of the AI systems used in the organisation and classify them according to risk. Data quality must be assured, since in many applications the quality of the data matters more than the choice of model. Systems should be tested before deployment and monitored continuously, supported by comprehensive and easily accessible documentation. Explainability must be ensured where decisions have to be justified to clients, employees or supervisors, and independent reviews should be carried out where appropriate. Finally, staff must be trained so that AI is used properly and ethically. FINMA frames all of this proportionately: the intensity of measures should depend on the materiality of the AI systems and on the probability that the associated risks materialise.³

Two features of the guidance deserve emphasis. The first is its treatment of third parties. Where an institution uses models, hardware or cloud services from external providers, it remains responsible for the risks, and FINMA expects an integrated approach that follows the logic of the outsourcing rules. The second concerns the legal nature of the document. FINMA guidance is not binding law, yet it describes the supervisory practice that FINMA applies when it assesses whether an institution meets the statutory requirement of adequate organisation and risk management. An institution that departs from the guidance must be able to explain why its own approach achieves the same protection. In practice, the inventory, the risk classification and the documentation of testing are the elements that auditors and FINMA request first.

Supervisory priorities after 2024

FINMA’s Risk Monitor 2025 does not list artificial intelligence as a principal risk in its own right. It names nine principal risks, of which outsourcing, cyber attacks and the complexity of information and communication technology are directly relevant to AI. FINMA called for more robust controls over the outsourcing of critical functions and noted that almost half of all reported incidents involved third parties.⁴ The classification is logical. From a supervisory perspective, most AI risks materialise as operational, outsourcing or cyber risks, so they can be captured within existing categories. An AI model that fails is an operational incident, one that leaks data raises a cyber and data protection issue, and dependence on a single American provider of language models is an outsourcing and concentration risk. FINMA’s approach therefore places AI within a framework that Swiss institutions already know, which reduces uncertainty but also means that the relevant rules are spread across several instruments.

Notes

1. FINMA, “Künstliche Intelligenz: Die FINMA formuliert ihre Erwartungen” (dossier Fintech), https://www.finma.ch/en/documentation/dossier/dossier-fintech/kuenstliche-intelligenz/ (accessed September 2026). According to the dossier, the industry welcomed FINMA’s technology neutrality and risk-based approach. ↩
2. FINMA, “FINMA guidance on governance and risk management when using artificial intelligence”, press release of 18 December 2024, https://www.finma.ch/en/news/2024/12/20241218-mm-finma-am-08-24/. ↩
3. Pestalozzi, “FINMA guidance on governance and risk management when using AI”, https://pestalozzilaw.com/en/insights/news/legal-insights/finma-guidance-on-governance-and-risk-management-when-using-ai/ (accessed September 2026), summarising FINMA Guidance 08/2024. ↩
4. FINMA, “FINMA Risk Monitor 2025: accentuated geopolitical risks – cyber and real estate risks continue to grow”, 17 November 2025, https://www.finma.ch/en/news/2025/11/20251117-mm-risikomonitor/. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.