Docs

Appearance

FINMA AI Governance — Guidance 08/2024 on Governance and Risk Management When Using AI ​

FINMA AI Governance illustration

FINMA Guidance 08/2024, "Governance and risk management when using artificial intelligence", is guidance of the Swiss Financial Market Supervisory Authority (FINMA) for supervised institutions that use AI. For its date and its effect in law, see The guidance and the law.

Start here ​

For FINMA Guidance 08/2024, select the applicable information:

The guidance and the law ​

FINMA Guidance 08/2024 has the date 18 December 2024.

FINMA's "FINMA Guidance" source tells supervised institutions that FINMA guidance "does not have legal impact". This source also tells them: "Unlike its ordinances and circulars, FINMA guidance is not a supervisory tool, aiming rather to ensure proper application of the rules in practice."

On 18 December 2024, section 1 of Guidance 08/2024 gave this information about the law:

To date, there is no AI-specific legislation in Switzerland. In financial market law, the technology-neutral, principle-based regulatory requirements for effective governance and risk management cover the risks arising from the use of AI.

For the OFCOM information of 10 March 2025, see Related sources.

FINMA Guidance 08/2024 has three parts:

  • Section 1, "Introduction": section 1 gives the expectations of FINMA for supervised institutions that use AI. See Institutions and AI risks.
  • Section 2, "Findings from supervision": section 2 gives "examples of measures to address specific risks resulting from AI applications that FINMA has observed as part of its ongoing supervision". FINMA observed these measures during "supervisory discussions" and in "initial specific on-site" supervisory reviews. See The seven assessment areas.
  • Section 3, "Outlook": see Related sources.

FINMA Guidance 08/2024 contains no penalties and no compliance date for AI. This does not change the requirements of financial market law that section 1 refers to.

Institutions and AI risks ​

FINMA Guidance 08/2024 is for supervised institutions that use AI (section 1). Section 2 tells them that its examples are "intended to support supervised institutions in identifying, assessing, managing and monitoring risks from internal and external AI applications". In section 3, FINMA "strives for a technology-neutral, proportional and standardised approach across all sectors, taking into account significant differences between the sectors and international standards".

Section 2 of FINMA Guidance 08/2024 tells supervised institutions that the risks from the use of AI are "mainly in the area of operational risks". Section 2 gives these risks:

  • in the area of operational risks: "in particular model risks (e.g. lack of robustness, correctness, bias and explainability) as well as IT and cyber risks"
  • risks from "a growing dependence on third parties such as providers of hardware solutions, models or cloud services in an increasingly concentrated market"
  • "legal and reputational risks"
  • "challenges in the allocation of responsibilities due to the autonomous and difficult-to-explain actions of these systems and scattered responsibilities for AI applications at supervised institutions"

Footnote 3 of section 2 refers to the Capital Adequacy Ordinance (CAO):

See Art. 89 CAO: The term “operational risk” refers to the risk of loss resulting from the inappropriateness or failure of internal procedures, people or systems, or from external events.

For the expectations of FINMA in section 1 and the "factors" for each institution and each AI application, see Proportionality. For the "definition of AI", footnote 7 ("AI is not a high-risk application per se"), and the risk classification of AI applications, see Inventory and risk classification.

The seven assessment areas ​

Section 2 of FINMA Guidance 08/2024, "Findings from supervision", has sections 2.1–2.7. Each section gives information about the items that FINMA "observed" and "assessed" at supervised institutions. Some assessments apply only to some institutions or applications, for example to institutions "with many or significant applications" (section 2.1) or to "material applications" (sections 2.5 and 2.7).

For sections 2.1–2.3, see Governance, Inventory and Risk Classification, and Data Quality:

  • Governance (section 2.1)
  • Inventory and risk classification (section 2.2)
  • Data quality (section 2.3)

For sections 2.4–2.7, see Testing and Ongoing Monitoring, Documentation, Explainability, and Independent Review:

  • Tests and ongoing monitoring (section 2.4)
  • Documentation (section 2.5)
  • Explainability (section 2.6)
  • Independent review (section 2.7)

Use in Modulos ​

For FINMA Guidance 08/2024, Modulos recommends OFF-22 for the Organization and one AI System with MFF-22 for each AI application. For the Controls that other Frameworks also use, see Control overlap.

Section 3 of FINMA Guidance 08/2024, "Outlook", gives information about changes to FINMA's expectations. After 18 December 2024, FINMA and other organizations gave more information about AI. The items below do not identify changes to Guidance 08/2024.

Section 3 of Guidance 08/2024, "Outlook". Section 3 tells supervised institutions that, "Based on its supervisory experience, and in line with relevant international developments", FINMA "will also refine its expectations of appropriate governance and risk management by supervised institutions in connection with AI and, where necessary, make them transparent in the market". Section 3 gives no date for this.

FINMA's "FINMA Guidance" source. On 14 October 2026, FINMA's "FINMA Guidance" source showed "Updated: 18.12.2024" for Guidance 08/2024. This entry does not show that FINMA has no other expectations for AI after that date.

FINMA press release, 24 April 2025. In this press release, FINMA tells institutions:

FINMA recommends that the authorised institutions contact FINMA in good time if they are planning to use AI in critical processes or to calculate regulatory parameters.

The press release gives no time limit and no procedure for this contact. For this work, see Use FINMA AI Governance in Modulos.

OFCOM, 10 March 2025. "Artificial Intelligence" of the Federal Office of Communications (OFCOM) has the date 10 March 2025. On that date, OFCOM gave this information:

  • "In Switzerland, there is currently no specific legislation on AI."
  • The source gives the end of 2026 for a consultation draft that "will implement the Council of Europe's AI Convention".
  • The source also gives the end of 2026 for an "implementation plan for the other measures not laid down in legislation".

OFCOM gives the last two items as work to do. These two items are not law.

FINMA Guidance 02/2026, 9 April 2026. FINMA Guidance 02/2026 is for "banks and persons under Article 1b of the Banking Act". Section 3.2 of FINMA Guidance 02/2026 tells them:

When it comes to establishing client relationships online, fraudulent account opening (using forged identification documents or identity theft) poses a particular risk. This risk is exacerbated by the increased use of artificial intelligence, video manipulation software and deepfake technologies.

Circular 2016/7, 8 October 2026. In a press release of 8 October 2026, FINMA gives information about changes to some parts of its Circular 2016/7 "Video and online identification":

liveness detection is now to be introduced as an additional security measure for online identification, in order to address the growing risks associated with new technologies (particularly in the field of artificial intelligence)

The press release also gives this date: "The changes will enter into force on 1 November 2026."

IAIS Application Paper, 2 July 2025. On 2 July 2025, the International Association of Insurance Supervisors (IAIS) "published the final version of its Application Paper on the supervision of artificial intelligence". The IAIS consultation source also shows: "This consultation is now closed and the Application Paper has been published." The Application Paper (p. 2) gives this information:

Application Papers do not include new requirements, but provide further advice, illustrations, recommendations or examples of good practice to supervisors on how supervisory material may be implemented. The proportionality principle applies also to the content of Application Papers.

The Application Paper is for "supervisors and insurers" and the use of "AI systems in insurance". The Application Paper is not FINMA guidance.

FINMA AI Governance FAQ ​

For FINMA Guidance 08/2024, see FINMA Guidance 08/2024 FAQ.

Sources ​

Disclaimer

This page gives general information. It is not legal advice.