Frequently asked questions about FINMA Guidance 08/2024

Each entry below gives short information about FINMA Guidance 08/2024 and shows where to find the full information.

Disclaimer

This page gives general information. It is not legal advice.

What is FINMA Guidance 08/2024?

FINMA Guidance 08/2024 gives information about governance and risk management at supervised institutions that use AI. Its date is 18 December 2024. In section 1, FINMA expects institutions to align governance, risk management and control systems with AI's effect on their risk profile. Section 2 gives information about items that FINMA observed and assessed in seven areas. FINMA's "FINMA Guidance" source tells institutions that guidance "does not have legal impact". See the guidance and its effect in law.

Is FINMA Guidance 08/2024 legally binding?

FINMA's "FINMA Guidance" source tells supervised institutions that FINMA guidance "does not have legal impact". This source includes Guidance 08/2024. Section 1 of Guidance 08/2024 tells supervised institutions that, in financial market law, "the technology-neutral, principle-based regulatory requirements for effective governance and risk management cover the risks arising from the use of AI". In section 1, FINMA also expects supervised institutions that use AI to align their governance, risk management and control systems with the effect of AI. See the guidance and its effect in law.

Who does FINMA's AI guidance apply to?

FINMA Guidance 08/2024 is for FINMA-supervised institutions that use AI, with internal and external AI applications. Section 3 identifies "significant differences between the sectors". Two parts of the guidance change how it applies to an institution:

• Section 2.1 assesses governance at institutions "with many or significant applications".
• Section 1 identifies the institution's "size, complexity, structure and risk profile", application materiality and the probability that application risks occur.

See institutions and AI risks and proportionality.

What are the seven FINMA AI governance assessment areas?

FINMA Guidance 08/2024 puts the examples from its supervision in seven areas:

1. Governance (section 2.1)
2. Inventory and risk classification (section 2.2)
3. Data quality (section 2.3)
4. Tests and ongoing monitoring (section 2.4)
5. Documentation (section 2.5)
6. Explainability (section 2.6)
7. Independent review (section 2.7).

FINMA gives information about items that it observed and assessments that it made. Section 2 gives "examples of measures" from its supervision. Some assessments have conditions, such as the limit to material applications in sections 2.5 and 2.7. See the seven areas.

How does FINMA apply proportionality to AI?

In FINMA Guidance 08/2024, section 1, FINMA expects institutions to align governance, risk management and control systems with AI's effect on their risk profile. Section 1 tells institutions that their "size, complexity, structure and risk profile", application materiality and risk probability "must be taken into account". Footnote 2 gives "Possible (non-exhaustive) factors". Section 1 gives the items for the institution and for its applications together. It gives no method to set the depth of the work.

Section 2.1 assesses governance at institutions "with many or significant applications". Sections 2.5 and 2.7 give documentation and independent review assessments for material applications. See proportionality.

What did FINMA assess under AI governance?

In FINMA Guidance 08/2024, section 2.1, FINMA assessed governance at institutions "with many or significant applications":

• a "centrally managed inventory with a risk classification and resulting measures"
• "responsibilities and accountabilities" for "development, implementation, monitoring and use"
• requirements for model tests and "supporting system controls"
• "documentation standards"
• "broad training measures".

For these institutions, in "the case of outsourcing", FINMA also assessed more tests, controls, "contractual clauses" for responsibilities and liability, and if institutions made sure of third parties' "necessary skills and experience". Section 2.1 names no governance unit. It gives no persons, contents or interval for "broad training measures". See governance (section 2.1).

How should AI applications be classified under FINMA guidance?

FINMA Guidance 08/2024, footnote 5, recommends that supervised institutions set classification criteria. Section 2.2 assesses a "sufficiently broad definition of AI", because "traditional applications can also present similar risks". It then assesses inventory "existence and completeness" and application risk classification. FINMA observed that not all institutions had "consistent criteria for identifying applications that require special attention" because of their "materiality, specific risks and probability".

Footnote 2 gives "Possible (non-exhaustive) factors". Footnote 5 identifies uses where risks "tend to be higher".

Footnote 6 refers to the OECD's "definition approach". Footnote 7 identifies application risks: "AI is not a high-risk application per se". Section 2.1 assesses a "centrally managed inventory" at institutions "with many or significant applications". See inventory and risk classification.

Does buying AI software count as outsourcing under FINMA guidance?

A purchased application does not automatically cause all outsourcing measures in FINMA Guidance 08/2024 to apply. Section 2.1 gives no rule that identifies a purchased application as outsourcing. For "externally purchased applications and services", institutions "sometimes had difficulties determining" AI use, data, methods and "whether sufficient due diligence exists".

The outsourcing assessment is for institutions "with many or significant applications". FINMA assessed more tests and controls, "contractual clauses" for responsibilities and liability, and if institutions made sure of the "necessary skills and experience" of third parties. See purchased applications and outsourcing.

What does FINMA assess about AI data quality?

In FINMA Guidance 08/2024, section 2.3, FINMA assessed internal rules and directives for data completeness, correctness, integrity, and "the availability of and access to data". FINMA assessed if this availability and access is "secured". FINMA observed that some institutions had no data quality requirements or controls for AI.

Section 2.3 also gives data quality risks, which are not items in that assessment. For "purchased solutions", institutions "often have no influence on or knowledge of the underlying data". Unstructured data can "make it difficult to assess quality". See data quality (section 2.3).

What testing and monitoring does FINMA assess for AI?

In FINMA Guidance 08/2024, section 2.4, FINMA assessed scheduled tests for data quality and "functionality", with accuracy, robustness, stability and, "if necessary, bias". FINMA also assessed:

• "experts in the respective area of application" with "questions and predefined expectations", and performance indicators set "in advance"
• regular output checks, for example "thresholds or other validation methods"
• monitoring of changes in input data, with "recognition and treatment of data drift"
• "prior consideration to recognising and handling exceptions".

Monitoring also includes "analysing cases in which the output has been ignored or changed by users". Footnote 8 gives test examples. Footnote 9 adds that it is "important to consider fallback mechanisms in order to be prepared if the AI develops in an undesirable direction and no longer fulfils the originally defined objectives". See tests and ongoing monitoring.

How often should AI applications be tested or independently reviewed?

FINMA Guidance 08/2024 gives no specified test or independent review interval. Section 2.4 assesses scheduled tests and regular output checks. Footnote 9 identifies checks "before productive use", on changes and "on an ongoing basis". These checks become more important with a more "essential and complex" application, and less information about how it works or its data.

Section 2.7 gives no independent review approval step before use. See tests and ongoing monitoring and independent review.

Do non-material AI applications need documentation and independent review?

In FINMA Guidance 08/2024, FINMA assessed documentation contents and two independent review items only for material applications. The guidance gives no such items for other applications. Section 1 refers to financial market law: its governance and risk management requirements "cover the risks arising from the use of AI". These limits apply:

• Material applications: documentation contents (section 2.5), independent review "opinion" and use of results in "development of the application" (section 2.7).
• No materiality limit: items that FINMA observed about documentation and independent review (sections 2.5 and 2.7).
• Institutions "with many or significant applications": documentation standards (section 2.1).
• Proportionality: institution "size, complexity, structure and risk profile", application materiality and risk probability (section 1).

See documentation, independent review and proportionality.

When does FINMA assess AI explainability in more depth?

In FINMA Guidance 08/2024, section 2.6, FINMA assessed explainability "in greater depth" where decisions "had to be justified to investors, clients, employees, the supervisory authority or the audit firm". This includes application "drivers" or "behaviour under different conditions", to examine the "plausibility and robustness" of results.

FINMA also observed that results "often cannot be understood, explained or reproduced and therefore cannot be critically assessed". Section 2.6 gives no materiality limit. It does not tell institutions that all decisions "had to be justified" to all these persons. See explainability (section 2.6).

What does FINMA assess in an independent AI review?

In FINMA Guidance 08/2024, section 2.7, FINMA assessed, for material applications, an "objective, informed and unbiased opinion" on the "appropriateness and reliability of a process for a particular application". FINMA also assessed use of independent review results in the "development of the application".

FINMA also "did not observe a clear distinction between the development of AI applications and the independent review in all cases". It observed "only a few supervised institutions" with an "independent review of the entire model development process by qualified personnel". These two observed items have no materiality limit. Section 2.7 gives no structural separation, independent review unit or approval step before use. See independent review (section 2.7).

When should we contact FINMA about a planned AI use?

FINMA's press release of 24 April 2025 recommends contact "in good time" by "authorised institutions" "planning to use AI in critical processes or to calculate regulatory parameters". This information is from the press release, with no time limit or approval procedure.

This recommended contact is not in Guidance 08/2024. The Requirements of OFF-22 and MFF-22 refer only to Guidance 08/2024, and do not include the contact with FINMA. See the press release and contact with FINMA.

How do the FINMA AI Governance Frameworks divide the work in Modulos?

Modulos uses OFF-22 at the Organization level and MFF-22 at the AI System level. Modulos recommends OFF-22 on the organization AI System of the institution, and MFF-22 on one AI System for each AI application that the institution selects. If the institution has no organization AI System, contact Modulos Support before you add OFF-22. Modulos, not FINMA, recommends this structure. FINMA Guidance 08/2024 does not use this Organization and AI System structure.

FINMA Guidance 08/2024 gives conditions for some assessments, such as "with many or significant applications" (section 2.1) and "For material applications" (sections 2.5 and 2.7). See the recommended AI System structure and the Requirements in Modulos.

In what order should we set up FINMA AI Governance?

Modulos recommends the AI inventory and risk classification first, then governance and application work. FINMA Guidance 08/2024 gives no sequence. These parts of the guidance change the work:

• Section 1: institution "size, complexity, structure and risk profile", application materiality and risk probability.
• Section 2.1: purchased applications are not automatically outsourcing. The outsourcing assessment is for institutions "with many or significant applications".
• Sections 2.5 and 2.7: assessments for material applications do not remove other applications from governance and risk management.
• Section 2.6: explainability "in greater depth" where decisions "had to be justified to investors, clients, employees, the supervisory authority or the audit firm".

See the recommended work sequence.

Can we reuse work from an ISO 42001 or EU AI Act program?

Modulos recommends that you compare your ISO 42001 or EU AI Act work with FINMA Guidance 08/2024 and the conditions for each assessment. A mapping between Frameworks does not show that your work is sufficient or that the instruments are equivalent. See the recommended work sequence and Control overlap.

Has FINMA Guidance 08/2024 changed?

On 14 October 2026, FINMA's "FINMA Guidance" source showed "Updated: 18.12.2024" for Guidance 08/2024. This entry does not show if FINMA gave subsequent AI expectations. Section 3 gives no date for changes to expectations.

These FINMA items give different information: the press release of 24 April 2025, Guidance 02/2026 (9 April 2026), and Circular 2016/7 (press release, 8 October 2026). They do not identify changes to Guidance 08/2024. See related sources for the institutions that they apply to and their dates.

Does FINMA Guidance 08/2024 set a compliance deadline or fines?

FINMA Guidance 08/2024 gives no AI-specific penalty and no date for compliance. FINMA's "FINMA Guidance" source tells supervised institutions that FINMA guidance "does not have legal impact". This does not remove AI applications from financial market law or from supervision. Section 1 tells supervised institutions that the requirements of financial market law for governance and risk management "cover the risks arising from the use of AI". See the guidance and its effect in law.