Governance, Inventory and Risk Classification, and Data Quality

FINMA Guidance 08/2024, "Governance and risk management when using artificial intelligence", has the date 18 December 2024. The sections below give its section 1 on proportionality and its sections 2.1 to 2.3 on governance, inventory and risk classification, and data quality. FINMA's "FINMA Guidance" source tells supervised institutions that FINMA guidance "does not have legal impact" (Legal effect of the guidance).

Proportionality

In FINMA Guidance 08/2024 section 1, FINMA "expects supervised institutions that use AI to actively consider the impact of this use on their risk profile and to align their governance, risk management and control systems accordingly".

In section 1, FINMA tells supervised institutions: "Besides the size, complexity, structure and risk profile of the supervised institutions, the materiality of the AI applications used and the probability that the risks resulting from the use of these applications will materialise must be taken into account."

Section 1 gives no method to set how far an institution aligns its governance, risk management and control systems. For the possible "factors" in footnote 2, see Materiality and probability.

Governance (§2.1)

In FINMA Guidance 08/2024 section 2.1, FINMA observed three items about AI governance at supervised institutions. FINMA also assessed if supervised institutions "with many or significant applications" have AI governance, and it assessed these institutions in "the case of outsourcing".

FINMA observed that supervised institutions "focus primarily on data protection risks, but less on model risks such as lack of robustness and correctness, bias, lack of stability and explainability". FINMA also observed that "the development of AI applications is often decentralised, making it challenging to implement consistent standards, assign responsibilities clearly to employees with the appropriate skills and experience and address all relevant risks". For the observed item about purchased applications, see Purchased applications and outsourcing.

FINMA assessed "whether supervised institutions with many or significant applications have AI governance in place". In section 2.1, the AI governance that FINMA assessed includes these items:

• "a centrally managed inventory with a risk classification and resulting measures"
• "the definition of responsibilities and accountabilities for the development, implementation, monitoring and use of AI"
• "requirements for model testing and supporting system controls"
• "documentation standards"
• "broad training measures"

The condition "with many or significant applications" applies to all of these items.

For the "broad training measures", section 2.1 does not give these items:

• the persons who receive these measures
• the contents of these measures
• the levels of these measures
• an interval for these measures
• a result of these measures

Section 2.1 does not refer to a governance group in the institution. It also gives no rule about how to record the AI governance or how to make it available to other persons.

Purchased applications and outsourcing

In FINMA Guidance 08/2024 section 2.1, FINMA observed one item about purchased applications. "In the case of externally purchased applications and services", the supervised institutions "sometimes had difficulties determining" these items:

• "whether AI is included"
• "which data and methods are used"
• "whether sufficient due diligence exists"

Section 2.1 assesses supervised institutions "with many or significant applications". For these institutions, in "the case of outsourcing", FINMA assessed:

whether the supervised institutions had implemented additional tests, controls and contractual clauses governing responsibilities and liability issues and ensured that the third parties entrusted with the outsourcing had the necessary skills and experience.

The first part of section 2.1 identifies the observed item about purchased applications. The next part contains the outsourcing assessment. Section 2.1 does not identify a purchased application as outsourcing. The outsourcing items do not apply only because an institution uses a purchased application. The "necessary skills and experience" of the third parties are a different item from the "broad training measures" of the governance items.

Inventory and risk classification (§2.2)

In FINMA Guidance 08/2024 section 2.2, FINMA observed three items about AI inventories and risk classification, and assessed three items.

FINMA observed these items:

• Some supervised institutions "defined AI narrowly in order to focus on supposedly larger or new risks".
• "For many supervisors, it was a challenge to ensure the completeness of inventories". Section 2.2 gives two causes: "AI development and use is often widely spread across the organisation", and "since the advent of generative AI, applications are accessible to everyone".
• "not all supervised institutions had established consistent criteria for identifying applications that require special attention in risk management due to their materiality, specific risks and probability of these materialising"

FINMA assessed "whether the supervised institutions had a sufficiently broad definition of AI". The cause in section 2.2 is that "traditional applications can also present similar risks and the same risks must be addressed in the same way".

FINMA then assessed these items:

• "the existence and completeness of AI inventories"
• "the risk classification of AI applications"

Footnote 6 refers to "the OECD's definition approach" in the OECD "Explanatory Memorandum on the Updated OECD Definition of an AI System" (March 2024). Section 2.2 does not make this "approach" the "definition of AI" for supervised institutions, and it does not tell institutions to compare their "definition of AI" with it.

A "centrally managed inventory" is one of the section 2.1 governance items for supervised institutions "with many or significant applications" (see Governance (§2.1)). Section 2.2 does not add this item to the items that FINMA assessed in section 2.2.

Classification criteria

FINMA Guidance 08/2024 footnote 5 tells supervised institutions: "The criteria for classification should be defined by the supervised institutions." Footnote 5 also gives this information: "Risks tend to be higher when AI is used to comply with supervisory law or to perform critical functions, or when customers or employees are strongly affected by its results." Footnote 5 does not give a risk category to each of these uses.

FINMA Guidance 08/2024 footnote 7 tells supervised institutions: "AI is not a high-risk application per se." Footnote 7 also gives this information: "The risk associated with it depends on the complexity, adaptivity and autonomy of the respective application, its area of application and its integration into processes."

Section 2.2 gives no interval to examine the classification criteria of an institution again. In section 2.5, in its assessment of the documentation of material applications, FINMA "considered" if supervised institutions "carry out an appropriate categorisation into a risk category and the associated justification and review" (see Documentation (§2.5)).

Materiality and probability

Footnote 2 to section 1 of FINMA Guidance 08/2024 gives "Possible (non-exhaustive) factors that influence the materiality of an application". It also gives "Possible (non-exhaustive) factors that influence the probability of the events associated with the risks materialising". For some probability "factors", footnote 2 also gives examples.

Group	Possible "factors"	More information in footnote 2
Materiality	"Significance for compliance with financial market legislation"	None
Materiality	"financial impact on the company"	None
Materiality	"legal and reputational risks"	None
Materiality	"relevance of the product for the company"	None
Materiality	"number of clients or investors affected"	None
Materiality	"types of clients or investors"	"retail/institutional"
Materiality	"importance of the product for clients or investors"	None
Materiality	"consequences of errors or failure"	None
Probability	"Complexity"	For example, "explainability, predictability"
Probability	"type and amount of data used"	For example, "unstructured data, integrity, appropriateness, personal data"
Probability	"unsuitable development or monitoring processes"	None
Probability	"degree of autonomy and process integration"	None
Probability	"dynamics"	For example, "short calibration cycles"
Probability	"linkage of several models"	None
Probability	"potential for attacks or failures"	For example, "increased due to outsourcing"

Data quality (§2.3)

In FINMA Guidance 08/2024 section 2.3, FINMA observed one item about data quality, gave data risks, and assessed one item.

FINMA observed that some supervised institutions "have not defined any requirements or controls to ensure data quality for AI applications".

Section 2.3 gives these data risks:

• AI applications "often learn from data automatically and without human intervention". Section 2.3 then tells supervised institutions: "Data quality is therefore often more important than the selection of the specific model."
• Data "can be incorrect, inconsistent, incomplete, unrepresentative or outdated and therefore of poor quality".
• "Historical data may contain a bias that is carried forward into future forecasts, or it may no longer be representative of the forecast due to a change in the environment."
• "In the case of purchased solutions, the supervised institutions often have no influence on or knowledge of the underlying data." Section 2.3 tells supervised institutions that this "can lead to these not being suitable for the supervised institutions or the specific issue and the risk of the unconscious use of deliberately manipulated data increasing".
• "Since the increased use of AI, more unstructured data such as texts and images are also being analysed, which can make it difficult to assess quality."

FINMA assessed "whether the supervised institutions have defined requirements in their internal rules and directives to ensure that data is complete, correct and of integrity and that the availability of and access to data is secured". Section 2.3 names no other items in that assessment, and the data risks above are not items in it.

Related information

For FINMA Guidance 08/2024 sections 2.4 to 2.7, see Testing, Monitoring, Documentation, and Review. For the FINMA AI Governance Requirements in Modulos, see Use FINMA AI Governance in Modulos. For the FAQ about FINMA Guidance 08/2024, see Frequently Asked Questions. For the effect of FINMA Guidance 08/2024 and for other FINMA guidance, see FINMA AI Governance.

Sources

• FINMA Guidance 08/2024 — FINMA, "Governance and risk management when using artificial intelligence", 18 December 2024. Sections 1, 2.1, 2.2, 2.3 and 2.5, and footnotes 2, 5, 6 and 7. FINMA PDF.
• FINMA's "FINMA Guidance" source — FINMA, "FINMA Guidance", Introduction. FINMA.

Disclaimer

This page gives general information. It is not legal advice.