Appearance
Use FINMA AI Governance in Modulos
Recommended AI System structure
For FINMA Guidance 08/2024, Modulos has the FINMA AI Governance Framework at two levels:
OFF-22at the Organization level. You add it to the organization AI System of your institution. If your institution has no organization AI System, contact Modulos Support before you addOFF-22.MFF-22at the AI System level. You add it to one AI System for each AI application that you select.
Modulos recommends this structure. FINMA Guidance 08/2024 does not give this structure. For more information about the guidance and the institutions that it is for, see The guidance and the law and Institutions and AI risks. To add a Framework to an AI System, see Register an AI System and Frameworks in Modulos.
Requirement mapping
For FINMA Guidance 08/2024, Modulos uses the Requirements below. The ORF codes are in OFF-22 (Organization) and the MRF codes are in MFF-22 (AI System).
FINMA expects institutions that use AI to align governance, risk management, and control systems with the effect of AI on their risk profile (section 1). All Requirements below use section 1. For proportionality at the institution and application levels, see Proportionality.
| Requirement | Requirement name | Sections of Guidance 08/2024 | Information |
|---|---|---|---|
ORF-439 | Proportionate AI governance framework | Sections 1 and 2.1 | Proportionality, Governance (§2.1) |
ORF-440 | AI roles, responsibilities and accountabilities | Sections 1 and 2.1 | Governance (§2.1) |
ORF-441 | AI documentation standards | Sections 1, 2.1, and 2.5 | Governance (§2.1), Documentation (§2.5) |
ORF-442 | AI competence and training | Sections 1 and 2.1 | Governance (§2.1) |
ORF-443 | Outsourcing and third-party AI governance | Section 1, the start of section 2, and section 2.1 | Purchased applications and outsourcing (§2.1) |
ORF-444 | AI inventory, scope and risk classification | Sections 1, 2.1, and 2.2, with footnotes 2 and 5–7 | Inventory and risk classification (§2.2), Governance (§2.1) |
ORF-445 | Data quality standards for AI | Sections 1 and 2.3 | Data quality (§2.3) |
ORF-446 | Independent review of AI models | Sections 1 and 2.7 | Independent review (§2.7) |
MRF-407 | Per-use-case risk classification | Sections 1 and 2.2 | Inventory and risk classification (§2.2) |
MRF-408 | Testing and ongoing monitoring | Sections 1 and 2.4, with footnotes 8–10 | Tests and ongoing monitoring (§2.4) |
MRF-409 | Documentation of material applications | Sections 1, 2.2, and 2.5 | Documentation (§2.5) |
MRF-410 | Explainability of AI applications | Section 1, the start of section 2, and section 2.6 | Explainability (§2.6) |
MRF-411 | Independent review of material applications | Section 1, the start of section 2, and section 2.7 | Independent review (§2.7) |
MRF-412 | Third-party AI assurance for the use case | Section 1, the start of section 2, and section 2.1 | Purchased applications and outsourcing (§2.1) |
For the FINMA AI Governance Controls that other Frameworks also use, see Control overlap.
Recommended work sequence
For FINMA Guidance 08/2024, Modulos recommends the sequence of work below. FINMA does not give a sequence. Section 2 of the guidance gives examples from supervision by FINMA.
Identify your AI applications and their risk classification. Use a "sufficiently broad definition of AI" for the AI inventory of your institution. Set the classification criteria of your institution. Give each application a risk classification with these classification criteria. See Inventory and risk classification (§2.2).
Add the Frameworks. Add
OFF-22to the organization AI System. Make one AI System for each AI application from step 1 that you want to include in Modulos. AddMFF-22to each of these AI Systems. See Recommended AI System structure.Select governance measures and rules for data quality. Use Proportionality for your institution and each application. For institutions "with many or significant applications", see the governance assessment (§2.1). Prepare internal rules and directives for data quality (§2.3).
Check purchased applications for outsourcing. Identify the "externally purchased applications and services" of your institution. Check if they include outsourcing. FINMA's outsourcing assessment is for institutions "with many or significant applications" (see Purchased applications and outsourcing (§2.1)).
Prepare the work for each AI application. In the guidance, the conditions are different for each of these parts:
- Tests and ongoing monitoring. Prepare tests and ongoing monitoring (§2.4), with bias checks "if necessary".
- Documentation. For material applications, compare your documentation with Documentation (§2.5).
- Explainability. Where decisions "had to be justified to investors, clients, employees, the supervisory authority or the audit firm", FINMA assessed explainability "in greater depth" (see Explainability (§2.6)).
- Independent review. For material applications, compare your independent review with Independent review (§2.7).
For material applications, FINMA assessed the documentation and the independent review. The materiality condition does not remove other applications from the governance and risk management of your institution.
Compare your work for other Frameworks with the guidance. If your institution uses other Frameworks in Modulos, compare that work with Guidance 08/2024. A Control that other Frameworks also use does not show that your work is sufficient for the guidance. It also does not show that the rules of those Frameworks and the guidance are equivalent. Find the work that is missing. Do this work.
Contact with FINMA
FINMA's 24 April 2025 press release recommends contact "in good time" by "authorised institutions" "planning to use AI in critical processes or to calculate regulatory parameters". This recommended contact is in the press release, not in FINMA Guidance 08/2024.
The Requirements of OFF-22 and MFF-22 refer only to sections of Guidance 08/2024. Thus, these Requirements do not include the contact with FINMA.
Related information
For more information about FINMA Guidance 08/2024 and Modulos, see below.
FINMA AI Governance overview
The guidance, the institutions that it is for, and its dates
Governance, inventory, and data quality
Sections 1 and 2.1 to 2.3 of the guidance
Testing, monitoring, documentation, and review
Sections 2.4 to 2.7 of the guidance
FINMA AI Governance questions
Short information about FINMA Guidance 08/2024 and the Frameworks in Modulos
Governance operating model
How AI Systems, Requirements, Controls, and Evidence work together
Reviews & Statuses
How Controls change and how a Requirement Owner does the Review of a Requirement
Control overlap
The Controls that two or more Frameworks use
Sources
- FINMA Guidance 08/2024 — "Governance and risk management when using artificial intelligence", FINMA, 18 December 2024. Sections 1, 2, and 2.1 to 2.7, with footnotes 2 and 5 to 10. FINMA Guidance 08/2024 (PDF).
- FINMA press release — "FINMA survey: artificial intelligence gaining traction at Swiss financial institutions", FINMA, 24 April 2025. Last section. FINMA news.
Disclaimer
This page gives general information. It is not legal advice.