Docs

Appearance

Testing and Ongoing Monitoring, Documentation, Explainability, and Independent Review ​

Sections 2.4 to 2.7 of FINMA Guidance 08/2024 of 18 December 2024 are about tests, ongoing monitoring, documentation, explainability and independent review. FINMA's "FINMA Guidance" source tells supervised institutions that FINMA guidance "does not have legal impact" (see FINMA AI Governance).

In FINMA Guidance 08/2024, section 1 gives "factors" that "must be taken into account" when institutions align governance, risk management and control systems (see Proportionality).

Tests and ongoing monitoring (§2.4) ​

In FINMA Guidance 08/2024, section 2.4, FINMA "observed weaknesses in the selection of performance indicators, tests and ongoing monitoring at some of the supervised institutions".

In section 2.4, FINMA assessed these items:

  • "whether the supervised institutions schedule tests to ensure the data quality and functionality of the AI applications, which include checks for accuracy, robustness and stability and, if necessary, bias".
  • "whether experts in the respective area of application provided questions and predefined expectations".
  • "whether performance indicators were defined in advance in order to assess how well an AI application achieves the set goals". Section 2.4 does not identify the person who sets these performance indicators.
  • For "regular checks to be carried out", FINMA "assessed, for example, whether the supervised institutions had defined thresholds or other validation methods to ensure the correctness and ongoing quality of the outputs".
  • "whether the supervised institutions monitor changes in input data to ensure that models remain applicable in a changing environment". This monitoring includes the "recognition and treatment of data drift".
  • "whether the supervised institutions give prior consideration to recognising and handling exceptions".

In section 2.4, monitoring also includes "analysing cases in which the output has been ignored or changed by users, as such manual corrections can provide information about weaknesses".

Footnote 10 gives examples of methods that "can contribute" to the regular checks: "Sampling, backtesting, predefined test cases or benchmarking".

Test examples (footnote 8) ​

FINMA Guidance 08/2024, footnote 8, gives these examples of tests "to assess the performance and results of an application":

  • "tests in which the user knows the correct result and checks whether the application delivers it", for example backtesting and out-of-sample testing.
  • "constructed tests to understand how the application behaves in certain borderline cases", for example sensitivity analyses or stress testing.
  • Tests with incorrect input data, for example adversarial testing.
  • Tests against "additional, possibly simpler benchmark models".
  • Tests "to assess potential application limits and to check results for “repeatability”".

Footnote 8 makes none of these tests necessary.

Times to examine the application, and fallback mechanisms (footnote 9) ​

In FINMA Guidance 08/2024, section 2.4, the item on performance indicators has footnote 9. Footnote 9 tells institutions when it is "more important" to examine "whether the application is working according to its purpose". The more "essential and complex" the application is, and the less "is known about how the system works or the underlying data", the more important it is to examine the application.

Footnote 9 identifies when to examine the application: "before productive use", "in the event of changes" and "on an ongoing basis". For the time "on an ongoing basis", footnote 9 gives this cause: "especially due to the adaptive nature of today’s applications". Footnote 9 gives no interval.

Footnote 9 also tells institutions: "It is also important to consider fallback mechanisms in order to be prepared if the AI develops in an undesirable direction and no longer fulfils the originally defined objectives."

Documentation (§2.5) ​

In FINMA Guidance 08/2024, section 2.5, FINMA observed two items:

  • Some supervised institutions "do not have centralised documentation requirements".
  • "some of the existing documentation is not sufficiently detailed and recipient-oriented".

In section 2.1, documentation standards are part of the AI governance that FINMA assessed at supervised institutions "with many or significant applications" (see Governance (§2.1)).

For material applications, FINMA "assessed whether the supervised institutions address" these items "in the documentation":

  • "the purpose of the application"
  • "data selection and preparation"
  • "model selection"
  • "performance measures"
  • "assumptions"
  • "limitations"
  • "testing and controls"
  • "fallback solutions"

For material applications, FINMA also "considered" these items:

  • For the selection of data, "whether the supervised institutions presented data sources and data quality checks including integrity, correctness, appropriateness, relevance, bias and stability".
  • "how the supervised institutions ensure the robustness, reliability and traceability of the application".
  • "whether they carry out an appropriate categorisation into a risk category and the associated justification and review".

In section 2.5, FINMA "considered" this "justification and review" of the risk category for material applications. Section 2.2 gives no interval for a check of the classification criteria of the institution (see Inventory and risk classification (§2.2)).

Section 2.5 gives these documentation items only for material applications. It does not give documentation items for other applications or tell institutions how much documentation to prepare for them. This assessment limit does not remove other applications from the governance and risk management requirements in section 1.

Explainability (§2.6) ​

In FINMA Guidance 08/2024, section 2.6, FINMA observed that results "often cannot be understood, explained or reproduced and therefore cannot be critically assessed".

Section 2.6 then gives a condition. Where decisions "had to be justified to investors, clients, employees, the supervisory authority or the audit firm", FINMA assessed the explainability of the applications "in greater depth". Section 2.6 adds that this "includes understanding the drivers of the applications or the behaviour under different conditions in order to be able to assess the plausibility and robustness of the results".

Section 2.6 does not use materiality as the condition for explainability "in greater depth".

Independent review (§2.7) ​

In FINMA Guidance 08/2024, section 2.7, FINMA observed two items:

  • FINMA "did not observe a clear distinction between the development of AI applications and the independent review in all cases".
  • "only a few supervised institutions carry out an independent review of the entire model development process by qualified personnel in order to consistently identify and reduce model risks".

Section 2.7 does not use materiality as a condition for these two observed items.

For material applications, FINMA assessed two items:

  • "whether the independent review included the submission of an objective, informed and unbiased opinion on the appropriateness and reliability of a process for a particular application".
  • "whether the results of the independent review were taken into account in the development of the application".

In section 2.7, FINMA assessed the "opinion" and the use of the "results of the independent review" only for material applications. This does not remove other applications from governance and risk management requirements.

Section 2.7 gives no structure for the "clear distinction between the development of AI applications and the independent review". Section 2.7 also gives no governance unit or interval for the independent review, and no approval step for it. Section 2.7 gives no rule for the depth of the independent review.

The last observed item refers to an independent review "of the entire model development process by qualified personnel". The two assessed items do not. In footnote 9, "before productive use" is a time to examine the application in section 2.4 (see footnote 9). Section 2.7 gives no such time for the independent review.

Sources ​

  • FINMA Guidance 08/2024 — FINMA, "Governance and risk management when using artificial intelligence", 18 December 2024: sections 1, 2.1, 2.2 and 2.4 to 2.7, and footnotes 8 to 10. FINMA PDF.
  • FINMA's "FINMA Guidance" source — FINMA, "FINMA Guidance". The part that starts "Published infrequently". FINMA.

Disclaimer

This page gives general information. It is not legal advice.