SwitzerlandFINMA · 08/2024Version 1.023 October 2026
FINMA Guidance 08/2024 on AI, expectation by expectation
FINMA Guidance 08/2024, published on 18 December 2024, sets out what FINMA observed in supervising institutions that use artificial intelligence and what it assessed: AI governance with a central inventory and risk classification, data quality, tests and ongoing monitoring, documentation, explainability and independent review. It creates no AI-specific rule; it applies the existing technology-neutral requirements for governance and risk management. This page maps each area to the control and the evidence that answer it, read in FINMA's primary sources on 23 October 2026.
On this page
Supervisory practice, written down. Proportionate by design.
In this page, "we" means Hikari Blue, which engineers and operates the AI operating layer for institutions in Switzerland, the United States and France. The mapping of FINMA's areas to controls is ours; FINMA has not reviewed it.
FINMA states that Switzerland has, to date, no AI-specific legislation, and that the technology-neutral, principle-based requirements of financial market law for governance and risk management cover the risks of AI. The measures in its guidance are examples observed in ongoing supervision, in supervisory discussions and in initial on-site reviews.
Proportionality runs through the text: size, complexity, structure and risk profile of the institution, the materiality of each AI application and the probability that its risks materialize. FINMA adds that AI is not a high-risk application per se, and that risks tend to be higher when AI serves compliance with supervisory law, performs critical functions or strongly affects customers or employees.
Mostly operational: the model, the IT, the third party, the responsibility.
Model risks
Lack of robustness, correctness, bias and explainability. FINMA observed that institutions focus on data protection risks and less on model risks.
IT and cyber risks
Named with model risks as the core of the operational risk of AI. FINMA's press release adds data-related risks: security, quality and availability of data.
Dependence on third parties
A growing dependence on providers of hardware, models and cloud services, in an increasingly concentrated market.
Legal, reputational and responsibility risks
Challenges in allocating responsibilities, because AI systems act autonomously, are difficult to explain and responsibilities are scattered.
What FINMA found, what it assessed, and what answers it.
Read each row from left to right: the area of section 2 of the guidance, what FINMA found in supervision, what it assessed, and the control and evidence an institution can show. The control identifiers are those of our published governance framework.
Mapping prepared by Hikari Blue, not reviewed by FINMA. It is neither legal advice nor a guarantee of compliance.
| Area | What FINMA found | What FINMA assessed | Control and evidence |
|---|---|---|---|
| 2.1 Governance | A focus on data protection, less on model risks; difficulty telling whether bought-in products contain AI. | AI governance with a centrally managed inventory, a risk classification and the resulting measures; for outsourcing, added tests, controls and contractual clauses on responsibility and liability. | GOV-P-01 use-case register; named accountable executive and AI risk owner. Evidence: the register with signed classifications, and the contract clauses. |
| 2.2 Inventory and risk classification | Some institutions defined AI narrowly, to focus on supposedly larger or new risks. | A sufficiently broad definition of AI, since traditional applications can present similar risks; FINMA points to the OECD definition. | One register for every AI use, bought-in and embedded included, reconciled with procurement and the agent register. Evidence: the reconciliation. |
| 2.3 Data quality | Some institutions set no requirements or controls on data quality; with purchased products, they often know nothing of the underlying data. | Requirements ensuring data is complete, correct and of integrity, and that its availability and access are secured. | Data requirements written in each register entry; the inputs reference field shows which data each decision read. Evidence: the entry and a record export. |
| 2.4 Tests and ongoing monitoring | Weaknesses in the choice of performance indicators, in tests and in ongoing monitoring. | Tests covering accuracy, robustness and stability and, where needed, bias; monitoring of input data for drift. | Evaluation set run before production; GOV-E-03 monitoring against declared thresholds, each incident recorded. Evidence: results and the incident register. |
| 2.5 Documentation | No central documentation requirements at some institutions, and documentation not detailed or recipient-oriented enough. | For material applications: purpose, data selection and preparation, model selection, performance measures, assumptions, limitations, testing and controls, and fallback options. | GOV-P-04 instructions for use per system, versioned with the model; GOV-P-03 routing table with a primary model and a fallback. Evidence: the file and the table. |
| 2.6 Explainability | Results often cannot be understood, explained or reproduced, and so cannot be critically assessed. | Explainability in greater depth where decisions must be justified to investors, clients, employees, the supervisory authority or the audit firm. | The 9-field record: model and version, inputs, policy and human verification for each decision. Evidence: the export of one past decision. |
| 2.7 Independent review | Only a few institutions have qualified personnel review the entire model development process independently. | A review giving an objective, informed and unbiased opinion on the appropriateness and reliability of a process for a given application. | Held outside the build team. We supply what the reviewer needs: register, tests, record exports. The review stays with the second line or internal audit. |
Area headings and the findings follow section 2 of the guidance; the wording is paraphrased, the EN and FR PDFs govern. FINMA writes in its outlook that it will refine its expectations and, where necessary, make them transparent in the market.
About half of surveyed institutions use AI, and most are early.
FINMA published a survey on 24 April 2025, covering around 400 licensed banks and securities firms among other categories. Its press release on the guidance had already noted that most financial institutions are in the early stages, with governance and risk management structures still being established.
| Finding | Figure |
|---|---|
| Institutions using AI or with initial applications in development | About 50% |
| Institutions intending to use AI in the next 3 years | A further 25% |
| Applications per respondent, on average | About 5 in use, 9 in development |
| AI users also using generative AI | 91% |
| Institutions with an explicit AI strategy | About 50% |
FINMA recommends that institutions planning to use AI in critical processes or to calculate regulatory parameters contact it in good time. Its Annual Report 2025, published on 21 April 2026, notes that AI is more widespread among insurers than among banks and that generative AI brings an increasing dependence on external service providers.
No AI act in Switzerland yet. Data protection already applies.
| Text or decision | What it says | Status |
|---|---|---|
| Federal Act on Data Protection, SR 235.1 | Article 21: inform the person of a decision based exclusively on automated processing with legal or considerably adverse effect, and allow review by a natural person on request. Article 21(3) lifts both duties where the decision is directly connected with concluding or performing a contract and the person's request is granted, or where the person has expressly consented. Article 22: impact assessment before high-risk processing. | In force since 1 September 2023 |
| FDPIC statement, updated 8 May 2025 | The data protection act is directly applicable to AI-supported processing: purpose, functioning and data sources made transparent; right to object and to human review. | Published guidance |
| Federal Council decision, 12 February 2025 | Ratify the Council of Europe AI Convention; amend law sector by sector where needed; develop legally non-binding measures. The FDJP drafts a consultation bill by the end of 2026. | To our knowledge, as of 25 October 2026, no consultation has been opened |
| Council of Europe Convention, CETS No. 225 | Framework convention on AI and human rights, democracy and the rule of law; applies primarily to state actors under the Federal Council's approach. | Signed by Switzerland on 27 March 2025; not ratified and not in force on the Council of Europe chart of 23 October 2026 |
An institution with business in the European Union can also fall under the EU AI Act, whose scope reaches providers outside the Union and output used in the Union. This is not legal advice.
90 days on one material application, area by area.
We install the governance framework on one AI application already in use, then extend it. Each block closes on evidence that answers named areas of the guidance.
- 01
Days 1 to 30 · inventory and classification
Register every AI use, bought-in included, under a broad definition; classify each on materiality and probability; name the accountable executive and the AI risk owner.
Evidence: register and classifications (2.1, 2.2), decision rights, outsourcing clauses.
- 02
Days 31 to 60 · controls on the first application
Write the data requirements and the instructions for use, run the evaluation set, start the record and the monitoring thresholds.
Evidence: data requirements (2.3), test results and monitoring (2.4), documentation file (2.5), first record export (2.6).
- 03
Days 61 to 90 · review pack
Hand the second line or internal audit a review pack built from the register, the tests and the record, and set the cadence for the next applications.
Evidence: review pack for the independent review (2.7), cadence and owner for each next application.
The 90 days are those of the adoption path of our governance framework. Extending it depends on the number of applications and their materiality, not on the guidance.
The questions asked about FINMA Guidance 08/2024.
Is FINMA Guidance 08/2024 binding?
No. It states supervisory expectations and creates no new rule. What binds supervised institutions are their existing legal and prudential obligations on governance and risk management, for banks in particular FINMA Circular 2023/1 on operational risks and resilience, in force since 1 January 2024. The guidance sets out how FINMA expects those obligations to be met when AI is used.
Does FINMA require an AI inventory?
FINMA assessed whether institutions with many or significant applications have AI governance including a centrally managed inventory with a risk classification and the resulting measures, under a sufficiently broad definition of AI.
Does FINMA treat AI as high-risk?
Not per se. FINMA writes that AI is not a high-risk application per se, and that risks tend to be higher when AI is used to comply with supervisory law, to perform critical functions, or when customers or employees are strongly affected by its results.
What does FINMA expect for AI bought from a vendor?
That the institution knows whether a product contains AI, which data and methods it uses and whether due diligence is sufficient. For outsourcing, FINMA assessed added tests, controls and contractual clauses on responsibility and liability, and the skills of the third party.
How does the guidance relate to the EU AI Act?
They are separate. The guidance applies Swiss financial market law; the EU AI Act is an EU regulation that reaches a Swiss institution only when it places AI systems on the EU market or when their output is used in the Union. The same register, tests and record can serve both.
Is a Swiss AI law coming?
The Federal Council decided on 12 February 2025 to ratify the Council of Europe AI Convention and to amend Swiss law sector by sector where needed. The FDJP is to draft a bill for consultation by the end of 2026. To our knowledge, as of 25 October 2026, no consultation has been opened.
Reference documents and primary sources.
Every finding, date and status on this page comes from the sources below, read on 23 October 2026.
Reference documents
- Enterprise AI Governance Framework v1.0 15 controls with owners, cadences, evidence and EU AI Act hooks. CC BY 4.0.
- AI Operating Layer Reference Architecture v1.0 4 planes, 4 testable controls and the 9-field record.
- AI audit trail: definition and EU AI Act mapping The 9 fields of the record, mapped to Articles 12, 19 and 26.
- Financial services The operating layer in banking, insurance and asset management.
- The EU AI Act for Swiss companies When the EU regulation reaches a company established in Switzerland, and what it requires.
Primary sources, consulted on 23 October 2026
- FINMA Guidance 08/2024 · Governance and risk management when using artificial intelligence (opens in a new tab) 18 December 2024, in English. Sections 1 to 3. PDF.
- Communication FINMA sur la surveillance 08/2024 · Gouvernance et gestion des risques en lien avec l’utilisation de l’intelligence artificielle (opens in a new tab) 18 December 2024, in French. PDF.
- FINMA · Press release on Guidance 08/2024 (opens in a new tab) 18 December 2024: early stage of most institutions, data-related risks.
- FINMA · Survey: artificial intelligence gaining traction at Swiss financial institutions (opens in a new tab) 24 April 2025: use, strategy, generative AI, early contact with FINMA.
- FINMA · Annual Report 2025, digital strategy and digitalisation (opens in a new tab) Published 21 April 2026: insurers and banks, dependence on external providers.
- FINMA Circular 2023/1 · Operational risks and resilience, banks (opens in a new tab) Dated 7 December 2022, in force since 1 January 2024: operational risk management, ICT and cyber risks, critical data, operational resilience. PDF.
- Circulaire FINMA 2023/1 · Risques et résilience opérationnels, banques (opens in a new tab) The same circular, in French. PDF.
- Federal Council · AI regulation: Federal Council to ratify Council of Europe Convention (opens in a new tab) Press release of 12 February 2025: approach, objectives and next steps.
- Council of Europe · Chart of signatures and ratifications of Treaty 225 (opens in a new tab) Status as of 23 October 2026: Switzerland signed on 27 March 2025.
- Fedlex · Loi fédérale sur la protection des données (LPD), RS 235.1 (opens in a new tab) Article 21, including the exceptions of paragraph 3, and Articles 22 and 25; in force since 1 September 2023.
- FDPIC · Current data protection legislation is directly applicable to AI (opens in a new tab) Update of 8 May 2025.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "FINMA Guidance 08/2024 on AI, expectation by expectation v1.0", 23 October 2026, https://hikariblue.com/switzerland/finma-ai-governance
Section anchors are stable: #status, #risks, #areas, #market, #swiss-law, #implementation, #faq, #references, #cite.
Changelog
v1.0 · 23 October 2026. First public version.
Editorial correction · 25 October 2026: license extended to this page (CC BY 4.0).
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Place one AI application against the 7 areas.
30 minutes with a named partner. We take one AI application your institution runs today and show, area by area, which evidence exists, which is rebuilt by hand and which is missing before the next supervisory review. You leave with that map, whether or not we work together.
- One application, mapped to the 7 areas
- The evidence that exists, and what is missing
- Who should own each gap