FINMA Guidance 08/2024Switzerland

AI governance & risk management

FINMA Guidance 08/2024 sets out what FINMA assessed in supervising the use of AI, in seven areas: governance, inventory and risk classification, data quality, testing and monitoring, documentation, explainability and independent review. It creates no new legal obligations.

Key points

01
Published 18 December 2024 as FINMA guidance: not a regulatory instrument and without legal effect, but a description of what FINMA assessed in supervisory discussions and on-site reviews.
02
Switzerland has no AI-specific legislation; FINMA states that the technology-neutral, principle-based governance and risk management requirements of financial market law cover the risks from AI.
03
FINMA sees the risks mainly as operational: model risks (robustness, correctness, bias, explainability), IT and cyber risks, growing dependence on third parties in a concentrated market, legal and reputational risks, and unclear responsibilities.
04
Seven areas: governance; inventory and risk classification; data quality; tests and ongoing monitoring; documentation; explainability; independent review.
05
AI is not high-risk per se: risk depends on complexity, adaptivity, autonomy, area of application and process integration; classification criteria are set by the institution.
06
In April 2025, after a survey of around 400 institutions, FINMA reported that around 50% use AI or have applications in development and recommended contacting FINMA in good time before using AI in critical processes or to calculate regulatory parameters.

Status

Published 18 December 2024. As FINMA guidance it has no entry into force: according to FINMA, guidance – unlike ordinances and circulars – is not a regulatory instrument and has no legal effect; it serves the proper application of the rules in practice. The binding basis is the technology-neutral, principle-based governance and risk management requirements of Swiss financial market law, which FINMA states also cover AI risks. As at 13 October 2026 no FINMA circular and none of FINMA’s guidance published up to 05/2026 replaces it.

What it requires

01
AI governance and accountability
For institutions with many or significant applications, FINMA assessed whether AI governance includes a centrally managed inventory with risk classification and resulting measures, defined responsibilities for development, implementation, monitoring and use, model testing requirements and supporting system controls, documentation standards and broad training (section 2.1). For outsourcing, it assessed additional tests and controls, contractual clauses on responsibility and liability, and the third party’s skills and experience.
02
Inventory and risk classification
FINMA assessed whether the definition of AI is broad enough – traditional applications can carry similar risks, and the same risks are to be treated the same way – and whether AI inventories exist, are complete and classify applications by risk (section 2.2). FINMA refers to the OECD’s definition approach for AI systems.
03
Data quality
FINMA assessed whether internal rules and directives define requirements ensuring that data are complete, correct and of integrity, and that availability of and access to data are secured (section 2.3). It notes that data quality is often more important than the choice of model and that purchased solutions often give no insight into the underlying data.
04
Tests and ongoing monitoring
FINMA assessed tests of accuracy, robustness, stability and, where relevant, bias; performance indicators defined in advance; thresholds or other validation methods for output quality; monitoring of data drift; analysis of cases where users ignored or changed the output; and predefined handling of exceptions (section 2.4).
05
Documentation and explainability
For material applications, documentation should cover purpose, data selection and preparation, model selection, performance measures, assumptions, limitations, testing and controls, and fallback solutions (section 2.5). Where decisions must be justified to investors, clients, employees, the supervisor or the audit firm, FINMA assessed explainability in greater depth, including the drivers of results and behaviour under different conditions (section 2.6).
06
Independent review
FINMA found the separation between AI development and independent review unclear in some cases and few institutions reviewing the entire model development process (section 2.7). For material applications, it assessed whether qualified staff provide an objective, informed and unbiased opinion on appropriateness and reliability, and whether the results are taken into account in development.

What it means for the board and executive management

01
FINMA expects institutions that use AI to consider its impact on their risk profile and to align governance, risk management and control systems accordingly; decentralised development and scattered responsibilities are among the weaknesses FINMA observed.
02
Boards should be able to see a complete AI inventory with risk classification: FINMA observed narrow AI definitions, incomplete inventories and difficulty identifying AI in purchased applications and services.
03
AI from third parties is a dependency and concentration issue: FINMA expects additional tests, controls and contractual clauses on responsibility and liability when AI is outsourced, alongside the general outsourcing and operational risk framework.
04
Plans to use AI in critical processes or to calculate regulatory parameters should include early contact with FINMA, as FINMA recommended in April 2025.

In MRM-Solution

How MRM-Solution supports it

01Keep every model in one inventory with owner, tier, EU AI Act risk class and re-validation dates, linked to the committees that approve its use.
02Model committees, mandates and escalation lines once; the structure is checked for gaps, cycles and independence of the second line.
03Treat AI findings as proposals: a verdict counts only after a person has confirmed it against the exact texts.
04Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.

Book a demo

Questions executives ask

Is FINMA Guidance 08/2024 legally binding?

No. FINMA states that guidance, unlike its ordinances and circulars, is not a regulatory instrument and has no legal effect. The binding obligations are the existing, technology-neutral governance and risk management requirements of financial market law, which FINMA says cover AI risks; the guidance shows how FINMA assessed their application to AI in supervisory discussions and on-site reviews.

Which AI applications need the most attention?

Those that are material and whose risks are likely to materialise. FINMA lists materiality factors such as significance for compliance with financial market law, financial impact, legal and reputational risk, and the number and type of clients affected, and notes that risks tend to be higher when AI is used to comply with supervisory law, to perform critical functions, or when clients or employees are strongly affected by its results. The institution defines its own classification criteria.

Do we have to inform FINMA before deploying AI?

The guidance itself sets no notification duty. In April 2025, publishing the results of its survey of around 400 institutions, FINMA recommended that authorised institutions contact FINMA in good time if they plan to use AI in critical processes or to calculate regulatory parameters.

Sources

Executive summary for orientation, not legal advice. The official text prevails.

Reference: FINMA Guidance 08/2024
Official title: Governance and risk management when using artificial intelligence
Issued by: Swiss Financial Market Supervisory Authority FINMA
Type: Guidance
Applies to: FINMA-supervised institutions in all sectors that use AI. Expectations scale with the institution’s size, complexity, structure and risk profile and with the materiality and risk probability of each AI application.
Last reviewed: 13 October 2026