On 18 December 2024, the Swiss Financial Market Supervisory Authority (FINMA) published Supervisory Notice 08/2024 on governance and risk management in the use of artificial intelligence. There is no AI-specific financial market law in Switzerland. FINMA relies on the existing, technology-neutral and principles-based requirements for effective governance and appropriate risk management.
Supervisory notices are not ordinances. They show which risks FINMA is observing and what it expects from and examines in supervised institutions. The notice does not apply to companies outside the financial sector. However, anyone supplying AI solutions to banks, insurers or asset managers should be familiar with it, because institutions pass these expectations on to their suppliers.
Core message
Institutions that use AI should actively consider the impact on their risk profile and align governance, risk management and control systems accordingly. The relevant benchmarks are the institution's size, complexity, structure and risk profile, the materiality of individual applications, and the likelihood that risks will materialize.
Risks that FINMA is monitoring
According to FINMA, risks exist primarily in:
- operational risks, in particular model risks such as lack of robustness, correctness, bias and explainability;
- IT and cyber risks;
- the growing dependence on third parties (hardware, models, cloud) in a concentrated market;
- legal and reputational risks;
- unclear accountabilities, where systems are developed in a decentralized manner or are difficult to explain.
What FINMA examines in its supervisory activities (selection)
Governance
Central steering, clear accountabilities for development, implementation, monitoring and use, requirements for testing and documentation, and training. For outsourced solutions, additionally: tests and controls, contractual rules on responsibility and liability, and an assessment of whether the service provider has the necessary capabilities.
Inventory and risk classification
A sufficiently broad definition of AI, a complete inventory, and consistent criteria to identify material applications that require special attention. FINMA has observed that some institutions define AI so narrowly that only part of the applications and risks are captured.
Data quality
Requirements and controls regarding completeness, correctness and integrity of data, as well as their availability and access. For purchased solutions, institutions often have no influence over the training data; this risk must be known and managed.
Testing and ongoing monitoring
Tests for accuracy, robustness, stability and, where applicable, bias; predefined performance indicators; detection of changes in data (data drift); evaluation of cases where results were manually corrected or not used; consideration of fallback arrangements in the event of failure.
Documentation and explainability
For material applications: purpose, data selection, model choice, performance measures, assumptions, limitations, tests, controls and fallback arrangements. For important decisions, results must be traceable and plausibly justifiable.
Independent review
For material applications: an objective, knowledgeable and unbiased assessment of whether the application is appropriate and reliable, carried out by persons not involved in its development.
What financial institutions want to know from their providers
Even if you are not yourself supervised by FINMA, financial institutions, as customers, typically ask:
- Is there an AI inventory with a risk classification?
- Who is responsible for the model, data and operations?
- What tests and monitoring thresholds are documented?
- How are risks from third-party providers (e.g., cloud LLM, API) covered contractually and operationally?
- Can results be explained to customers, audit firms and supervisory authorities?
The applicable financial market laws and circulars that apply to the respective institution—for example, on outsourcing and operational risks—remain decisive. The supervisory notice shows how FINMA applies these requirements to the use of AI.