AI governance for financial institutions
About half of the institutions surveyed by FINMA use artificial intelligence, on average five applications in operation and nine in development. In Guidance 08/2024 FINMA set out what it expects from supervised institutions. The focus is not the model but the governance.
What FINMA expects
- An inventory of AI applications.
- A consistent risk classification.
- Testing and ongoing monitoring of accuracy, stability and bias.
- Documentation of the design and the limits of each application.
- Explainability wherever results affect clients, employees or regulation.
- For material applications, an independent review separate from development.
Risk classification instead of a debate on principle
FINMA does not consider AI to be inherently high-risk. The risk depends on materiality, complexity, autonomy and use case. Once the classification is set up cleanly, you decide per application how much review is needed instead of rediscussing every single application.
The AI inventory
Seven entries per application: purpose, data sources, model used, place of operation, who signs off the results, what effect an error would have and who owns the application. Without this register, every further review remains a snapshot.
Explainability towards clients and the supervisor
Explainability does not mean understanding the model core. It means being able to show, for each result, which data and rules it rests on and who signed it off. That can be documented, reviewed and is sufficient in practice.
Independent review
For material applications FINMA expects a review separate from development. Anyone who builds an application and reviews it at the same time has a conflict of interest that an audit firm will ask about. An independent review also provides a benchmark for effort and sequencing before budget is committed.
Where the data sits
If data may not leave the house, the models run on your own or dedicated infrastructure. That is more demanding in operation and the choice of models is smaller. This trade-off belongs in the assessment, not in a debate on principle.
Process and effort
- First conversation, 30 minutes, without obligation.
- Assessment at a fixed price: inventory, risk classification, findings. In writing.
- Review of the material applications, separate from development.
- Implementation of the measures, in stages.
- Handover: documentation, training, recurring monitoring.