Your industry: Wealth managers and financial service providers
Tailored to wealth managers and financial service providers: FINMA principles (notice 08/2024), the outsourcing rules (Art. 17 FinIO for wealth managers, Circular 2018/3 for banks and insurers) and professional secrecy are factored into every row.
Works with client data: the setup is proven, contract and governance are in place. This is exactly how you should do it.
Depends on the contract, configuration and industry: feasible with a documented risk assessment, not without it.
Not defensible for client data in our risk assessment: no contract, no control or no documented safeguards. Often still the best choice for research, marketing and anonymised content.
For wealth managers, green only applies when three conditions are met: the outsourcing is documented under Art. 17 FinIO, audit rights for the supervisory organisation and FINMA are contractually secured, and professional secrecy is technically protected. If any of these is missing, every green option turns yellow.
Filter the table by traffic-light colour. On a smartphone it scrolls sideways.
| Solution | Client data | Models | Data location | Model quality | Effort | Cost | What to watch |
|---|---|---|---|---|---|---|---|
Azure OpenAI Switzerland (Standard) Microsoft Azure, Switzerland North region | Green | GPT-4o (until April 2027), Embeddings | Processing Switzerland Storage Switzerland | Solid, several generations behind the frontier | Medium, integration by IT or partner | Low, per token, no base fee | The reference setup under FINMA logic: Swiss data location, choose the Standard deployment type (not Global or Data Zone), outsourcing contract under Art. 17 FinIO or Circular 2018/3 with confidentiality and audit rights. For new customers, GPT-4o (until April 2027) is effectively the only option. Apply for Modified Abuse Monitoring: without this approval Microsoft stores flagged samples, and authorised staff can review them even in the Swiss region. |
Azure OpenAI Switzerland (Provisioned) Microsoft Azure, Switzerland North, reserved capacity | Green | GPT-5.1 (until May 2027) | Processing Switzerland Storage Switzerland | Very good, strongest model with CH guarantee | Medium, integration by IT or partner | From approx. USD 13,000 per month (minimum 50 PTU) | Like the Standard variant, but with regional Provisioned capacity in Switzerland North (not Global or Data Zone Provisioned) and GPT-5.1 (until May 2027); include the capacity contract in the risk assessment per supervisory notice 08/2024. From approx. USD 13,000 per month (minimum 50 PTU): unrealistic for most wealth managers, and a successor in Switzerland is not guaranteed. |
Swiss AI platforms e.g. AIgent, Swisscom, Phoenix Technologies (kvant), Infomaniak | Green | Open models such as DeepSeek, Qwen, GLM, Apertus | Processing Switzerland Storage Switzerland | Good to very good, a step behind the frontier | Low, ready-made interface, some with agents | Medium, licence per user, sometimes plus usage | The simplest FINMA-compliant surface without US ties: check ISO 27001, references and confidentiality, disable optional US models. |
AI in your industry software e.g. practice, law firm, CRM or portfolio systems | Depends on provider | Usually GPT or Claude in the background | Processing Depends on provider Storage Depends on provider | Good, tailored to the use case | Low, the system is already in use | Low to medium, often as an add-on module | Clarify in writing which model runs where. The outsourcing remains your responsibility even with an industry vendor (Art. 17 FinIO or Circular 2018/3). |
Microsoft 365 Copilot Microsoft, with EU Data Boundary | Yellow | GPT models from OpenAI, operated by Microsoft | Processing EU/EFTA Storage Switzerland (Data Location or ADR) | Very good, strong in everyday office work | Low, licence and configuration | Medium, licence per user and month | Permissible with safeguards: Flex Routing off, Anthropic models off, permissions cleaned up. Document the contract and client information. |
Azure OpenAI Data Zone EU Microsoft Azure, resource in Switzerland North | Yellow | Latest GPT generation, e.g. GPT-5.4 to GPT-6.1 | Processing EU Data Boundary, confirm countries with Microsoft before use Storage Switzerland | Frontier, latest GPT models | Medium, integration by IT or partner | Low, per token | FINMA permits processing abroad with safeguards: risk assessment, contract, client information and an explicit assessment of the residual CLOUD Act risk. Feasible with our reference architecture: client data stays in Switzerland, only pseudonyms are processed in the EU. |
Claude via AWS Bedrock (EU) Amazon Web Services, EU regions | Yellow | Opus 5 and Sonnet 5 in Ireland or Stockholm, Opus 5.5 and Sonnet 5.5 via EU inference | Processing EU Storage No prompt storage by Bedrock | Frontier, especially strong for text and analysis | Medium to high, AWS account and development needed | Low to medium, per token | Like Azure Data Zone EU; also cover AWS as a sub-processor in the contract. AWS evidences the FINMA requirements with a dedicated ISAE 3000 Type 2 report. |
Gemini via Google Vertex AI (EU) Google Cloud, EU regions | Yellow | Gemini models | Processing EU Storage EU or Switzerland | Frontier, strong with long documents | Medium to high, Google Cloud project and development | Low to medium, per token | Like Azure Data Zone EU; have the processing location verified in writing before use. Google evidences the FINMA requirements with an ISAE 3000 report. |
Claude directly from Anthropic Claude API, Team and Enterprise | Red | Claude Fable 5.1, Opus 5.5, Sonnet 5.5 | Processing US or global Storage US | Frontier, newest Claude models first | Low, ready to use | Medium, licence or per token | US processing without documented safeguards: unsuitable for client data in this configuration. Breaching professional secrecy (Art. 69 FinIA, for banks Art. 47 Banking Act) is a criminal offence, even through negligence with a fine of up to CHF 250,000. |
Claude in Microsoft Foundry or Copilot Microsoft, operated on Anthropic infrastructure | Red | Claude models | Processing Outside the EU Data Boundary Storage Not guaranteed | Frontier, same as Claude direct | Low, switchable at a toggle | Medium, in licence or per token | Processing outside the EU Data Boundary: unsuitable for client data, keep the switch off. Here too, breaching professional secrecy is a criminal offence. |
Copilot with Flex Routing enabled Microsoft 365, setting available since April 2026 | Red | GPT models | Processing At peak load also US, Canada, Australia Storage Switzerland | Very good, same as Copilot | Low, a single setting | Medium, licence per user and month | Peak-load processing in the US, Canada, Australia: disable for FINMA-supervised client data; one setting suffices. Without it you risk a criminal breach of professional secrecy. |
Private AI accounts ChatGPT, Claude.ai, Gemini with a private or free account | Red | All of them | Processing Unclear, mostly US Storage US | Frontier, which makes it so tempting | None, and that is exactly the problem | Low, free or privately paid | A clear breach of professional secrecy (Art. 69 FinIA): a criminal offence, even through negligence with a fine of up to CHF 250,000. Prohibit by policy, offer an approved alternative. |
Microsoft, AWS and Google are US corporations and are subject to the US CLOUD Act, even with data centres in Switzerland or the EU. This residual risk belongs in every risk assessment.
Hardly any organisation needs just one tool. What has proven itself is the combination of an AI employee for daily work and a secure interface for automations.
For FINMA-supervised organisations we recommend the pragmatic setup: Copilot for daily work, sensitive client data only through the Swiss pipeline, all under an outsourcing contract under the FINMA rules (Art. 17 FinIO, Circular 2018/3). For new customers, GPT-4o (until April 2027) is effectively the only option there; Provisioned with GPT-5.1 costs from approx. USD 13,000 per month and is unrealistic for most. If you need frontier models, our reference architecture is the answer: client data stays in Switzerland, only pseudonyms are processed in the EU.
For Swiss organisations, the revised Data Protection Act (DPA) applies: cloud AI is usually commissioned processing, and disclosures of data abroad require, depending on the country, an adequate level of protection, safeguards or an exception (Art. 16 and 17 DPA). Responsibility stays with you, even when outsourcing to a cloud provider. Where sectoral supervision applies in addition, the industry selector by the cloud options shows it.
On top of data protection, supervisory rules apply to FINMA-supervised organisations: technology does not release you from responsibility, not even when outsourcing to a cloud provider.
This overview does not replace legal advice. Model availability and regions change constantly; October 2026 edition. Verify details with the provider before use.
Taskstreams builds and operates the pipeline that fits your policy: Switzerland only with Azure OpenAI Switzerland North, or the frontier model in the EU while your client data stays in Switzerland. Contract and governance are included; you receive finished AI employees for your processes, from document review to client reporting, instead of your own infrastructure project.