FINMA guidance 08/2024 explained: what small financial firms must know about AI

FINMA does not expect a small Swiss financial firm to build a corporate-grade structure for AI. Its supervisory notice 08/2024 of 18 December 2024 asks for three things at the core: you must know where AI is used, who is responsible for it, and how errors surface. A team of five can achieve that. This article explains what the notice is, whom it concerns, what the seven measures it names mean in practice, and which minimal version is enough for a small firm.

What is supervisory notice 08/2024, and where does it come from?

On 18 December 2024, the Swiss Financial Market Supervisory Authority published its notice on «Governance and risk management when using artificial intelligence» (FINMA, media release of 18 December 2024). A supervisory notice is not a new ordinance. With it, FINMA sets out what it has observed in ongoing supervision, notably in supervisory meetings and first specific on-site inspections, and which measures it has seen at institutions.

Important for context: Switzerland has no AI-specific legislation so far. Existing supervisory requirements for governance and risk management are technology-neutral and already cover the risks of using AI.

Why does this concern small firms too? Because the notice explicitly anchors proportionality: what matters is the institution's size, complexity and risk profile, plus the materiality of the applications in use. A small institution does not need the same programme as a major bank. But it must be able to answer the same basic questions.

Who has to do what?

The notice addresses institutions supervised by FINMA. How directly it applies to your firm depends on your licence and supervisory regime, and that classification belongs in the hands of a specialist. To put it cautiously: independent asset managers hold a FINMA licence and are therefore broadly addressed; their ongoing supervision, however, is carried out by a supervisory organisation. Insurance brokers are not subject to the same ongoing supervision, yet they feel the expectations indirectly, through insurers, banking partners and clients who increasingly ask how AI and data are handled.

Whatever your own regime, reading the notice pays off: it is the best public checklist of the AI questions that will come up in audit and client meetings.

Which seven measures does FINMA name?

The core of the notice is seven areas in which FINMA has observed measures at institutions. Here is the overview, followed by each area in detail:

Measure	What FINMA means	Minimal version for a small team
1. Governance	Clear responsibilities and standards	One named person and a one-page rule
2. Inventory and risk classification	A complete register of all AI applications	A table listing application, purpose and risk level
3. Data quality	Rules and controls for correct data	Know the sources, check samples
4. Testing and ongoing monitoring	Tests before use, monitoring in production	Test cases with known outcomes, a fixed review slot
5. Documentation	Record purpose, data, assumptions and limits	A one-page profile per application
6. Explainability	Ability to justify results	Recommendations only with source and reasoning
7. Independent review	Review by someone who did not build it	Four-eyes principle, an external look when needed

The seven measures of FINMA supervisory notice 08/2024 and their smallest effective form.

What is behind each measure?

1. Governance

FINMA observed that AI often emerges decentrally and that responsibilities are unclear. It expects defined ownership for development, implementation, monitoring and use, training measures, and careful due diligence when solutions are bought in. For a small team that means: not a new department, but one person with a clear mandate. Minimal version: one page recording who may use AI for what, who decides and who reviews.

2. Inventory and risk classification

FINMA expects a sufficiently broad definition of AI and a complete, centrally maintained inventory with a classification by materiality and risk. The most common stumbling block: AI is already embedded in standard purchased software, from transcription tools to accounting, and appears on nobody's list. Minimal version: a table with the application, its purpose, the data it uses, the responsible person and a simple risk level such as high, medium, low.

3. Data quality

AI applications learn from data, and data quality often matters more than the choice of model. Data can be wrong, incomplete, outdated or biased, and with purchased solutions you usually do not know the underlying data at all. For a small team that means: you must know which data feeds which application. Minimal version: name the data source per application, assign it to a person, and regularly check samples against the source.

4. Testing and ongoing monitoring

FINMA expects tests for accuracy, robustness and stability before productive use, performance indicators defined in advance, and ongoing monitoring, including the question of whether input data changes over time. Cases in which staff ignore or correct an output also belong to monitoring, because they point to weaknesses. Minimal version: before go-live, run ten cases whose correct outcome you know; afterwards a weekly sample and a clear criterion for when to intervene.

5. Documentation

For material applications, FINMA expects documentation of purpose, data selection, model choice, assumptions, limitations, tests and fallback solutions. For a small team that means: one page per application that a new colleague understands without follow-up questions. Minimal version: a profile with purpose, data, ownership, known limits and the date of the last review.

6. Explainability

When decisions must be justified toward clients, employees, the supervisor or the auditor, it must be traceable how the application reached its result. For a small team that means: no AI recommendation goes to a client unchecked. Minimal version: every recommendation carries its source and a short reasoning, and in client contact a human decides.

7. Independent review

FINMA expects a clear separation between those who build or configure an application and those who review it. In a small team that is the four-eyes principle: whoever set up an application does not review its results alone. Minimal version: a second person checks samples, and once a year someone from outside looks at the most critical application.

What may you skip, and what not?

Proportionality is written into the notice itself: AI is not a high-risk application by definition, and the effort follows the materiality and likelihood of the risks. You may typically skip or heavily simplify: a dedicated validation function, complex model-risk frameworks, formal stress tests for uncritical applications, and daily monitoring where a weekly sample is enough.

Four things you may not skip, because they form the backbone of the notice: the inventory, meaning knowing where AI runs at all. The named responsibility, meaning a person instead of a diffuse «we». The review of client-facing results before they leave the firm. And data protection: personal data belongs only in environments with clear contracts and a verified location; the foundations are set out in the revised Federal Act on Data Protection.

How do large institutions set this up, and what is enough for you?

From my projects at additiv I know how insurers and neobanks build AI governance: a centrally maintained inventory, risk classes per application, model tests before every release, documented responsibilities, and a review body independent of the developers. That is the full version, and it costs a multiple of what a small firm needs.

Translated to a firm of five to fifty people, the same logic fits a pocket format: a table instead of an inventory platform, one named person instead of a committee, a fixed weekly review instead of a monitoring dashboard. The supervisor's questions are the same for both; only the answers may be smaller.

From my practice: The most effective measure is the cheapest one: the inventory. In almost every first conversation with a small firm it turns out that nobody knows all the AI applications in use, least of all those inside purchased software. Once someone has written down what runs where and who owns it, half the notice is done, and the conversation with auditors or banking partners feels noticeably different afterwards.

Checklist: are you ready?

Go through this list once. Every «no» is an item for the next meeting:

1. We have a complete list of all AI applications, including AI features inside purchased software.
2. Every application has a named, responsible person.
3. We know which data flows into which application, and where that data sits.
4. New applications are tested before productive use with cases whose outcome we know.
5. A human reviews client-facing results before they leave the firm.
6. Every material application has a one-page profile.
7. We can explain every AI-assisted recommendation with its source and reasoning.
8. Results are never reviewed by the same person alone who set up the application.
9. We have defined how irregularities are reported and resolved.
10. The list is updated at least once per quarter.

Note: We are not a law firm. All statements on legal and regulatory topics are subject to change and do not replace legal advice. For specific questions, please consult a lawyer.

Conclusion: your next step

Start this week with the inventory: thirty minutes, one table, every application with an AI component, plus one responsible person each. That answers the first and most important question of the notice. For the overall picture of use cases, regulation and approach, see the guide: AI for financial services in Switzerland. Data protection is summarized in ten points by the revFADP checklist for financial firms, and the location question by AI hosting in Switzerland. What documentation and explainability look like using the KYC review as an example is shown in the article preparing KYC and source-of-wealth dossiers with AI. And if you would like to see an environment where logging and access rights are built in from the start: on AI for wealth managers we show what that looks like. Brokers and their requirements are covered on AI for insurance brokers.

FAQ

Is supervisory notice 08/2024 binding like a law?

No. It is not an ordinance but describes expectations FINMA derives from existing, technology-neutral supervision, plus measures it has observed at institutions. In practice that means: in supervisory meetings and audits these points become the benchmark. The legal classification for your firm belongs to a specialist.

Do I have to report our use of AI to FINMA?

There is no general duty to report every use of AI. What applies depends on your licence and supervisory regime. Above all, the notice expects you to know and steer your own use of AI. Clarify your specific case with a specialist.

Does this also apply to a team of five?

The notice itself demands proportionality: size, complexity and risk profile determine the effort. For a small team, the minimal version in this article is usually enough. The basic questions, where AI runs, who is responsible and how errors surface, apply regardless of size.

Is a simple spreadsheet enough as an inventory?

For a small firm: yes. What matters is completeness and upkeep, not the tool.

What does the minimal version cost to implement?

Mostly internal time: the inventory and the rule come together in one or two afternoons. It becomes more involved once applications run productively against your systems; the orders of magnitude are in What does AI cost for financial services?.