# FINMA on Artificial Intelligence: Widespread Use, Limited Governance

> Der Beitrag von Swiss GRC fasst die FINMA-Umfrage zum Einsatz von KI im Schweizer Finanzmarkt zusammen. Er zeigt, dass KI breit genutzt wird, die Governance aber hinterherhinkt, und stellt das AI GRC Modul der GRC Toolbox vor.

- URL: https://swissgrc.com/en/finma-on-artificial-intelligence-widespread-use-limited-governance/
- Publisher: SwissGRC®
- Published: 2025-04-25
- Last updated: 2026-08-20

## Key facts

- Laut der FINMA-Umfrage ist Künstliche Intelligenz im Schweizer Finanzmarkt fester Teil des Tagesgeschäfts, vor allem bei Banken und Versicherungen.
- KI wird am häufigsten für Prozessoptimierung, Schadenbearbeitung, Front-Office-Aufgaben und Risikomanagement eingesetzt.
- Laut FINMA haben rund 50 % der Institute KI in eine explizite Strategie eingebettet, die Umsetzung bleibt jedoch uneinheitlich.
- Bestehende Governance-Rahmen konzentrieren sich meist auf Datenschutz, Cybersicherheit oder Datenmanagement, während Erklärbarkeit, Verzerrungen (Bias) und Automatisierungsrisiken oft übersehen werden.
- Die FINMA beobachtet den Umgang der Institute mit KI genau und will ihn verstärkt in ihre Aufsichtstätigkeit einbeziehen.
- Das AI GRC Modul von Swiss GRC ist Teil der GRC Toolbox und lässt sich mit Risikomanagement, IKS, BCM, TPRM, Datenschutz und Informationssicherheit (ISMS) sowie Internal Audit verbinden.

**With its latest survey, FINMA has issued a clear signal: Artificial Intelligence (AI) has become a firmly embedded part of day-to-day operations in the Swiss financial market – particularly within banks and insurance companies. It’s most commonly used for process optimisation, claims handling, front-office tasks, and risk management. The spectrum ranges from rule-based systems to self-learning models that increasingly influence decisions.**

Progress is evident – but uneven. While technological innovation moves ahead and initial use cases go live, governance often lags behind. [FINMA](https://www.finma.ch/en/news/2025/04/20250424-mm-umfrage-ki/) is direct in its assessment: Many institutions lack [clear internal frameworks](https://swissgrc.com/en/ai-grc/), responsibilities are undefined, and the implications of AI on risk exposure, accountability, and regulatory compliance are not being addressed in a structured way.

The result is a structural gap – between technological potential and institutional control. AI is being deployed, but often without formal integration into organisational oversight. Control mechanisms are fragmented, reactive, or siloed within specific departments, with little alignment to overarching [GRC structures](https://swissgrc.com/en/solutions/). This poses significant operational, reputational, and regulatory risks, particularly for critical use cases.

Widespread Adoption, Limited Structure

Despite the growing use of AI, many institutions still lack a comprehensive management model. According to FINMA, around 50% have embedded AI into an explicit strategy – yet implementation remains inconsistent. Existing governance frameworks typically focus on data protection, cybersecurity, or data management, while specific challenges related to algorithmic systems – such as explainability, bias, or automation risks – are often overlooked.

The following chart from the FINMA report illustrates which areas AI is currently being used in – with banks leading the way, and a strong concentration in process optimisation and broadly defined “Other Applications”.

![Chart: Number of AI applications by area and type of institution. Source: 187 institutions with approved AI use cases.](https://swissgrc.com/en/wp-content/uploads/sites/2/2025/04/20250424-umfrage-ki.png)

**Chart:** Number of AI applications by area and type of institution. Source: 187 institutions with approved AI use cases.

This broad and partly undefined pattern of use highlights the pressing need for a structured, institution-specific AI governance framework – one that goes beyond IT or data protection, and addresses the full organisational, ethical, and regulatory dimensions of AI.

Governance Is Not Optional – It’s Fundamental

FINMA has made it clear: it is closely monitoring how institutions handle AI and will increasingly factor this into its supervisory activities. At the same time, the upcoming [EU AI Act](https://swissgrc.com/en/the-eus-ai-dilemma-innovation-or-over-regulation/) is set to introduce a binding regulatory framework – one that will also affect Swiss companies with cross-border operations.

In this evolving landscape, organisations face critical questions:

- How can AI-related risks be identified and managed at an early stage?
- How can AI be embedded into existing GRC structures?
- How can transparency and auditability be ensured for AI-driven decisions?
- How can regulatory requirements be met in a fast-moving environment?

These are not just technical questions. They go to the heart of organisational control and must therefore be addressed at the management level.

An Integrated Approach: Swiss GRC and AI Governance

At Swiss GRC, we’ve long been focused on how governance structures must evolve to keep pace with technological developments. In our view, AI does not require a separate governance world – it needs to be embedded into existing enterprise control systems.

Swiss GRC’s [**AI GRC Module**](https://swissgrc.com/en/ai-grc/) is a fully integrated component of our established **GRC Toolbox**, and works seamlessly with:

- Enterprise Risk Management
- Internal Control System (ICS)
- Business Continuity Management (BCM)
- Third Party Risk Management (TPRM)
- Data Protection & Information Security (ISMS)
- Internal Audit

This integrated approach provides a **360-degree view of AI-related risks** – methodologically robust, practically tested, and fully aligned with current and upcoming regulatory frameworks.

![AI GRC Module Dashboard within the GRC Toolbox](https://swissgrc.com/en/wp-content/uploads/sites/2/2025/04/Dashboard-AI-GRC-1024x513.png)

**Abbildung:** Dashboard des AI GRC Moduls in der GRC Toolbox

Conclusion: Use AI – But Keep It Under Control

The FINMA survey makes one thing clear: AI is already in widespread use – but governance has not caught up. The challenge is real: AI deployment is accelerating, but risk management, control mechanisms, and oversight structures are not developing at the same pace. This creates a tension between technological advancement and corporate accountability – with potential consequences for system integrity, regulatory compliance, and trust in automated decision-making.

**Now is the time to rethink governance** – not as an afterthought, but as a strategic foundation for secure, transparent, and future-ready AI implementation.

Swiss GRC helps organisations establish exactly this foundation: integrated, practice-oriented, and seamlessly connected to their existing GRC structures.

**Curious how AI Governance could look in your organisation?**
Book a conversation with our expert team today. [**Schedule a meeting**](https://swissgrc.com/en/discoverycall/).

## Frequently asked questions

### Was hat die FINMA-Umfrage zu künstlicher Intelligenz ergeben?

Die Umfrage zeigt, dass KI im Schweizer Finanzmarkt breit genutzt wird, besonders bei Banken und Versicherungen. Die Governance hält damit nicht Schritt: Vielen Instituten fehlen klare interne Rahmenwerke, und Verantwortlichkeiten sind nicht definiert.

### Wofür setzen Finanzinstitute KI am häufigsten ein?

Genannt werden Prozessoptimierung, Schadenbearbeitung, Front-Office-Aufgaben und Risikomanagement. Die Spanne reicht von regelbasierten Systemen bis zu selbstlernenden Modellen.

### Welche Lücken bestehen bei der KI-Governance?

Kontrollmechanismen sind laut Text fragmentiert, reaktiv oder auf einzelne Abteilungen beschränkt und kaum auf übergeordnete GRC-Strukturen abgestimmt. Besondere Fragen algorithmischer Systeme wie Erklärbarkeit, Bias oder Automatisierungsrisiken werden oft nicht beachtet.

### Was ist das AI GRC Modul von Swiss GRC?

Es ist ein integrierter Bestandteil der GRC Toolbox von Swiss GRC. Es arbeitet mit Enterprise Risk Management, IKS, BCM, TPRM, ISMS und Internal Audit zusammen und soll einen 360-Grad-Blick auf KI-Risiken ermöglichen.

### Welche Rolle spielt der EU AI Act für Schweizer Unternehmen?

Der kommende EU AI Act soll einen verbindlichen Regulierungsrahmen schaffen. Laut Text betrifft er auch Schweizer Unternehmen mit grenzüberschreitender Geschäftstätigkeit.