# La FINMA sur l'intelligence artificielle : usage généralisé, gouvernance limitée

> Swiss GRC summarises the FINMA survey on AI in the Swiss financial market: AI is widely used, but governance lags behind. The article shows why AI belongs in existing GRC structures and presents the AI GRC Module of the SwissGRC® GRC Toolbox.

- URL: https://swissgrc.com/fr/finma-intelligence-artificielle-gouvernance-limitee/
- Éditeur: SwissGRC®
- Publié: 2025-04-25
- Dernière mise à jour: 2025-04-25

## Points clés

- According to its latest survey, FINMA finds that AI is a firmly embedded part of day-to-day operations in the Swiss financial market, particularly in banks and insurance companies.
- AI is most commonly used for process optimisation, claims handling, front-office tasks and risk management, ranging from rule-based systems to self-learning models.
- FINMA reports that around 50% of institutions have embedded AI into an explicit strategy, but implementation remains inconsistent.
- Existing governance frameworks typically focus on data protection, cybersecurity or data management and often overlook explainability, bias and automation risks.
- FINMA is closely monitoring how institutions handle AI and will increasingly factor this into its supervisory activities. The EU AI Act will also affect Swiss companies with cross-border operations.
- The Swiss GRC AI GRC Module is part of the GRC Toolbox and works with Enterprise Risk Management, ICS, BCM, TPRM, ISMS and Internal Audit.

**With its latest survey, FINMA has issued a clear signal: Artificial Intelligence (AI) has become a firmly embedded part of day-to-day operations in the Swiss financial market – particularly within banks and insurance companies. It’s most commonly used for process optimisation, claims handling, front-office tasks, and risk management. The spectrum ranges from rule-based systems to self-learning models that increasingly influence decisions.**

Progress is evident – but uneven. While technological innovation moves ahead and initial use cases go live, governance often lags behind. [FINMA](https://www.finma.ch/en/news/2025/04/20250424-mm-umfrage-ki/) is direct in its assessment: Many institutions lack [clear internal frameworks](https://swissgrc.com/en/ai-grc/), responsibilities are undefined, and the implications of AI on risk exposure, accountability, and regulatory compliance are not being addressed in a structured way.

The result is a structural gap – between technological potential and institutional control. AI is being deployed, but often without formal integration into organisational oversight. Control mechanisms are fragmented, reactive, or siloed within specific departments, with little alignment to overarching [GRC structures](https://swissgrc.com/en/solutions/). This poses significant operational, reputational, and regulatory risks, particularly for critical use cases.

Widespread Adoption, Limited Structure

Despite the growing use of AI, many institutions still lack a comprehensive management model. According to FINMA, around 50% have embedded AI into an explicit strategy – yet implementation remains inconsistent. Existing governance frameworks typically focus on data protection, cybersecurity, or data management, while specific challenges related to algorithmic systems – such as explainability, bias, or automation risks – are often overlooked.

The following chart from the FINMA report illustrates which areas AI is currently being used in – with banks leading the way, and a strong concentration in process optimisation and broadly defined “Other Applications”.

![Chart: Number of AI applications by area and type of institution. Source: 187 institutions with approved AI use cases.](https://swissgrc.com/fr/wp-content/uploads/sites/3/2025/04/20250424-umfrage-ki.png)

**Chart:** Number of AI applications by area and type of institution. Source: 187 institutions with approved AI use cases.

This broad and partly undefined pattern of use highlights the pressing need for a structured, institution-specific AI governance framework – one that goes beyond IT or data protection, and addresses the full organisational, ethical, and regulatory dimensions of AI.

Governance Is Not Optional – It’s Fundamental

FINMA has made it clear: it is closely monitoring how institutions handle AI and will increasingly factor this into its supervisory activities. At the same time, the upcoming [EU AI Act](https://swissgrc.com/en/the-eus-ai-dilemma-innovation-or-over-regulation/) is set to introduce a binding regulatory framework – one that will also affect Swiss companies with cross-border operations.

In this evolving landscape, organisations face critical questions:

- How can AI-related risks be identified and managed at an early stage?
- How can AI be embedded into existing GRC structures?
- How can transparency and auditability be ensured for AI-driven decisions?
- How can regulatory requirements be met in a fast-moving environment?

These are not just technical questions. They go to the heart of organisational control and must therefore be addressed at the management level.

An Integrated Approach: Swiss GRC and AI Governance

At Swiss GRC, we’ve long been focused on how governance structures must evolve to keep pace with technological developments. In our view, AI does not require a separate governance world – it needs to be embedded into existing enterprise control systems.

Swiss GRC’s [**AI GRC Module**](https://swissgrc.com/en/ai-grc/) is a fully integrated component of our established **GRC Toolbox**, and works seamlessly with:

- Enterprise Risk Management
- Internal Control System (ICS)
- Business Continuity Management (BCM)
- Third Party Risk Management (TPRM)
- Data Protection & Information Security (ISMS)
- Internal Audit

This integrated approach provides a **360-degree view of AI-related risks** – methodologically robust, practically tested, and fully aligned with current and upcoming regulatory frameworks.

![AI GRC Module Dashboard within the GRC Toolbox](https://swissgrc.com/fr/wp-content/uploads/sites/3/2025/04/Dashboard-AI-GRC-1024x513.png)

**Abbildung:** Dashboard des AI GRC Moduls in der GRC Toolbox

Conclusion: Use AI – But Keep It Under Control

The FINMA survey makes one thing clear: AI is already in widespread use – but governance has not caught up. The challenge is real: AI deployment is accelerating, but risk management, control mechanisms, and oversight structures are not developing at the same pace. This creates a tension between technological advancement and corporate accountability – with potential consequences for system integrity, regulatory compliance, and trust in automated decision-making.

**Now is the time to rethink governance** – not as an afterthought, but as a strategic foundation for secure, transparent, and future-ready AI implementation.

Swiss GRC helps organisations establish exactly this foundation: integrated, practice-oriented, and seamlessly connected to their existing GRC structures.

**Curious how AI Governance could look in your organisation?**
Book a conversation with our expert team today. [**Schedule a meeting**](https://swissgrc.com/en/discoverycall/).

## Questions fréquentes

### What did the FINMA survey on artificial intelligence find?

FINMA finds that AI is firmly embedded in day-to-day operations in the Swiss financial market, especially in banks and insurers. Governance often lags behind, with unclear internal frameworks and undefined responsibilities.

### What is AI used for in Swiss banks and insurance companies?

According to the article, AI is most commonly used for process optimisation, claims handling, front-office tasks and risk management. The chart also shows a strong concentration in process optimisation and in broadly defined other applications.

### Which AI risks do existing governance frameworks often overlook?

Existing frameworks usually focus on data protection, cybersecurity or data management. Challenges specific to algorithmic systems, such as explainability, bias and automation risks, are often overlooked.

### What is the Swiss GRC AI GRC Module?

The AI GRC Module is an integrated component of the Swiss GRC GRC Toolbox. It works with Enterprise Risk Management, ICS, BCM, TPRM, ISMS and Internal Audit and provides a 360-degree view of AI-related risks.

### Does the EU AI Act affect Swiss companies?

The article states that the upcoming EU AI Act will introduce a binding regulatory framework that will also affect Swiss companies with cross-border operations.