top of page

Financial Institutions and Artificial Intelligence: Minimum Considerations

Tamara M. Teves

Partner (Advoro Zurich AG)
Dr. iur. HSG
CAS Finanzmarktrecht UZH

October 22, 2026

​

Artificial intelligence ("AI") has long since found its way into the daily operations of financial institutions. This was already demonstrated by the survey conducted by the Swiss Financial Market Supervisory Authority on 24 April 2025: Around half of the nearly 400 financial institutions surveyed were already using AI or developing applications; another 25 percent were planning to use it within the next three years. More recent surveys by FINMA are not publicly available, but it is reasonable to assume that the number of financial institutions using AI has massively increased.


Employees use AI systems for research, drafting, analysing large amounts of data, or supporting compliance and risk functions. The efficiency gains can be substantial. At the same time, new questions arise regarding governance, data protection, information security, and regulatory responsibility.


The discussion is not whether financial institutions will use artificial intelligence, but under what conditions this can be done responsibly and in a controlled manner.


Responsibility remains with humans

A fundamental principle remains unchanged: The responsibility for decisions cannot be delegated to an AI. Whether it's investment decisions, compliance checks, AML assessments, or regulatory reporting: The responsibility remains with the respective employees, the management, and ultimately the board of directors. AI can support, analyse, and generate suggestions. However, the assessment and approval of the result must be carried out by a human.


This also corresponds to the common regulatory expectations for an appropriate governance and control system.


No use without clear rules

In fact, AI systems differ significantly from classic IT applications. Models are constantly changing, results are not always reproducible, and data processing often occurs through complex provider structures.


Therefore, every financial institution should have a formal AI directive or an AI addendum to existing directives, which answers at least the following questions:

  • Which AI systems may be used?

  • For what purposes may they be used?

  • Which data may be processed?

  • Who is responsible for approval?


The use of non-approved systems should therefore be explicitly prohibited, and the AI register should also be regularly updated or checked for updates.


Particular attention must be paid to the handling of client data

Not every AI system is suitable for processing confidential information. Before approval, it should be checked whether inputs are used for training purposes, whether the provider's employees have access to the data, and in which countries the processing takes place. Outsourcing requirements and data protection regulations must also be taken into account.


For professional secrets, the requirements are even higher. Here, questions arise in particular about the provider's obligation of secrecy, any foreign connections, and the technical design of the solution.


Risk-based approach instead of a technology ban

Not every AI application creates the same risks: While creating a first draft of an email or summarising a publicly accessible document is regularly classified as low-risk, applications involving client data or those influencing investment, risk, or compliance processes can trigger significantly higher requirements.


A risk classification with tiered approval and control processes has therefore proven effective. The greater the potential impact on clients, regulatory obligations, or the institution's business activities, the higher the requirements for documentation, monitoring, and independent control must be.


Who controls what

The responsibility for the proper use of AI ultimately lies with the institution's governing bodies. The board of directors and management should therefore ensure that:

  • an AI directive exists;

  • roles and responsibilities are defined;

  • permissible systems and AI applications (incl. the version) are approved;

  • employees are trained;

  • risks are continuously monitored;


The supervision of AI is therefore not purely an IT task. It is part of corporate governance and risk management.


Conclusion

The use of artificial intelligence is fundamentally changing the way financial institutions operate. The main challenge is not to prevent the use of new technologies, but to channel it in an orderly manner.



Sources:

bottom of page