AI governance with ISO/IEC 42001, aligned with FINMA expectations
Your teams already use AI, often through vendors and generative AI tools. FINMA published Guidance 08/2024 on governance and risk management when using AI on 18 December 2024. IRM-Advisors helps you build AI governance that fits your size, using ISO/IEC 42001 as the structure.
- Pricing
- Fixed price, quoted after a 30-minute scoping call.
Who it is for
- FINMA-supervised banks, asset managers and insurers using or buying AI
- Fintechs and software vendors whose clients ask for AI governance evidence
- Swiss firms serving EU clients that need to know whether the EU AI Act applies
- Organisations planning ISO/IEC 42001 certification
What you receive
- An inventory of AI use cases, including vendor and generative AI tools
- A risk classification and assessment method
- An AI policy, roles and accountability model
- A gap assessment against ISO/IEC 42001 and FINMA Guidance 08/2024
- An EU AI Act applicability analysis, coordinated with your legal counsel
- An implementation roadmap and certification readiness support
How it works
- DiscoverBuild the AI inventory and identify who owns each use case.
- AssessClassify risks and run a gap assessment against ISO/IEC 42001 and FINMA expectations.
- BuildPolicies, controls, data quality and testing requirements, vendor oversight.
- OperateMonitoring, independent review and readiness for certification or supervisory review.
AI governance and data protection go together. Daniel Anastasi holds the ISACA CDPSE certification and applies privacy by design under the Swiss revFADP. His DBA research at Henley Business School (UK) studies how boards oversee AI and cybersecurity.
Relevant credentials
Frequently asked questions
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system. It defines how an organisation governs, assesses and controls the AI systems it develops, provides or uses, and it can be certified.
What does FINMA Guidance 08/2024 expect?
It sets out FINMA’s observations and expectations on AI governance, including an inventory and risk classification of AI applications, data quality, testing, explainability and independent review. It is guidance, not a new ordinance, but supervisors use it to assess institutions.
Does the EU AI Act apply to a Swiss company?
It can, for example when a Swiss firm places AI systems on the EU market or when their output is used in the EU. Applicability depends on your use cases and should be confirmed with legal counsel.
Do we need ISO 42001 certification?
Not necessarily. Many firms use ISO/IEC 42001 as a framework without certifying. Certification helps when clients or partners ask for independent proof.
Discuss your situation in a 30-minute call. No preparation needed.
Book a call