FINMA doesn't publish an AI rulebook. What it publishes is a set of expectations — about data residency, model risk, outsourcing, and the documented accountability of every decision an institution takes. AI systems inherit all of those.
In practice, that means three things. First, the data the model touches stays inside the institution's environment, on infrastructure with Swiss data residency. Second, every step a model takes that influences a regulated process needs to be reconstructable after the fact. Third, the human who signs off on the output owns the output — and needs the tools to actually understand it.
Most off-the-shelf AI products fail one of those tests on day one. They route prompts through a US endpoint, they keep no decision log you can audit, or they hide enough of the reasoning that the sign-off becomes performative.
Our default is to build the AI layer the same way we build the reporting layer: in your environment, with logging and review hooks the compliance officer can actually use. That isn't a marketing position. It's the only configuration that survives an internal audit.