1. Risk Classification and Management

• Defining Risk Criteria: Institutions must establish their own criteria for classifying AI applications based on their potential impact on business operations, customers, and employees. These criteria should reflect the technology-neutral and principles-based approach of Swiss regulation. 
• Impact-Based Classification: AI systems are categorized based on their significance, particularly those that could lead to material business risks, regulatory challenges, or ethical concerns. 
• Governance Requirements: 
• Institutions are expected to implement tailored frameworks for assessing, managing, and mitigating risks associated with AI. 
• Classification must consider both operational risks (e.g., disruption of services) and reputational risks (e.g., biases in AI-driven decisions). 

2. Third-Party Management

• Vendor Selection and Due Diligence: Institutions outsourcing AI-related activities must conduct thorough assessments of third-party capabilities. This includes reviewing their technical expertise, compliance with ethical standards, and past performance. 
• Contractual Safeguards: 
  • Contracts must clearly define responsibilities, including liability for failures, compliance requirements, and penalties for breaches. 
  • Specific clauses should address data protection, algorithmic transparency, and accountability. 
• Monitoring and Testing: 
  • Continuous oversight of third-party activities to ensure adherence to agreed standards. 
  • Regular performance reviews and audits to validate compliance with governance frameworks.

3. Inventory Completeness

• Centralized AI Inventory: 
  • Institutions are required to maintain an up-to-date, centralized record of all AI systems used across the organization. 
  • The inventory must include details such as the purpose of the AI, its risk classification, its operational dependencies, and any third-party involvement. 
• Procedures for Maintenance: 
  • Mechanisms must be established for identifying and cataloging new AI applications as they are introduced. 
  • Regular reviews and updates to ensure completeness and accuracy. 
• Integration Across Departments: 
  • Coordination among IT, compliance, and operational teams to monitor AI usage throughout the organization.  

4. Transparency and Accountability

• Documentation Standards: 
  • Institutions must create detailed documentation for each AI system, covering its development, intended use, and decision-making processes. 
  • Documentation should include risk assessments, testing procedures, and mitigation strategies. 
• Market Transparency: 
  • Institutions are encouraged to communicate transparently about their AI usage, particularly in areas that directly impact customers (e.g., credit scoring or automated customer service). 
  • Stakeholder engagement to address concerns related to AI practices. 
• Internal Accountability: 
  • Clear allocation of roles and responsibilities for AI governance within the organization. 
  • Boards and senior management must ensure proper oversight and integration of AI systems into the broader governance structure. 

5. Alignment with International Standards

• OECD AI Principles: 
  • Switzerland adopts the OECD’s definitions and principles for AI systems, focusing on trust, fairness, transparency, and human-centric design. 
• Global Collaboration: 
  • Institutions are encouraged to align with international best practices to ensure cross-border interoperability of AI systems. 
• Sectoral Adaptation: 
  • Regulatory expectations vary by sector, with tailored approaches for areas such as financial services, healthcare, and public administration.