Neither the US agencies nor FINMA publish a separate rulebook for AI proofs of concept. US model-risk guidance from April 2026 leaves generative and agentic AI out of scope, and FINMA expects AI to sit inside the governance and risk management a bank already has. A pilot is therefore judged by the controls around it, not by its label.
This article sorts what each supervisor says, what is guidance and what is not, and what a CIO or COO can put into a pilot so that the step to production does not start from zero.
Key Takeaways
- The Fed, OCC and FDIC revised their model-risk guidance on April 17, 2026 (Fed SR 26-2, OCC Bulletin 2026-13). It supersedes SR 11-7, is guidance rather than an enforceable standard, and excludes generative and agentic AI.
- FINMA Guidance 08/2024 expects AI to be covered by aligned governance, risk management and controls. It does not create a separate AI regime for pilots.
- A pilot that tests an agent or copilot needs more than one successful demo: repeated sampling, adversarial cases, logged human interventions and a named owner.
- Build the production evidence during the pilot: documentation, access controls, validation notes and an audit trail.
Table of Contents
- What US supervisors say about AI pilots
- What FINMA says
- How the two compare for a Swiss bank
- What Swiss institutions report about the PoC-to-production gap
- Setting up a pilot that can reach production
- Testing agents and copilots before client or operational use
- Our perspective
- Common pilot mistakes and how to avoid them
- How S-PRO helps banks move from pilot to production
- FAQ
- Sources
What US supervisors say about AI pilots
US supervisors say nothing specific about proofs of concept, and their newest model-risk guidance does not cover generative or agentic AI. On April 17, 2026, the Federal Reserve, the OCC and the FDIC published revised model-risk management guidance. The OCC bulletin and the Federal Reserve letter SR 26-2 carry the text. SR 26-2 replaces SR 11-7, so SR 11-7 should no longer be cited as the current reference.
Three points matter for a bank planning a pilot.
It is guidance. According to the OCC bulletin, the document is not an enforceable standard or a prescriptive requirement, and non-compliance alone does not lead to supervisory criticism. The text we reviewed gives no effective date.
It is risk-based. The guidance is tailored to an institution’s size, complexity, model use and risk profile. It is most relevant to organizations above $30 billion in assets, and it may apply to smaller institutions with significant model-risk exposure.
It excludes generative and agentic AI. The agencies describe these models as novel and rapidly evolving. Its principles still apply to traditional statistical and quantitative models and to non-generative, non-agentic AI. For a copilot or an agent, there is no US model-risk standard yet that tells you what a pilot must show. The sound reading is to apply the principles by analogy and document why.
Some principles carry over directly. The guidance says validation should assess whether a model performs as expected, its reliability and limitations, its assumptions and methods, and its data. Rigor and timing vary with purpose, change, data limitations and materiality. It also says that extending a model beyond its intended purpose adds uncertainty and risk, which makes a new-use review sound practice before a pilot grows into a wider rollout.
What FINMA says
FINMA expects supervised institutions to manage AI inside their existing governance, not beside it. FINMA Guidance 08/2024 on governance and risk management when using artificial intelligence follows Switzerland’s technology-neutral, principle-based approach. A law-firm summary of the guidance notes that Switzerland has no AI-specific law, and that existing governance and risk-management requirements apply to AI.
In practice, that points to the following for a pilot:
- Central accountability. One function owns the inventory of AI applications and the risk assessment.
- Independent review. Skilled people who did not build the system review it.
- Third-party management. Contracts and liability for external models, APIs and vendors are clear.
- Training and documentation. Staff understand the tool, and the testing approach is written down.
The guidance is a supervisory communication, so use the verb the supervisor uses: FINMA expects alignment, it does not prescribe a pilot procedure. For the governance question that research could not source, such as who signs off a pilot, we point to the above as the supervisory frame and leave the internal design to each bank’s own risk framework.
The BIS Financial Stability Institute’s FSI Insights No 63, published in December 2024, gives a wider view. It finds financial institutions investing heavily in AI but cautious about generative AI, with customer-facing and high-risk use cases still relatively limited. It is a useful reference for how other authorities are approaching the same questions.
How the two compare for a Swiss bank
A Swiss bank answers to FINMA first, and US guidance becomes relevant through business lines and market access. A Lenz & Staehelin analysis from March 2026 states that US regulatory standards do not apply directly as a matter of Swiss law. It adds that institutions should still weigh foreign regulatory risk, particularly where access to international financial markets is involved. Legal 500’s Swiss AI chapter adds that EU standards may also be relevant for Swiss companies operating in or targeting the EU.
| Question | US (Fed, OCC, FDIC) | Switzerland (FINMA) |
|---|---|---|
| Main document | SR 26-2 / OCC Bulletin 2026-13, April 17, 2026 | Guidance 08/2024 |
| Legal weight | Guidance, not an enforceable standard | Supervisory guidance on existing requirements |
| Generative and agentic AI | Excluded from scope | Covered by the expectation of aligned governance and controls |
| Approach | Risk-based, tailored to size and model use | Technology-neutral, principle-based |
| Pilot-specific rules | None | None |
| Relevance to a Swiss bank | Through US business or market access | Direct |
The consequence is practical. For an agent or copilot, FINMA’s expectation is the more direct yardstick, and the US guidance is a mature reference for validation discipline.
What Swiss institutions report about the PoC-to-production gap
The gap between pilot and production is a recognized Swiss topic. The OST and Swiss Fintech Innovations (SFTI) study, Bridging the AI PoC-Production Gap, published in October 2025, combines an online survey of 24 Swiss financial institutions with interviews. Its stated aim is to give practical strategies for scaling AI initiatives. It reports that AI in Swiss financial institutions is not blocked by culture, and it breaks down the share of AI initiatives by stage. Read the report for the exact distribution across stages, because it shows where your own portfolio sits against peers.
The lesson for a CIO: treat the move to production as a planned workstream with its own owner and budget, not as the natural next step of a successful demo. Our overview of moving an AI pilot into production at a bank covers the organizational side.
Setting up a pilot that can reach production
A pilot that reaches production is one that produces the evidence a validator, auditor and supervisor will later ask for. Use this checklist when scoping.
- Name the use case and its boundary. Write the intended purpose, the users and the data. Use the same question the US guidance asks: what happens if the tool is used beyond its intended purpose? Check Annex III of the EU AI Act against the use case if the bank serves EU clients, and record the result.
- Assign accountability. One executive owner, one risk owner, and a reviewer independent of the build team.
- Define success and failure in advance. Accuracy thresholds, escalation rates, and the conditions that stop the pilot.
- Control the data. Decide where data is hosted, who can access it, and what the model provider may retain. Keep sensitive development and production environments separate.
- Secure the system. The UK NCSC’s guidelines for secure AI system development recommend controlling access to APIs, models, data and pipelines, protecting models against extraction or tampering, and using hashes or signatures to validate model and dataset integrity.
- Document as you go. The same guidelines point to documenting model, dataset and prompt creation, data sources, scope, limitations, guardrails, retention, review frequency and potential failure modes, and to treating logs as sensitive assets.
- Test beyond the demo. See the next section.
- Plan the exit. Decide before the pilot starts whether it ends with production, redesign or shutdown, and who decides.
If you need a view of what the production step involves in effort terms, our page on AI agent pilot to production explains how we scope it.
Testing agents and copilots before client or operational use
For generative and agentic systems, one successful test run is weak evidence. Outputs vary from run to run, and explanations can be hard to produce. A King & Spalding summary of the OCC examiner framework for bank AI use, dated November 4, 2026, points to repeated sampling, adversarial scenarios, workflow-level tests and observation of human intervention as more appropriate. Treat this as a law-firm reading of the framework, and confirm details against the OCC’s own publication.
A test plan for a copilot or agent can cover:
- Accuracy: repeated runs on the same cases, scored by reviewers against a reference.
- Failure modes: malformed inputs, conflicting documents, prompt injection attempts and missing data.
- Bias and consistency: comparable cases with different client attributes should get comparable treatment.
- Explainability: can a reviewer see which sources and steps led to an output?
- Human oversight: the same summary distinguishes human-in-the-loop approval from human-on-the-loop monitoring. Reviewers need expertise, authority and time, and bulk approvals can make review merely formal.
- Workflow tests: the agent inside the real process, with real handoffs, not in isolation.
The summary also reports expectations that documentation lets a third party reconstruct a material AI decision, and that internal audit is independent of both builders and validators. Even if your bank is not subject to the OCC, these are sensible design targets for any audit trail.
If the pilot is a KYC or onboarding agent, scope the human review step from day one. Our page on KYC onboarding agents for banks shows how we approach this.
Talk to our engineers about scoping a pilot that is built for production review
Our perspective
The most common mistake we see is treating the pilot as a technology test and the production decision as a separate governance project that starts later. By then the evidence a validator needs, such as logs, test records and decision rights, was never collected.
Our view is that supervisors have given banks a workable frame: existing governance applies, and where US guidance is silent on agents, its principles on purpose, validation and change still point the way. A pilot designed around that frame is faster to approve, not slower.
At S-PRO we build AI agents and copilots for banks with logging, human review and documentation designed in from the first sprint. S-PRO is a Certified partner in the Claude Partner Network, and our team includes Claude-certified engineers and architects. We build solutions on our own agentic platform, S-PRO Agents, and run them as a service.
The S-PRO team
Common pilot mistakes and how to avoid them
Most pilot failures that block production are governance gaps rather than model gaps. These are the ones to look for.
| Mistake | Why it blocks production | What to do instead |
|---|---|---|
| No named owner | Nobody can sign off the risk assessment | Assign business, risk and independent review roles at kickoff |
| Success judged on a demo | One good run does not show reliability | Use repeated sampling and adversarial cases |
| Data handled informally | Hosting and access cannot be explained later | Fix hosting, access and retention before the first prompt |
| No log design | A material decision cannot be reconstructed | Log inputs, sources, outputs and human actions |
| Scope drifts | A new use needs new analysis | Record the intended purpose and review any extension |
| No exit criteria | The pilot continues without a decision | Set go, redesign and stop criteria in advance |
How S-PRO helps banks move from pilot to production
We help banks and financial institutions design AI pilots that are ready for risk review. S-PRO is headquartered in Zurich, with R&D centers in Zurich and Łódź, and we are ISO 27001 and ISO 27701 certified. Our work covers AI agents for banks, AML & transaction monitoring, KYC onboarding agents, RM & wealth copilots, process automation agents, AI pilot to production and Claude for financial services.
The full approach is on our page for AI proof of concept to production for banks. For wider strategy questions, our technology consulting services help CIOs and COOs sequence use cases and controls.
Book a discovery call with S-PRO
FAQ
Does SR 11-7 still apply to US banks?
No. Fed SR 26-2 and OCC Bulletin 2026-13, published April 17, 2026, supersede SR 11-7. The revised guidance is not an enforceable standard, and it excludes generative and agentic AI models. Check the Federal Reserve and OCC pages for the text and any updates before relying on it in a policy.
Does FINMA require a specific process for AI pilots?
No specific pilot process is set out. FINMA Guidance 08/2024 expects AI to fall under aligned governance, risk management and controls, including accountability, independent review and documentation. The Swiss approach is technology-neutral and principle-based, so a pilot is judged by how well those existing controls cover it.
Do US rules apply to a Swiss bank’s AI pilot?
Not directly. US regulatory standards do not apply as a matter of Swiss law, according to a March 2026 analysis by a Swiss law firm. They can matter indirectly where a bank has US business or relies on access to international financial markets. Your compliance team should assess that exposure for each use case.
What does an AI pilot cost and how long does it take?
Our design thinking pilot from CHF 20k, 2-4 weeks. It is a scoped starting point for defining the use case, controls and production path. Larger builds are scoped after that discovery work, once the data, integrations and review requirements are known.
Sources
- OCC Bulletin 2026-13: Model Risk Management, Revised Guidance (April 17, 2026)
- Federal Reserve SR 26-2: Revised Guidance on Model Risk Management (April 17, 2026)
- FINMA Guidance 08/2024, summary by MLL
- BIS FSI Insights No 63: Regulating AI in the financial sector (December 2024)
- OST and SFTI: Bridging the AI PoC-Production Gap (October 2025)
- Lenz & Staehelin: FinCEN Section 311 action and FINMA liquidation (March 4, 2026)
- Legal 500 Country Comparative Guides 2026: Switzerland, Artificial Intelligence
- NCSC: Guidelines for secure AI system development (2023)
- King & Spalding: The OCC Issues Examiner Framework for Bank Use of AI (November 4, 2026)
Last updated November 9, 2026
Subscribe
Thank you!
Get ready! You will receive handpicked content right to your inbox.
