Swedish FSA Launches Survey on AI Use and Risk Management Across Financial Sector

Key Takeaways

• Finansinspektionen (FI) is surveying a wide range of supervised firms on how they use AI and manage its opportunities and risks.
• The survey also covers how firms expect the partially applicable EU AI Act to affect them.
• Compliance teams at Swedish-supervised institutions should expect a data request and treat the exercise as a signal of FI's supervisory priorities.

Deep Dive

This is a supervisory information-gathering exercise, not new regulation. FI describes it as an "in-depth analysis," a targeted survey sent to a broad selection of supervised institution types. Recipients include banks, credit institutions, insurers, fund companies, payment institutions, and securities firms. It follows up on a 2024 FI survey but adds new questions reflecting the rapid development of AI, particularly generative models. FI says the results will help it direct supervisory resources to where they are most useful. Firms that report weak governance or elevated risk exposure may therefore draw closer attention later.

The release introduces no new legal obligations, deadlines, or penalties, and it gives no response date. It does, however, state FI's expectations. Firms must keep strengthening their ability to prevent, detect, and manage AI-related challenges, and FI calls these issues a priority that it is "following closely." The release highlights operational resilience and cybersecurity risks arising from generative AI. The survey will also assess how firms believe they are affected by the EU AI Act, which FI notes has partially entered into force. Responses will therefore reveal how well firms understand their obligations under that framework.

Compliance teams should take several steps. First, confirm who at the firm will receive and coordinate the response, and make sure it is routed to the right owners across compliance, risk, IT, and data functions. Second, build or update a complete AI inventory covering use cases, vendors, models (including generative AI and third-party tools), and business criticality. Third, assess AI use against the EU AI Act, including risk classification, AI literacy, and any high-risk use cases such as creditworthiness assessment or insurance pricing. Fourth, review governance and controls, including model risk management, third-party and outsourcing oversight, cyber and resilience testing, and incident handling. Compare current answers with the firm's 2024 responses to explain any changes consistently.

The impact is moderate and mainly supervisory. Inaccurate or inconsistent responses could create credibility issues with FI, while gaps surfaced by the survey could lead to follow-up inquiries or thematic supervisory work. Firms that can show a clear inventory, accountable ownership, and tested controls will be better placed. Those operating across the EU should align Swedish responses with their broader AI Act and DORA-related resilience programs.

Source: Finansinspektionen