Most institutions know how to buy software and how to hire a person; far fewer know how to find an AI partner, because the search resembles neither. The market is loud, the pitches are polished, and the loudest vendor is rarely the one who will still be answerable for a regulated process two years after go-live. For a FINMA-regulated institution the problem is sharper still: you are not looking for a generic AI agency but for a partner who understands that touching a controlled workflow means inheriting its requirements — data residency, auditability, sign-off. Finding a qualified AI partner is therefore less a matter of scanning a directory than of knowing which channels surface competence and which merely surface marketing. Three of them reliably do, each with its own quality signal, and a shortlist is only worth vetting once it comes from the right places.
The strongest channel is the one that scales worst: a referral from a peer institution that has already put a partner through a regulated delivery. A recommendation from another fund management company or investment foundation carries information no website can — it has survived the parallel run, the reconciliation, the first audit request — and it is worth more than any case study, because the person giving it has no incentive to flatter. Ask specifically what the partner delivered, what moved, and what went wrong, because a referral that cannot name a single difficulty is describing a demo, not a delivery. The limit of the channel is supply: strong referrals are rare, and the best partners are not always the ones with the widest network. When a peer offers one, treat it as the highest-quality lead you will get.
The second channel is search, and here the quality signal is not ranking but substance. A partner worth shortlisting has usually written plainly about the actual constraints of regulated delivery — how a calculation stays deterministic and auditable, how a workflow runs in parallel before cutover, what a data-residency answer should contain — rather than publishing another round of undifferentiated AI enthusiasm. Read what they publish the way you would read a candidate's work sample: does it show they have done the thing, or only that they know the vocabulary? A firm whose entire online presence is trend commentary and adjectives has told you it sells attention; a firm that writes concretely about the failure modes of a regulated automation has told you it has met them. Search is the channel where you can vet competence before you ever make contact.
The third channel is the professional network, read for depth rather than reach. A large following is a marketing metric; what matters is whether the people who would actually build your workflow have a visible track in regulated work, and whether the person accountable for delivery is findable and specific rather than a brand with no faces behind it. Look past the follower count to the substance of what is shared and who shares it — a founder who engages with the real problems of Swiss financial operations tells you more than a company page that reposts industry news. The signal you are hunting for across all three channels is the same: evidence of practice, not evidence of presence.
A shortlist sourced well still has to be vetted, and two tactics separate the practitioners from the merely confident. First, ask for a workflow audit sample — a short, concrete read of one of your processes, or a redacted example of one they have done. A partner who can map a workflow end to end, name its control points, and identify where a baseline would sit is showing you the discipline the whole engagement depends on; one who jumps straight to a tool recommendation has skipped the only part that matters. Second, request a reference call with a client who is not their flagship. Every firm will parade its best logo; the more telling conversation is with an ordinary engagement, because it tells you what the partner is like on a normal Tuesday rather than on their proudest day.
Two further tactics finish the vetting. Ask who specifically builds the work and where they sit while your data is in play — in regulated finance that is an outsourcing and data-residency question, not an administrative detail, and you are entitled to a straight answer, with a diagram, before a single file changes hands. Then pay attention to their own discovery questions, because a serious partner interviews you as hard as you interview them. If they ask about your process, your controls, your baseline, and what you are trying to prove before they propose anything, they are measuring before they build; if they arrive with a solution already chosen, they are selling a product and calling it a diagnosis. The direction of the questions tells you which one you are dealing with.
The last signal is scope. The partner worth hiring has a boundary and will name it — a productised, narrow offer they deliver well beats an open-ended promise to do everything, because a firm that answers every scoping question with "yes, we can do that too" has shown you it has never had to own the result. The best ones narrow the work rather than widening it: start with the single workflow whose baseline is provable, measure it, and let the proven case fund the next. That is exactly how reporting across 39+ funds at a leading Zurich investment foundation was built — one measurable workflow at a time, each earning the next — not a sweeping mandate handed to whoever pitched hardest. If you have sourced a shortlist and want a defensible way to test it, an AI Audit is where it starts: it maps the workflow, the baseline, and the real scope before anything is committed. It is the same discipline that runs through everything we build.