On 28 October 2026, the Swiss Federal Council reviewed progress on regulating artificial intelligence: binding rules are being drafted, and the consultation is due to open in spring 2027. Should you wait for that law before using AI in your company? No. Where personal data is involved, the Swiss Data Protection Act (FADP), in force since 1 September 2023, already applies to AI, and it is enough to tell a small business what to do today.
Key points
- Switzerland has no AI-specific law yet. On 12 February 2025, the Federal Council decided to ratify the Council of Europe convention on AI; the consultation on binding rules is planned for spring 2027.
- Meanwhile, the Federal Data Protection and Information Commissioner (FDPIC) is explicit: the FADP is "directly applicable" to AI-supported data processing.
- In practice, five obligations matter: the record of processing activities, the impact assessment when the risk is high, informing people, the contract with the provider, and where the data goes.
- The technical choice is part of compliance: a model running on a server you control, in Switzerland, sends your data neither to an AI provider nor abroad.
- This article is not legal advice: for sensitive data or data covered by professional secrecy, have your choice checked by a lawyer.
What is happening: the Swiss Data Protection Act and AI, and a law in the making
New rules: not before the 2027 consultation
On 12 February 2025, the Federal Council decided to ratify the Council of Europe convention on artificial intelligence. It asked the Federal Department of Justice and Police to prepare a draft for consultation, noting that Switzerland currently has no legislation of its own on the subject. The Federal Office of Justice is working on it: the draft is to cover transparency, data protection, non-discrimination and oversight.
On 28 October 2026, the Federal Council took note of the progress made. Two tracks are taking shape. On one side, binding measures drafted by the Federal Office of Justice, which also cover risk assessment; according to the press release, the consultation is planned to open in spring 2027. On the other, non-binding measures coordinated by the Federal Office of Communications: guidelines, sector standards and voluntary commitments, with a guide to help industries draft their own codes.
The actual content of the future rules has not been published. Anything written today about their details is guesswork, and I will not add to it.
The current rule: the FADP already applies
The FDPIC is clear. The FADP is technology-neutral, so it "is directly applicable to AI-supported data processing". It draws precise requirements from this: those who build, supply or use AI must be transparent about its purpose, how it works and its data sources; people have a right to know whether they are dealing with a machine; and for high-risk processing, the law requires an impact assessment. The Commissioner repeated this on 28 January 2026, on Data Protection Day: generative AI as such is not subject to the FADP, but it becomes so as soon as it processes personal data.
What it means for you
For a small business, AI does not bring a separate regime: it brings a new tool into obligations that already exist. Here are the ones that matter most, article by article.
- The record of processing activities (Art. 12 FADP). For each processing activity, it states the purpose, the categories of data and people, the recipients and, for transfers abroad, the country and the safeguards. Companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 24 DPO). Even if you are exempt, keeping one for your AI uses is still the simplest way to know where your data goes.
- The impact assessment (Art. 22 FADP). Required before any processing likely to create a high risk, "in particular when using new technologies". It describes the processing, assesses the risks and lists the planned measures. An assistant that screens job applications or analyses health records is an obvious candidate.
- The duty to inform (Art. 19 and 21 FADP). Your clients and staff must know what their data is used for and who receives it, including in which country. If a decision that significantly affects them is made solely by an automated system, you must tell them, and they can ask for a person to review it.
- The provider and the place of processing (Art. 9 and 16 FADP). An online AI service is usually a processor: you need a contract, and servers abroad require a country recognised as adequate or appropriate safeguards. I covered this point, and professional secrecy, in the article on shadow AI.
- Data protection by design (Art. 7 FADP). Processing must be limited, by default, to what is necessary. Sending a whole file to an AI to extract one date is not.
Penalties target individuals, not only the company: fines of up to CHF 250,000, on complaint, for anyone who intentionally fails to inform, transfers data abroad without safeguards, or hands processing to a processor outside the legal conditions (Art. 60 and 61 FADP).
What I have learned
In my own setups, one question decides everything: which data goes where. And the answer is not the same for everything.
In my home automation infrastructure, speech recognition and speech synthesis run locally, offline; the assistant searches documents stored on my side, and only complex reasoning goes to an external API. For my daily work, my AI agents run on Claude Code, an Anthropic service: part of my data therefore goes out to a provider, while the servers that host it, my ERP and my agents' memory are in Switzerland. I described this setup in claudeVPS.
That is a choice I make for my own data, knowing the provider's terms. For client files covered by professional secrecy, or for health data, I would make the other choice: a model running on a server you control, with nothing leaving it. That is the rule I apply when I set up AI for a client: local models when confidentiality requires it, external APIs when that is acceptable, and a written list of what goes where. That list is already half of the record.
What to do in practice
1. Take stock of your AI uses
Which tools, for which tasks, with which data: clients, staff, applicants, patients. Include the AI features quietly added to the software you already use, such as email, CRM or word processing.
2. For each use, note where the data goes
The provider, its contract, the country of processing, and whether your data is used to train its models. If you are exempt from the record, one page per tool is enough; otherwise, add to your existing record.
3. Identify high-risk uses
Sensitive data (health, opinions, biometric data, criminal proceedings), decisions about people, profiling. For these, write an impact assessment before you start, not after.
4. Choose the place of processing according to sensitivity
An API under contract for what can leave; a local model, on your server, for what must not. The two work well side by side, as long as the rule is written down in advance.
5. Update your privacy notice
Mention the use of AI, the recipients and the countries. If a chatbot answers your clients, tell them they are talking to a machine.
6. Set a date for spring 2027
When the consultation opens, check your inventory against the published draft. If you have completed the five steps above, you will mostly have adjustments to make.
Frequently asked questions
Does a small business need to keep a record?
Fewer than 250 employees: in principle no, unless you process sensitive data on a large scale or carry out high-risk profiling (Art. 24 DPO). The duty to inform, the processor contract and the rules on transfers abroad, however, apply to businesses of every size.
Is using ChatGPT or Claude prohibited in Switzerland?
No. It is allowed if you comply with the FADP: a suitable contract, safeguards for transfers abroad, informing the people concerned, and no professional secrecy standing in the way. For a sensitive case, ask a lawyer.
Does the EU AI Act apply to me?
That depends on your activities in the European Union, and it is a question for a lawyer. This article covers Swiss law.
Going further
I set up AI that stays with you when confidentiality requires it, and I document what goes elsewhere when that is acceptable. The guides for my personal AI server describe the technical stack. To look at your own case: a 20-minute call.
Sources
- Federal Council takes note of interim progress on AI regulation, Swiss Federal Council, press release, 28 October 2026.
- Intelligence artificielle (Artificial intelligence), Federal Office of Justice, updated page (decision of 12 February 2025), accessed 10 November 2026.
- AI and data protection, FDPIC, 24 September 2025.
- Data Protection Day 2026, FDPIC, 28 January 2026.
- Federal Act on Data Protection (FADP), SR 235.1, Art. 7, 9, 12, 16, 19, 21, 22, 60 and 61, Swiss Confederation, in force since 1 September 2023.
- Data Protection Ordinance (DPO), SR 235.11, Art. 24, Swiss Confederation, in force since 1 September 2023.
Cover photo: Vitaly Gariev / Unsplash, Unsplash licence.
Tags: Swiss Data Protection Act, artificial intelligence, data protection, Switzerland, FDPIC, local AI