AI Under Swiss Law and GDPR: What Companies Must Know

Your company has just launched a new AI chatbot that reads customer emails, organizes data, and makes small decisions automatically. But is it legally allowed to do all these things? Understanding AI Under Swiss Law and GDPR can be challenging because Switzerland does not yet have a single law covering all AI systems. Instead, businesses must follow existing regulations, including Swiss data protection law and, in many cases, the EU’s GDPR. This creates confusion for business owners who may assume Switzerland has no AI rules or that GDPR covers every situation. In this article, we’ll explain the current legal requirements, upcoming changes, and practical steps your company can take to stay compliant.

Why There’s No Single “Swiss AI Law” (Yet)

Unlike the European Union, Switzerland has not passed a dedicated AI law. There’s no Swiss version of the EU AI Act sitting on the books today.

Instead, on February 12, 2025, the Swiss Federal Council chose a different path. Rather than writing one big law for all AI systems, it decided to rely mainly on existing sector laws, such as those covering health, finance, and data protection, updating them only where genuinely necessary, and to treat cross-sector regulation as the exception rather than the rule.

The Council of Europe AI Convention

On March 27, 2025, Switzerland signed the Council of Europe’s Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law. Signing is not the same as ratifying, however. The convention is not yet part of Swiss law, and ratification will also need parliamentary approval, and possibly a public referendum.

The Federal Department of Justice and Police, working with the Federal Department of the Environment, Transport, Energy and Communications and the Federal Department of Foreign Affairs, is preparing a draft bill to bring this convention into Swiss law. That draft is expected to go out for public consultation by the end of 2026. So nothing changes overnight, but change is coming.

What This Means for Businesses Today

Right now, if you use AI in Switzerland, you are not operating in a legal vacuum. You still must follow existing laws, especially data protection rules, along with sector-specific rules if you’re in a regulated industry like finance or healthcare. Think of it like driving a new type of car on old roads. The roads (laws) still apply, even if no one wrote them with your exact vehicle in mind.

Swiss AI Law and GDPR Compliance: How They Connect

Many Swiss companies ask the same thing: “Do I need to follow GDPR if I’m not in the EU?” The honest answer is: often, yes.

The Revised Swiss Data Protection Act (FADP)

Switzerland’s main privacy law is the revised Federal Act on Data Protection, or FADP (in German, revDSG). It came into force on September 1, 2023. The Federal Data Protection and Information Commissioner (FDPIC) has confirmed that this law applies directly to AI-supported data processing, even without a dedicated AI law, because the FADP is written to be technology-neutral.

That means it doesn’t name “AI” specifically, but its rules still apply whenever an AI tool touches personal information. In short, if your AI system handles names, emails, health data, or behavior patterns, the FADP already governs you. The FDPIC has also flagged that certain uses, like real-time mass facial recognition or comprehensive “social scoring” of individuals, would be prohibited under existing data protection principles regardless of any future AI law.

When GDPR Also Applies

GDPR is the European Union’s data protection law. Switzerland is not an EU member, so GDPR doesn’t apply automatically nationwide. But it applies to individual Swiss companies in specific situations, mainly when they:

• Offer goods or services to people in the EU
• Monitor the online behavior of people located in the EU
• Process personal data on behalf of an EU-based client, under a data processing agreement

For example, a Swiss software company selling an AI tool to customers across the EU would likely need to follow both the FADP and GDPR at the same time for those EU-facing activities. This is common for firms with any EU customer base, however small.

Where the Two Laws Overlap and Differ

The FADP and GDPR share core principles, including transparency, data minimization, and the right to know how personal data is used. However, their compliance requirements differ in several important ways. Under the GDPR, companies can face administrative fines of up to €20 million or 4% of their global annual turnover, whichever is higher. In contrast, the FADP generally imposes criminal fines on responsible individuals, such as managers or data protection leads, up to CHF 250,000. Companies can face direct fines in limited cases, such as when identifying the responsible person would require disproportionate effort and the fine would not exceed CHF 50,000. Another difference is that the FADP does not generally require private companies to appoint a formal Data Protection Officer, unlike the GDPR in certain situations. The FADP also requires organizations to report data breaches to the relevant authority as soon as possible, while the GDPR generally sets a 72-hour deadline. Additionally, the FADP can apply to data processing carried out abroad if it produces effects in Switzerland, even when the company and its servers are located elsewhere.

Recommended table

Although the FADP and GDPR share similar privacy principles, their requirements and enforcement differ. Swiss businesses should assess which laws apply to their activities and review their AI systems accordingly.

AI Data Protection in Switzerland: Core Requirements

Let’s get practical. If you’re using AI and personal data in Switzerland, here’s what actually matters.

Transparency About How AI Uses Data

Under the FADP, you must tell people, clearly, what data your AI system collects, why it collects it, and where that data comes from. You can’t hide this in page 40 of a privacy policy nobody reads.

For instance, if a hiring AI screens job applications, candidates have a right to know that an AI system reviewed their resume, not just a human recruiter.

Automated Decision-Making Rules

The FADP has a specific provision, Article 21, on automated individual decisions. If an AI system makes a decision exclusively through automated processing, and that decision has a legal effect or a similarly significant impact on someone, such as denying a loan or a job offer, the affected person generally has the right to be informed and to request that a human review the decision.

This matters more than many companies realize. If your AI approves or rejects things automatically with no human in the loop, you need a documented process for people to challenge that outcome. Tools like AI lead scoring are a common example: if a system automatically ranks or filters people based on their data, it’s worth checking whether that counts as an automated decision under the FADP or GDPR.

Data Protection Impact Assessments

When AI processing involves high risk to people’s rights, Swiss law (Article 22 FADP) expects a data protection impact assessment before the processing begins. Think of this as a checklist: What data are we using? What could go wrong? How do we limit harm?

This isn’t optional paperwork. It’s meant to catch problems before they hurt real people. A hospital testing an AI diagnostic tool, for example, should run this assessment before rolling it out to patients.

Data Minimization and Purpose Limitation

AI models often need large amounts of data, but collecting too much can create privacy risks. Businesses should understand the data challenges in generative AI, including data privacy, bias, outdated information, and copyright concerns. Swiss law also expects companies to collect only the personal data necessary for their stated purpose. For example, a customer service chatbot usually doesn’t need access to someone’s full medical history.

GDPR Requirements for AI Companies: A Closer Look

If GDPR applies to your AI business, here are the specific areas regulators focus on.

Lawful Basis for Processing

You need a valid legal reason to process personal data through AI, such as consent, contract necessity, or legitimate interest. Consent used to train AI models is especially tricky, since people must clearly understand and agree to that specific use, and pre-ticked boxes or buried clauses don’t count as valid consent under GDPR.

Data Subject Rights

Under GDPR, people can ask what data you hold, request corrections, or ask for deletion. This gets complicated with AI, because it’s hard to fully “delete” data that’s already baked into a trained model’s parameters. Companies need a real, documented plan for handling these requests, not just a promise in a privacy policy.

Data Protection by Design and Default

GDPR expects privacy safeguards to be built into your AI system from day one, not bolted on afterward. This includes things like anonymizing or pseudonymizing data where possible and limiting who inside your company can access raw personal data.

Do You Need a Data Protection Officer?

Under GDPR, you generally need to appoint a Data Protection Officer if your core activities involve large-scale, regular monitoring of individuals, or large-scale processing of sensitive data categories. Many AI-driven products, especially ones built on profiling or behavioral tracking, fall into this bucket. The FADP does not impose an equivalent mandatory requirement on private companies, though appointing someone responsible for data protection is still good practice.

Cross-Border Data Transfers

If your AI system sends EU personal data to servers outside Europe, GDPR has rules about how that transfer must happen safely, typically through standard contractual clauses, an adequacy decision, or another approved safeguard. Similar rules exist under the FADP for transfers out of Switzerland.

Swiss AI Compliance Requirements: A Practical Checklist

Here’s a simple starting checklist for Swiss companies using AI. It overlaps closely with general AI governance best practices, since good governance and good data protection compliance largely rely on the same habits: knowing what you’re using, who owns it, and how data flows through it.

Step 1: Map Your AI Systems

List every AI tool your company uses or builds, from chatbots to hiring software to fraud detection tools. You can’t manage risk you haven’t identified.

Step 2: Identify Personal Data Flows

For each AI tool, ask: does it touch personal data? Where does that data come from, and where does it go? This step often reveals surprises, like a marketing tool quietly sending customer data to an AI vendor based outside Switzerland.

Step 3: Check If GDPR Applies

Review whether you have EU customers, EU website visitors you track, or EU-based data processing partners. If yes, GDPR likely applies alongside the FADP for those activities.

Step 4: Run Risk and Impact Assessments

For higher-risk AI uses, like anything involving health data, financial decisions, or hiring, complete a data protection impact assessment before launch.

Step 5: Build Transparency Into Your Products

Make sure your privacy notices actually explain your AI use in plain language. Avoid vague phrases like “we may use automated tools.” Say what the tool does.

Step 6: Review Vendor and AI Tool Contracts

If you use third-party AI tools or APIs, check whether the vendor acts as a data processor under a proper data processing agreement, and where your data is actually stored and processed.

Step 7: Watch the EU AI Act Too

Even though Switzerland has no AI Act of its own, the EU AI Act has extraterritorial reach. Since August 2, 2026, its core obligations, including rules for high-risk systems and general-purpose AI models, apply broadly. If your AI system is placed on the EU market or its output is used there, you may fall under it even as a Swiss company.

Advantages and Disadvantages of Switzerland’s Approach

Switzerland’s decision to avoid a single, comprehensive AI law, unlike the EU, comes with real trade-offs for businesses.

Advantages:

• More flexibility for companies to innovate without a rigid, one-size-fits-all rulebook
• Fewer immediate new compliance burdens compared to companies operating fully under the EU AI Act
• Rules stay grounded in sector expertise (finance, health, etc.) rather than a generic framework

Disadvantages:

• More legal uncertainty, especially around AI training data, copyright, and liability for AI-generated outcomes
• Companies must piece together obligations from several laws instead of one clear source
• Swiss companies with EU customers still can’t avoid GDPR and the EU AI Act, so the “lighter” domestic approach doesn’t remove EU-side compliance work

What’s Changing: Keep an Eye on 2026 and Beyond

This is a fast-moving area, and what’s true today may shift soon, much like the broader pace of AI regulation and industry change happening globally. A few things to track:

• A Swiss consultation draft implementing the Council of Europe AI Convention is expected by the end of 2026, focused on transparency, data protection, non-discrimination, and supervision.
• Federal offices are also expected to draw up an implementation plan by the end of 2026 for non-binding measures, such as self-declaration frameworks or industry-led initiatives.
• The EU AI Act’s core obligations for high-risk systems and general-purpose AI models became applicable on August 2, 2026, with further requirements phasing in through August 2027.

Because none of this is fully settled, it’s worth checking official sources like the FDPIC’s website or admin.ch every few months rather than relying on older articles, including this one.

FAQ: AI Under Swiss Law and GDPR

Does Switzerland have a specific AI law?

No, not yet. Switzerland currently regulates AI through existing laws, mainly the FADP, along with sector-specific rules. A draft law implementing the Council of Europe AI Convention is expected for public consultation by the end of 2026.

Do Swiss companies need to follow GDPR?

Only if they offer goods or services to people in the EU, monitor EU-based individuals’ online behavior, or process data for EU clients. A purely domestic Swiss business with no EU customers generally doesn’t need full GDPR compliance, but should still follow the FADP.

What happens if my AI system processes personal data without following the FADP?

Depending on the violation, individuals responsible (often managers or data protection leads) can face criminal fines of up to CHF 250,000, and the FDPIC can open an investigation and issue binding orders. Non-compliance can also damage customer trust, which is often costlier than any fine.

Is the EU AI Act relevant to Swiss businesses?

Yes, in many cases. The EU AI Act applies to companies outside the EU if their AI systems are placed on the EU market or their outputs are used there. Since August 2026, key obligations for high-risk systems and general-purpose AI models apply to qualifying companies, including Swiss ones.

How is Swiss AI regulation different from the EU AI Act?

The EU AI Act is one large, unified law covering AI risk categories, with company-level fines. Switzerland is taking a sector-specific approach instead, adjusting existing laws rather than creating one comprehensive AI statute, and relying on individual (not company) criminal liability under its data protection law in the meantime.

Conclusion

Understanding AI Under Swiss Law and GDPR doesn’t require a law degree, but it does require careful attention. Although Switzerland has no dedicated AI law, AI tools must still comply with the Swiss Federal Act on Data Protection (FADP) and, in many cases, the EU’s GDPR. Businesses should map their AI systems, understand how data flows, and ensure transparency when using AI tools. Since regulations may evolve through 2026 and beyond, compliance should be an ongoing process rather than a one-time task. If you’re unsure about your company’s legal obligations, consult a data protection specialist to review your AI tools and data practices before problems arise.

Disclaimer: This article is for general information only and is not legal advice. Data protection and AI rules vary by situation, and Swiss and EU regulation in this area is still developing. Speak with a qualified lawyer or data protection specialist before making compliance decisions for your business.