Swiss data protection and AI: the framework in practice

Switzerland has no dedicated artificial intelligence act and is unlikely to adopt one in the form of a single statute. That does not mean a legal vacuum: since 1 September 2023, the revised Federal Act on Data Protection (FADP, known in French as the nLPD) has governed any processing of personal data by an AI system. For a small or medium-sized business rolling out a chatbot or an analytics tool, this is the law that currently sets the rules.

A technology-neutral law

The Federal Data Protection and Information Commissioner (FDPIC) made the point plainly in a statement of 9 November 2023: because the FADP is drafted in technology-neutral terms, it applies directly to AI-based processing, whatever future regulation may bring. Several concrete expectations follow. Manufacturers, providers and users must be transparent about the purpose, functioning and data sources of the processing. Anyone talking to a chatbot is entitled to know that they are dealing with a machine, and whether their input is used to improve the system. Deepfakes showing identifiable people must be clearly labelled as such.

The FDPIC accepts high-risk processing provided adequate safeguards are in place. By contrast, it cites comprehensive real-time facial recognition and the social scoring of lifestyles as incompatible with the law.

The obligations that matter for an AI project

Four provisions of the FADP come up in almost every project.

Article	Obligation	What it means for AI
Art. 19	Duty to inform at collection	State the purpose, recipients and countries of processing, including the model provider
Art. 21	Automated individual decisions	Inform the person; on request, let them state their view and obtain human review
Art. 22	Data protection impact assessment	Required where risk is high, notably with new technologies
Art. 16	Disclosure abroad	Country recognised as adequate, or appropriate safeguards

Article 21 covers decisions based solely on automated processing that have a legal effect on the person or a significant adverse impact. It does not apply where the decision is directly linked to entering into or performing a contract and the person’s request is granted, or where the person has expressly consented to automation. A tool that screens job applications or rental files without genuine human involvement typically falls within its scope.

The impact assessment under Article 22 must be carried out before processing begins, describe the processing, assess the risks and set out safeguards. If a high risk remains despite those measures, the FDPIC must be consulted.

Transfers abroad: a frequent blind spot

Most large models are hosted outside Switzerland. Under Article 16, personal data may be disclosed abroad if the Federal Council has found that the destination country offers adequate protection (as it has for EU and EEA countries), or otherwise with appropriate safeguards, such as the European Commission’s standard contractual clauses adapted to Swiss law, which the FDPIC recognises. Since 15 September 2024 the United States has been on the list, but only for companies certified under the Swiss-US Data Privacy Framework. Checking the provider’s certification, or the existence of suitably adapted clauses, is therefore part of choosing a tool.

Sanctions under the FADP are aimed primarily at individuals: intentional breaches of certain duties, including the duty to inform, can lead to a fine of up to CHF 250,000.

The Federal Council’s approach: no Swiss “AI Act”

On 12 February 2025 the Federal Council set out its position. Switzerland intends to ratify the Council of Europe’s Framework Convention on Artificial Intelligence, which it signed in Strasbourg on 27 March 2025, and to incorporate it into Swiss law. Legislative changes are to be sector-specific wherever possible; general cross-sector rules would be limited to areas involving fundamental rights, such as data protection. Non-binding measures (self-declarations, industry solutions) are also planned. The Federal Department of Justice and Police is to present a draft for consultation by the end of 2026, covering transparency, data protection, non-discrimination and oversight. The stated objectives are to strengthen innovation, protect fundamental rights and build public trust.

The contrast with the EU AI Act

The European Union has taken the opposite route: a horizontal regulation based on levels of risk. The AI Act entered into force on 1 August 2024; its prohibitions and the AI literacy obligation (Article 4) have applied since 2 February 2025, the rules on general-purpose AI models since 2 August 2025, and most of the remaining provisions were scheduled for 2 August 2026. In November 2025 the Commission proposed, as part of a “digital omnibus”, to postpone the obligations for high-risk systems, at the latest to December 2027 or August 2028 depending on the category; at the time of writing the proposal is still before the Parliament and the Council.

For a Swiss company, the AI Act is not a theoretical matter. Its Article 2 applies to providers placing a system on the EU market wherever they are established, and to providers and deployers in third countries where the output of the system is used in the Union. A Geneva-based business serving French or German clients with an AI tool may therefore be caught.

Practical pointers for a small business

Without claiming to replace legal advice, a few habits make sense:

• keep an inventory of the AI tools in use, the data passing through them and where they are hosted;
• update the privacy notice to mention this processing;
• ban, or strictly control, the entry of personal and confidential data into consumer-grade tools;
• keep a human genuinely in charge of any decision affecting an individual;
• carry out an impact assessment as soon as processing looks high-risk;
• for any EU-facing activity, check whether the AI Act applies.

Key takeaways

The FADP has applied in full to AI since September 2023, as the FDPIC has expressly confirmed. Transparency, safeguards around automated decisions, impact assessments and control of transfers abroad form the core obligations. Switzerland is preparing targeted rules tied to the Council of Europe convention rather than an equivalent of the AI Act. Businesses serving the European market, however, already need to take the EU regulation into account, even though parts of its timetable are still shifting.