AI regulation in Switzerland

Switzerland governs AI through law it already has. There is no Swiss AI Act, and the Federal Council has decided not to write a horizontal one in the style of the EU. Organisations using AI in Switzerland work under the Federal Act on Data Protection, sector law and regulator guidance, while the federal government prepares targeted changes to ratify the Council of Europe AI Convention. This page sets out what applies as of October 2026 and what is coming.

What applies today

The Federal Act on Data Protection. The revised FADP has applied since 1 September 2023. The Federal Data Protection and Information Commissioner (FDPIC) has said it is technology neutral and directly applicable to AI-supported data processing. The FDPIC expects manufacturers, providers and users of AI to be transparent about the purpose, functioning and data sources of the processing. It says people have a right to know whether they are dealing with a machine, that deepfakes of identifiable people must be clearly indicated, and that high-risk AI processing needs a data protection impact assessment. It names comprehensive real-time facial recognition and social scoring as uses that undermine informational self-determination.

Article 21 and automated decisions. Where a decision based exclusively on automated processing has a legal consequence for a person or significantly adversely affects them, the controller must tell them, let them express their point of view on request, and let them ask for a natural person to review it. The FADP does not prohibit these decisions, which sets it apart from the GDPR. The detail is on the FADP Article 21 page.

FINMA for financial institutions. Banks, insurers and other supervised institutions follow FINMA Guidance 08/2024, published in December 2024. It expects a centrally managed AI inventory with risk classification, clear responsibilities, data quality rules, testing and monitoring, documentation, explainability and independent review of material applications.

Sector and general law. Product safety, medical devices, non-discrimination, unfair competition, employment and liability rules apply to AI as they apply to any other technology. The Federal Council named healthcare and transport among the sectors where work on AI rules continues.

What the Federal Council has decided

On 12 February 2025 the Federal Council decided that Switzerland intends to ratify the Council of Europe AI Convention and to amend Swiss law where needed to do so. Switzerland signed the Convention in Strasbourg on 27 March 2025.

According to the Federal Chancellery’s AI page, the Federal Department of Justice and Police is preparing a bill for consultation by the end of 2026, together with DETEC and the FDFA. It will implement the Convention, with a focus on transparency, data protection, non-discrimination and supervision. The amendments are to be mostly sector specific, with cross-sector rules limited to core areas of fundamental rights such as data protection. DETEC, with OFCOM leading the drafting, is preparing a plan for non-binding measures such as industry solutions and voluntary commitments, also by the end of 2026.

Ratification needs parliamentary approval and may be put to a referendum. Any new obligations for organisations will depend on what Parliament adopts, so the realistic horizon for them is several years away.

Where the EU AI Act comes in

Switzerland is not bound by the EU AI Act, but many Swiss organisations are. The Act applies to providers outside the EU that place AI systems or general-purpose AI models on the EU market, and to providers and deployers outside the EU where the output of their AI system is used in the EU. A Swiss medtech company, insurer, bank or software firm with EU customers may therefore carry EU AI Act obligations for some of its systems. Article 50 transparency duties have applied since 2 August 2026, and obligations for high-risk systems listed in Annex III apply from 2 December 2027.

What Swiss organisations are doing now

With no AI Act to follow, most Swiss organisations build their AI governance on the FADP, sector expectations and an international standard. The work is similar wherever they start.

• Know what AI you run. An inventory of AI systems, including AI inside purchased software, is the base for everything else and is the first thing FINMA asks for.
• Find the automated decisions. Identify which systems decide things about people with real effects, and set up the Article 21 notice, hearing and human review process for them.
• Assess the risk. Run a data protection impact assessment where the risk is high, and a wider AI risk and impact assessment for material systems.
• Pick a reference framework. ISO/IEC 42001 and the NIST AI RMF give a structure that also prepares an organisation for the EU AI Act and for whatever Swiss amendments follow.

Where Aicura fits

Aicura supports this work. The AI register keeps the inventory with owners and risk tiers, assessments hold the risk and impact work, oversight records where a person reviews decisions, and guardrails apply your rules to live AI traffic. Essentials adds assessment against the FDPIC’s guidance on AI, and Pro adds ISO/IEC 42001, the NIST AI RMF and FINMA’s AI governance expectations. It supports the work and the decisions stay with you.