The Swiss position: no AI act, and why that changes little

Switzerland has no AI act. It is not going to have one in the shape the EU has one. Practitioners who read that as breathing space are misreading the position, because the duties that matter to an AI programme are already in force under general data protection law and sector supervision.

The Federal Council decision

On 12 February 2025 the Federal Council set the direction: ratify the Council of Europe Framework Convention on artificial intelligence, make only the legislative amendments necessary to do so, and otherwise regulate sector by sector rather than through a horizontal statute. A consultation draft was mandated by the end of 2026; as at 24 September 2026 it has not opened.

Switzerland signed the Framework Convention (CETS 225) on 27 March 2025 and has not ratified it. Do not describe Switzerland as bound by the Convention, and do not build a control on the assumption that its provisions are directly applicable. Signature signals intent; ratification creates the obligation.

The practical meaning of sector-by-sector regulation is that a Swiss insurer's AI duties arrive through FINMA and through data protection law, not through a single instrument with a compliance deadline. There is no date to plan towards, which makes the work harder to schedule and no less required.

The FDPIC position, which removes the excuse

The Federal Data Protection and Information Commissioner has stated, from 9 November 2023 and restated since, that the Federal Act on Data Protection is technology-neutral and directly applicable to AI. There is no gap and nothing to wait for. The FDPIC has named real-time comprehensive facial recognition and social scoring as impermissible, and has investigated X over Grok training data.

That position is the answer to the most common internal argument in a Swiss firm, which is that AI governance can wait for legislation. The supervisor has said in terms that the existing law already applies.

The revFADP provisions an AI programme actually runs on

The revised Act (SR 235.1) has been in force since 1 September 2023. Four clusters matter.

Article 19 is the duty to inform on collection: the controller's identity and contact details, the purpose of processing, the recipients or categories of recipients, and for a transfer abroad, the state concerned and the safeguard relied on. Article 20 sets the exceptions. For an AI programme this is where disclosure obligations bite on data flowing to a model provider abroad.

Article 21 governs automated individual decision-making: a decision based exclusively on automated processing with a legal consequence or a significant effect on the person. Three duties follow: inform the data subject that the decision is automated; on request, allow them to state their position; and allow them to request review by a natural person. Article 25(2) adds that the right of access includes information on the logic of the decision. That is the provision to design explainability against for Swiss customers, and it is narrower and more concrete than the explainability discussion usually held internally.

Articles 22 and 23 require a data protection impact assessment where processing entails a high risk to personality or fundamental rights, in particular extensive processing of sensitive data or systematic monitoring of large public areas, and require consultation with the FDPIC where high residual risk remains. Article 12 requires a register of processing activities, with an exemption for organisations under 250 employees that falls away for large-scale sensitive data processing or high-risk profiling.

Article 24 requires notification of a data security breach to the FDPIC as soon as possible. There is no 72-hour deadline in Swiss law. Programmes that copy a GDPR playbook into a Swiss policy import a deadline that does not exist, and then miss the actual standard, which is a promptness test rather than a clock.

Structure, penalties and reach

The revFADP does not use the GDPR legal-basis model for private controllers. Processing that breaches personality under Article 30 is justified under Article 31 by consent, an overriding private or public interest, or law. Article 34(2) requires federal bodies to have a statutory basis. Article 6 sets the processing principles: lawfulness, good faith, proportionality, purpose limitation and accuracy. Article 8 covers data security.

Penalties fall on responsible natural persons, with fines up to CHF 250,000 for wilful breaches including the Article 21 information duty. That is a materially different incentive structure from corporate fines and worth stating plainly to the individuals holding these duties.

Article 3 gives the Act extraterritorial effect, and Articles 14 and 15 require a Swiss representative for certain foreign controllers.

Worked example: a Swiss health insurer with EU policyholders

A Swiss health insurer deploys a model that assesses risk and sets premiums, including for a book of cross-border policyholders resident in the EU.

Under Swiss law: a register entry under Article 12; a data protection impact assessment under Articles 22 and 23, since health data is sensitive and the processing is extensive; Article 19 information on collection; and, if the pricing decision is taken exclusively by automated means with significant effect, the full Article 21 set plus Article 25(2) logic disclosure.

Under EU law, because the output is used in the Union, the insurer is within Article 2(1) reach, and risk assessment and pricing in health insurance is an Annex III category from 2 December 2027, carrying the Article 26 deployer set and an Article 27 fundamental rights impact assessment.

One model, two regimes, no Swiss AI act involved. The Swiss duties are live today and the EU duties have a date. The programme that treats "no Swiss AI act" as the headline has the sequencing exactly backwards.

As of 24 September 2026.