What changes the moment a feature switches on

A feature arriving by vendor update does not create a grace period. The duties attach on use. What follows is the short list of things that become true immediately, and who they fall on.

Someone must have read the instructions for use

Article 26 requires the deployer to use a system according to the instructions that came with it. For a high-risk system, Article 13(3) says what those instructions must contain: the provider's identity; the system's characteristics, capabilities and performance limitations, including the accuracy metrics it was validated against; the risks from foreseeable misuse; pre-determined changes; the human oversight measures; the computational and hardware resources, expected lifetime and maintenance; and how to interpret the logs.

Read that list as a shopping list rather than a formality. It tells you what a responsible vendor has to be able to answer. If a feature is high-risk in your use and the vendor's documentation is a marketing page with no accuracy figures and no statement of limitations, you have a problem that predates any incident.

Transparency to the people in front of it

Article 50 applies from 2 August 2026 and was not deferred by the Digital Omnibus. Three parts of it reach ordinary workplace features.

• Article 50(1): people must be informed they are interacting with an AI system, unless that is obvious. A support chat widget that answers in fluent prose is the case this was written for.
• Article 50(2): providers of systems generating synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificially generated.
• Article 50(4): deepfake disclosure, with a limited exception for evidently artistic, creative, satirical or fictional work, and disclosure for text published to inform the public on matters of public interest unless there is human review with named editorial responsibility.

The trap is assuming 50(2) discharges 50(4). It does not. The Commission's guidance requires a visible or audible label that a person can understand without a detection tool. A deployer cannot point at the provider's invisible watermark and call the disclosure done. The marking grace period for systems already on the market before 2 August 2026 ends 2 December 2026.

The data question, which is usually the urgent one

When a feature summarises your mailbox, the content of that mailbox becomes input. Under the revised Swiss Federal Act on Data Protection, processing must satisfy the Article 6 principles: lawfulness, good faith, proportionality, purpose limitation and accuracy. Article 8 requires data security. If the new feature sends content to a processor outside Switzerland, Article 19 requires the duty to inform on collection to cover the state and the safeguard relied on.

Switzerland does not use the GDPR model of a legal basis for private controllers. Processing by a private controller that breaches personality under Article 30 needs a justification under Article 31: consent, an overriding private or public interest, or law. Federal bodies are different again: Article 34(2) requires a statutory basis.

One thing to be clear about, because it is widely taught wrongly: Article 24 requires notification of a data security breach to the FDPIC as soon as possible. There is no seventy-two hour deadline in Swiss law. If your incident runbook contains one, it came from the GDPR and somebody copied it across.

Logs

Article 12 requires high-risk systems to log events automatically over their lifetime. Article 26(6) puts a retention duty on the deployer: keep the logs for at least six months. Article 19 imposes the same minimum on providers. For a vendor feature you do not control, this becomes a procurement question: can you export the logs, and does the vendor keep them long enough that you can meet your own duty?

The honest position on scale

Nothing above is proportionate to run for every autocomplete suggestion, and the law does not ask you to. Article 4 on AI literacy is explicitly proportionate to role and context, and Article 17's quality management duty is proportionate to the size of the organisation. Proportionate does not mean optional. It means you should be able to explain why a given feature got five minutes and another got five weeks.

As of 24 September 2026.