AI compliance in Switzerland: GDPR, FADP and the EU AI Act

Swiss companies using AI face three overlapping frameworks: the revised Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the EU AI Act. Which ones apply depends less on where a company is based than on whose data it processes and where its AI systems and outputs are used.

Does the GDPR apply to Swiss companies?

Yes, in many cases. The GDPR applies to Swiss companies that offer goods or services to people in the EU, or that monitor the behaviour of people in the EU — for example through online tracking or profiling. It also applies to EU subsidiaries and EU establishments of Swiss groups.

For AI, this means that a model trained on, or making decisions about, EU residents' personal data can bring a Swiss company within the GDPR's scope.

What does the Swiss FADP require for AI?

The revised FADP, in force since 1 September 2023, applies to AI systems that process personal data. The Federal Data Protection and Information Commissioner has confirmed that it is directly applicable to AI. In practice, this means transparency about the purpose and logic of processing, data protection by design and by default, a data protection impact assessment when processing is likely to create a high risk, and information to individuals about automated individual decisions.

When does the EU AI Act apply to Swiss companies?

The EU AI Act applies regardless of where a company is established when it places AI systems on the EU market, puts them into service in the EU, or when the output of its AI systems is used in the EU. Obligations are being phased in: prohibited practices since February 2025, general-purpose AI model obligations since August 2025, and most high-risk system obligations from August 2026.

The question for Swiss boards is not whether AI regulation applies, but which combination applies to each AI use case.

What about a Swiss AI law?

Switzerland has chosen not to adopt a single, comprehensive AI act. Instead, the Federal Council intends to ratify the Council of Europe's AI Convention and adapt existing laws where needed, with a consultation draft expected by the end of 2026. Until then, AI governance in Switzerland rests on the FADP and sector-specific rules — for example in financial services.

A practical compliance checklist for Swiss boards

1. Map every AI use case: what data it uses, whose data it is, and where its outputs are used.
2. Classify each use case against the FADP, the GDPR and the EU AI Act risk categories.
3. Run data protection impact assessments for high-risk processing.
4. Assign clear ownership and human oversight for each AI system.
5. Document decisions so they hold up under scrutiny from regulators, customers and auditors.

Compliance is the floor, not the ceiling. The organisations that map these obligations early are also the ones that deploy AI faster, because the questions are answered before projects scale.

Learn how StratEdge supports Boards: For Boards