The AI Act, Regulation (EU) 2024/1689 on artificial intelligence (AI), does not stop at the border: a Swiss company is subject to it as soon as it places an AI system on the European Union (EU) market or the output of its system is used there. The text has applied since 2 August 2026, but its rules on high-risk AI have been postponed to 2 December 2027 and 2 August 2028. Switzerland is taking another path, that of the Council of Europe convention, with a consultation planned for spring 2027.

The Swiss law in preparation is described in detail on our page on AI regulation in Switzerland.

Key figures

  • 4 risk levels: unacceptable, high, transparency, minimal or none.
  • 9 prohibited AI practices, 8 of them since 2 February 2025.
  • 2 December 2027: rules for high-risk AI in sensitive areas (Annex III).
  • 2 August 2028: rules for high-risk AI built into regulated products (Annex I).
  • 35 million euros or 7% of worldwide annual turnover: maximum fine for a prohibited practice.
  • Spring 2027: planned opening of the consultation on the Swiss rules.

When does a Swiss company fall under the AI Act?

The criterion is not where the company is headquartered, but the market it targets and where the output is used. Article 2 of the regulation, consolidated as of 27 July 2026 by the European Commission's service desk, covers in particular:

  • providers that place on the market or put into service an AI system in the EU, or place a general-purpose AI model there, whether they are established in the EU or in a third country;
  • providers and deployers established in a third country, where the output produced by the AI system is used in the EU;
  • deployers established or located in the EU;
  • importers, distributors and authorised representatives of providers not established in the EU.

The provider places the system on the market or puts it into service; the deployer uses it in its business. According to recital 22, the rule on output prevents a European operator from circumventing the text by entrusting a high-risk task to a service provider outside the EU.

Purely personal use, scientific research alone and exclusively military or defence uses are excluded. Free and open-source software is also excluded, unless it is high-risk, prohibited or subject to transparency obligations.

Our analysis: a Swiss company with no customers, no users and no output used in the EU remains outside the scope. Conversely, a Swiss software publisher selling CV-sorting software to recruiters in France would be the provider of a high-risk system, because the Commission lists this case among high-risk uses.

How does the AI Act classify risks?

The regulation targets specific uses, classified into four levels. The table uses the examples from the Commission's page on AI legislation.

LevelExamples cited by the CommissionConsequence
UnacceptableSocial scoring, emotion recognition in the workplace and at school, untargeted scraping of images for facial recognition, "nudification" appsProhibited
HighCV sorting, credit scoring, exam scoring, safety components of critical infrastructure, robot-assisted surgeryStrict obligations before being placed on the market
TransparencyChatbots, AI-generated content, deepfakesInform, make identifiable, label
Minimal or noneSpam filters, AI-enabled video gamesNo new rules

According to the Commission, the vast majority of AI systems used in the EU fall into the minimal-risk category. General-purpose AI models, which serve as the basis for many systems, have their own transparency and copyright rules.

What is the application timeline after the digital omnibus?

The regulation entered into force on 1 August 2024 and applies in stages. The timeline was amended by Regulation (EU) 2026/1744 of 8 July 2026, known as the "digital omnibus package on AI", published in the Official Journal of the EU on 24 July 2026.

DateWhat applies
2 February 2025Prohibited practices (the first eight) and AI literacy
2 August 2025Governance and rules for general-purpose AI models
2 August 2026General application, including the transparency rules; enforcement by the AI Office and national authorities
December 2026Ninth prohibition: AI-generated non-consensual intimate content and child sexual abuse material
2 December 2027High-risk AI in sensitive areas (Annex III): biometrics, critical infrastructure, education, employment, migration
2 August 2028High-risk AI built into products such as lifts or toys (Annex I)

According to the Commission, the omnibus was proposed on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026. Its recitals cite delays in technical standards and national authorities. A dated example: on 19 October 2026, the Commission announced the publication in the Official Journal of the first harmonised standard supporting the regulation.

The postponement shifts the deadlines without removing any obligation. According to the Commission, the rules will apply once companies have the necessary tools, such as standards.

Provider or deployer: what are the obligations?

The provider of a high-risk system bears most of the obligations. Before placing it on the market, the Commission lists seven:

  • a risk assessment and mitigation system;
  • high-quality datasets, to limit discriminatory outcomes;
  • logging of activity, to trace results;
  • detailed documentation, so that authorities can assess compliance;
  • clear information for the deployer;
  • appropriate human oversight measures;
  • a high level of robustness, cybersecurity and accuracy.

After placing the system on the market, the provider maintains a monitoring system. The deployer ensures human oversight and monitoring of the system. Both report serious incidents and malfunctions. The regulation also covers authorised representatives of providers established outside the EU; their obligations are set out in Article 22.

Transparency affects a wider audience. People must know that they are interacting with a chatbot. Providers of generative AI make content identifiable. Deepfakes and texts published to inform the public on matters of public interest must be labelled.

Article 4 required all providers and deployers to ensure AI literacy among their staff. The omnibus relaxes this: they must now take measures to support it, as the original obligation weighed mainly on small businesses, according to its recitals.

The omnibus also extends to small mid-cap companies relief measures intended for small and medium-sized enterprises (SMEs), including simplified technical documentation. The AI Act does not replace the General Data Protection Regulation (GDPR), which its Article 2 leaves untouched. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) pointed out on 24 September 2025 that the new Federal Act on Data Protection (nFADP) applies directly to data processing using AI.

What penalties does a company face?

EU member states set the penalties, within the limits of Article 99 of the regulation. The caps are as follows:

  • prohibited practice: up to 35 million euros or 7% of worldwide annual turnover, whichever is higher;
  • breach of the obligations of providers, authorised representatives, importers, distributors, deployers or of the transparency rules: up to 15 million euros or 3%;
  • incorrect or misleading information supplied to authorities: up to 7.5 million euros or 1%.

For an SME or a start-up, the lower of the two amounts serves as the cap. Since the omnibus, this rule also applies to small mid-cap companies, except for prohibited practices.

Will Switzerland adopt the AI Act?

Nothing in the published decisions points to it. According to the Federal Office of Justice (FOJ), Switzerland currently has no AI-specific legislation. On 12 February 2025, the Federal Council decided to ratify the Council of Europe AI convention and instructed the Federal Department of Justice and Police (FDJP) to draw up a preliminary draft of rules by the end of 2026.

In its press release of 28 October 2026, the Federal Council states that the FOJ is preparing the binding measures: transparency, data protection, non-discrimination, oversight and risk assessment. The opening of the consultation is now planned for spring 2027. These are still plans: no new obligation yet applies to companies in Switzerland on this basis.

The Federal Office of Communications (OFCOM) coordinates the non-binding measures. Its guide helps associations and companies draft a code on AI, with modules on ten topics and three levels of detail.

The EU ratified this framework convention (CETS No. 225) on 15 May 2026, according to the Council of Europe. Our analysis: the EU additionally has a detailed regulation, the AI Act, whereas Switzerland is preparing targeted measures. A company active on both sides will therefore follow two separate frameworks, which our section on the legal framework for AI tracks.

What should a Swiss company do now?

Our analysis, based on the texts cited:

  • inventory the AI systems developed, sold or used whose output is used in the EU, and its role for each one;
  • classify each use according to the four levels and rule out any prohibited practice;
  • apply transparency and train the staff concerned;
  • for a high-risk system sold in the EU, prepare risk management, documentation and logging before 2 December 2027 or 2 August 2028, and check the obligations relating to the authorised representative (Article 22);
  • follow the Swiss consultation announced for spring 2027.

The Commission's voluntary AI Pact invites providers and deployers "from Europe and beyond" to comply with the main obligations of the text.

What we do not know yet

  • The content of the Swiss preliminary draft: the Federal Council has published only its topics, and the consultation has not opened.
  • The approach Switzerland will choose to apply the convention to the private sector, which the Federal Council has not yet specified.

Sources