In Switzerland, data protection law applies directly to artificial intelligence (AI). The Federal Data Protection and Information Commissioner (FDPIC) restated this on 24 September 2025, in a note entitled “IA et protection des données”. An AI tool that processes personal data therefore falls under the Federal Act on Data Protection, often called the nFADP, and under the Commissioner's supervision.

This page deals with data protection alone. The overview of the framework, with political positions and voluntary commitments, is on our page on AI regulation in Switzerland. According to the sources consulted, no general AI law is in force there.

Key figures

  • 24 September 2025: FDPIC note “IA et protection des données”.
  • 455 data security breach notifications received by the FDPIC in 2026, up to 25 October, against 343 for the whole of 2025.
  • Fewer than one company in five has a person validate all of its generative AI content, according to the swissVR Monitor.
  • 76% of people surveyed by the DigitalBarometer 2026 put data protection ahead of convenience.
  • 5 September 2024: the Council of Europe Framework Convention on AI opened for signature; Switzerland has signed it.
  • Early 2027: deadline for a preliminary draft of AI regulation, according to the SME portal of the State Secretariat for Economic Affairs (SECO).

Does data protection apply to AI in Switzerland?

Yes, without waiting for an AI-specific text. In its note of 24 September 2025, the FDPIC observes that AI is increasingly part of people's daily lives. It concludes that Swiss data protection law is directly applicable to data processing that uses AI.

The criterion is therefore not the technology but the data being processed. Our analysis: as soon as a chatbot or an AI agent handles customer or employee data, the nFADP applies just as it does to any other software. The text of the law can be consulted on Fedlex, the publication platform for federal law, which lists it among its selected texts.

The rule also applies to federal bodies. The FDPIC sits, together with the Federal Office for Cybersecurity (FOCS) and the State Secretariat for Security Policy (SEPOS), in the security cluster of the Federal Chancellery's AI competence network. This arrangement is described on our page on AI in the federal administration.

For banks and insurers, personal data questions are also a matter for the FDPIC, as explained on our page FINMA and artificial intelligence.

What can the FDPIC do about a use of AI?

The FDPIC is an independent authority. According to its website, it ensures that federal bodies and private companies do not process personal data unlawfully. Each year it submits an activity report to the Federal Assembly; the latest edition is listed there under 29 June 2026.

Its strongest tool is the formal investigation. It opens one against a company when there are indications of a possible breach of data protection rules. The sources consulted mention no investigation targeting an AI tool.

A dated example: on 23 October 2026, the Commissioner opened a formal investigation against PK Softech, a software supplier to several Swiss pension funds, following a cyberattack. According to his press release of 24 October 2026, reported by Keystone-ATS, he wants to establish what data was entrusted to the provider, the legal framework for these transfers and how it is applied in practice.

Our analysis: this case does not involve AI, but it shows the method. The Commissioner traces the entire processing chain, from the client to its supplier. A company that entrusts data to an AI service is exposed to the same questions.

Adrian Lobsiger, the Federal Commissioner, also monitors data breach notifications, according to an interview reported by Keystone-ATS on 25 October 2026. He describes the threat linked to AI as “real”, without ranking it first. In the vast majority of reported cases, the weak point is human error. His office also notes that the interconnection of data and the removal of silos increase the risk of breaches.

Note: the “Information” in the Commissioner's title refers to access to official documents, under the Freedom of Information Act (FoIA), not to algorithms.

What transparency requirements apply to AI?

The public summary of the FDPIC note does not detail AI-specific duties to inform. The most precise reference points come from a treaty, the Council of Europe AI convention, opened for signature on 5 September 2024 and signed by Switzerland.

This text notably requires States:

  • to inform people that they are interacting with an AI and not with a human;
  • to document AI systems and their use, and to make this information accessible to the people concerned;
  • to provide enough information to challenge a decision made by means of an AI.

These obligations are aimed at States, not directly at companies. According to SECO's SME portal, Switzerland has committed to adapting its law accordingly, with a preliminary draft expected by early 2027. The Digital Switzerland action plan entrusts the implementing legislative project to the Federal Office of Justice (FOJ). Until that text is known, these requirements remain reference points, not rules applicable to companies.

Can data be entrusted to an AI hosted outside Switzerland?

The sources consulted do not detail the legal conditions for transferring personal data abroad. They do, however, show why the question arises with AI. According to Cyril Louis, managing director of Mavericx, an IT consultancy based in Geneva and Zurich, AI agents can depend on several language models and external services. Not all of them are operated in Switzerland, he explained to PME magazine.

Alexandre Buga, quoted by the same magazine, points out that an SME must comply with Swiss data protection legislation, including in its choice of tool. Before passing on customer, supplier or employee data, it needs to know:

  • where this data is processed;
  • for what purposes it may be reused;
  • who can access it.

The risk is real. On 16 October 2026, the FOCS warned that entering confidential information into an AI without precautions can expose that data. The specialist site TechRadar Pro described the mechanism on 28 October 2026: without a business contract, data entered into an AI assistant can be passed on to the provider and stored. Depending on the applicable terms, it can even be used to train the models.

Swiss providers are responding to this concern. Elca, a Swiss IT group, offers a sovereign AI platform where data and models remain under the client's control.

What does this change for an SME in Switzerland?

For a small or medium-sized enterprise (SME), the nFADP is the first rule to observe with AI. The recommendations of the Commissioner and the experts quoted translate into simple steps:

  • pass on to an AI tool only the data that is strictly necessary, as the FDPIC recommends;
  • preferably work with anonymised test data, another recommendation from the Commissioner;
  • choose a professional tool and set internal rules on which data is allowed, according to Alexandre Buga;
  • check the place of processing, possible reuses and access rights before sending anything;
  • have a person validate content produced by AI, a practice that is still rare according to the swissVR Monitor.

For questions, the FDPIC hotline answers Monday to Friday, from 10 a.m. to 11:30 a.m., on 058 462 43 95. Other articles on the legal framework for AI are gathered in our section.

What we don't know yet

  • The detailed content of the FDPIC note of 24 September 2025, beyond its public summary.
  • The legal conditions for transferring data to an AI provider established abroad: the sources consulted do not detail them.
  • The duties to inform that the nFADP specifically imposes on a decision made by an AI.
  • The exact criteria and deadline for notifying a data breach under the nFADP.
  • The content of the preliminary draft expected by early 2027, and the approach Switzerland has chosen to apply the convention to the private sector.

Sources

  • Federal Data Protection and Information Commissioner, FDPIC home page, including the summary of the note “IA et protection des données” of 24 September 2025
  • Fedlex, collection of federal law, Federal Act on Data Protection
  • SWI swissinfo.ch (Keystone-ATS), 24 and 25 October 2026, on the PK Softech investigation and data breach notifications, reported by 2clics.com
  • PME magazine, “Entreprise autonome: jusqu'où laisser l'IA décider?”, and swissVR Monitor, reported by 2clics.com on 28 October 2026
  • Council of Europe, Framework Convention on Artificial Intelligence; SECO SME portal; Digital Switzerland action plan; Federal Chancellery, reported by 2clics.com
  • FINMA, Guidance 08/2024, reported by 2clics.com
  • TechRadar Pro (France), 28 October 2026, based on Cybernews; FOCS, warning of 16 October 2026; DigitalBarometer 2026, reported by 2clics.com