In Switzerland, the regulation of artificial intelligence (AI) relies first and foremost on existing law. On 24 September 2025, the Federal Data Protection and Information Commissioner (FDPIC) pointed out that this law applies directly to data processing that uses AI. On the political front, Federal Councillor Albert Rösti is championing a “Swiss way” rather than a very strict general law.
This page gives an overview of the legal framework for AI in Switzerland. It distinguishes three things: the rules that already apply, political positions and voluntary commitments.
Key figures
- 24 September 2025: the FDPIC points out that Swiss data protection law applies directly to AI.
- 455 data security breach notifications received by the FDPIC in 2026, up to 25 October, compared with 343 for the whole of 2025.
- 23 actions in five areas in digitalswitzerland's Swiss AI Action Plan, presented in May 2026.
- 76% of respondents to the DigitalBarometer 2026 put data protection ahead of convenience.
- 21 and 22 June 2027: dates of the global AI summit in Geneva.
Is there an AI law in Switzerland?
The sources consulted for this page make no mention of any general AI law adopted in Switzerland. They describe a framework built on the law in force, first and foremost data protection.
The political debate centres precisely on whether such a law is useful. In September 2026, at the digitalswitzerland forum in Bern, Albert Rösti spoke out against an overly restrictive text. According to the head of the Federal Department of the Environment, Transport, Energy and Communications (DETEC), a very strict general law would risk stifling innovation.
He believes Switzerland is the most innovative country because it regulates comparatively less. He wants to preserve this advantage for AI, ideally through a path “without state intervention”.
These remarks are a position taken by Albert Rösti at a forum. They are neither a decision of the Federal Council nor a legislative text.
What rules already apply to AI in Switzerland?
Data protection is the first applicable framework. The FDPIC is an independent authority. It ensures that federal bodies and private companies do not process personal data unlawfully.
In its note “AI and data protection”, dated 24 September 2025, the Commissioner observes that AI is increasingly part of people's daily lives. He points out that Swiss data protection law is directly applicable to data processing that uses AI.
In practical terms, an AI tool that processes personal data remains subject to the Federal Act on Data Protection (FADP). The Commissioner can open a formal investigation when there are indications of a possible breach of these rules.
A dated example: on 23 October 2026, the FDPIC opened a formal investigation against PK Softech, a software provider for pension funds. This case concerns a cyberattack, not an AI tool. It nevertheless shows the Commissioner's method: he examines the data entrusted, the legal framework for transfers and how it is applied in practice.
Cybersecurity forms a second strand. On 16 October 2026, the Federal Office for Cybersecurity (FOCS) pointed out that carelessly entering confidential or business information into an AI can expose that data. Since 1 April 2025, operators of critical infrastructure have also been required to report their cyber incidents to the FOCS.
What does the “Swiss way” of regulating AI involve?
The “Swiss way” refers to light-touch, innovation-friendly regulation. This line is championed both by Albert Rösti and by digitalswitzerland, the umbrella association for digitalisation in Switzerland.
The association presented its Swiss AI Action Plan at the Digital Gipfel Schweiz in Andermatt on 26 and 27 May 2026. According to the association, the plan was drawn up in close coordination with the Federal Office of Communications (OFCOM). It comprises 23 actions spread across five areas, to which more than 500 experts contributed.
The governance strand calls for “light” regulation that is favourable to innovation. It is meant to protect fundamental rights and rely on voluntary commitments from the industry.
This plan remains an association document, which digitalswitzerland presents as a roadmap set to evolve. It is neither a law nor a decision of the Federal Council.
The digitalswitzerland roadmap leads to the global AI summit in Geneva on 21 and 22 June 2027. Its organisation has been entrusted to OFCOM and the Federal Department of Foreign Affairs (FDFA).
What role for self-regulation?
Many organisations are adopting their own AI charters and guidelines. These texts shape internal practices. They do not set general obligations, which are a matter for the legislature.
A dated example: on 12 October 2026, five Swiss churches and Christian organisations published ten guidelines on AI. The available information mentions neither a monitoring mechanism nor sanctions.
On the business side, digitalswitzerland and Implement Consulting announced on 10 March 2026 a practical AI guide aimed at managers of small and medium-sized enterprises (SMEs). Among its four “success factors” is AI governance, presented as a sustainable and responsible AI infrastructure.
Industry leaders disagree on the role of the law. Jack Clark, co-founder of Anthropic, is calling for robust legislation. Jensen Huang, head of Nvidia, disputes calls for more regulation. This debate between Anthropic and Nvidia mainly pits statements against each other. Anthropic does, however, say it has opened its systems to METR, a non-profit organisation that evaluates AI models.
How does Switzerland compare with other approaches?
In September 2026, Franziska Barmettler, director of digitalswitzerland, summarised the strategies of the major powers. According to her, the United States is betting on supremacy and the European Union (EU) on risk minimisation and regulation. The United Kingdom prioritises safety, Singapore training.
In her view, the Swiss way should build on existing strengths and on values such as trust and reliability.
| Actor | Approach described by the sources | Scope |
|---|---|---|
| FDPIC (Switzerland) | Data protection law directly applicable to AI | Rule in force, supervisory authority |
| Albert Rösti, head of DETEC | “Swiss way”, no very strict general law | Position taken at a forum |
| digitalswitzerland | Light regulation and voluntary industry commitments | Association action plan |
| European Union | Risk minimisation and regulation | Summary by digitalswitzerland |
| United States | Supremacy; government call for industry self-regulation | Summary by digitalswitzerland and AFP dispatch |
Our analysis: Switzerland has no single text on AI in the sources consulted. It combines existing law, political positions and voluntary commitments, whose scope remains to be clarified.
What AI regulation changes for an SME in Switzerland
For an SME, the first rule is already familiar: data protection. An AI tool that processes customer or employee data falls within the FDPIC's scope of supervision.
Our analysis: several general recommendations from the Commissioner and the FOCS also apply to the use of AI.
- Check what information the team enters into AI tools, following the FOCS's warning about confidential data.
- Only pass on data that is strictly necessary, as the FDPIC requests.
- Work preferably with anonymised test data, another recommendation from the Commissioner.
- Set internal rules of use, like the charters adopted by many organisations.
- Keep the FDPIC's contact details to hand: its hotline is available Monday to Friday, from 10 a.m. to 11:30 a.m., on 058 462 43 95.
The Commissioner describes the threat linked to AI as “real”, without ranking it as the leading cause. In his view, the weak point in reported attacks is rarely the technology. In the vast majority of data breach notifications, it is a matter of human error.
According to the DigitalBarometer 2026, 76% of respondents put data protection ahead of convenience. 83% say a “Made in Switzerland” label strengthens their trust in a digital service, compared with 53% for a European label.
What we don't know yet
- Whether the Federal Council is preparing an AI law or the amendment of existing laws: the sources consulted for this page do not go into detail.
- Switzerland's international commitments on AI, which these sources do not describe.
- The detailed content of the FDPIC note “AI and data protection”, beyond its summary.
- The exact criteria and deadline for reporting a data breach under the FADP.
- The funding and outcomes of the 2027 Geneva summit, which the press releases do not detail.
- The possible effects of EU rules on Swiss companies.
Sources
- Federal Data Protection and Information Commissioner (FDPIC), home page and note “AI and data protection”
- digitalswitzerland, “Digital Gipfel Schweiz 2026: digitalswitzerland launches Swiss AI Action Plan”, 28 May 2026
- digitalswitzerland, “digitalswitzerland forum 2026: Wake-up Call to Bern for Digital Infrastructure and Kick-off for the Road to Geneva”, 15 September 2026
