As soon as an SME enters personal data into it, using ChatGPT at work in Switzerland falls under the Federal Act on Data Protection (nFADP). The Federal Data Protection and Information Commissioner (FDPIC) pointed this out on 24 September 2025: this law applies directly to data processing that uses artificial intelligence (AI). For an SME, the risk therefore lies less in OpenAI's tool itself than in the information employees paste into it and the decisions left to it.
This page deals with a single tool and the rules for its use. The overview of uses, costs and first projects can be found in our guide AI for SMEs, part of our AI in business section.
Key figures
- 24 September 2025: the FDPIC points out that Swiss data protection law applies directly to AI.
- 16 October 2026: the Federal Office for Cyber Security (NCSC) warns against carelessly entering confidential information into an AI.
- Fewer than one company in five has all generative AI content validated by a person, according to the swissVR Monitor.
- 455 data security breach reports received by the FDPIC in 2026, up to 25 October, compared with 343 for the whole of 2025.
- More than eight times as many weekly users of Codex and ChatGPT Work in European SMEs in less than six months, according to OpenAI.
- 76% of respondents to the DigitalBarometer 2026 put data protection ahead of convenience.
What is ChatGPT used for in an SME?
ChatGPT serves first and foremost as an assistant. It is asked to write a text, summarise information or prepare an analysis, notes the specialist website Inside IT on 26 October 2026. In an SME, this covers, for example, a sales proposal or a report to be written.
The tool is, however, changing in nature. OpenAI, the company behind ChatGPT, has integrated ChatGPT Work, an agentic tool, into its "superapp". An agent no longer simply answers: it analyses a situation, looks for the relevant information, then carries out a series of actions.
According to an OpenAI report cited by TechRadar Pro, weekly active users of Codex and ChatGPT Work in European SMEs reportedly grew more than eightfold in less than six months. This figure comes from the vendor and covers only its own products. It says nothing about Switzerland, as we noted regarding the OpenAI report on European SMEs.
Our analysis: the distinction matters for internal rules. An assistant produces a text that the employee proofreads. An agent acts, and its mistake can then commit the company.
Which version of ChatGPT should you choose, and what happens to the data?
The sources consulted for this page do not detail the terms of each ChatGPT plan. The OpenAI report mentions "Enterprise" and "Business" customers, without describing what happens to their data. We therefore do not compare the free and paid versions here.
The method for choosing, on the other hand, is well known. According to Alexandre Buga, in PME magazine on 23 October 2026, an SME must comply with Swiss data protection legislation right down to its choice of tool. Before passing on data about customers, suppliers or employees, it needs to know:
- where this data is processed;
- for what purposes it may be reused;
- who can access it.
He recommends suitable professional tools, accompanied by simple rules on which data is allowed.
Where processing takes place becomes less clear with agents. According to Cyril Louis, managing director of Mavericx, an IT consultancy based in Geneva and Zurich, these systems may depend on several language models and external services. Not all of them are operated in Switzerland. Swiss providers are responding to this demand: Elca offers a sovereign AI platform, where data and models remain under the customer's control.
What does the nFADP say about using ChatGPT at work?
The sources consulted do not mention any Swiss rule specific to ChatGPT. The applicable framework is the Federal Act on Data Protection. The FDPIC, an independent authority, ensures that federal bodies and private companies do not process personal data unlawfully, according to the description on its website.
Its note "AI and data protection", dated 24 September 2025, starts from an observation: AI is increasingly part of people's daily lives. The Commissioner concludes that Swiss data protection law is directly applicable to processing that uses it.
AI-specific regulation is still being prepared. According to the SME Portal of the State Secretariat for Economic Affairs (SECO), Switzerland has signed the Council of Europe Framework Convention on AI and must adapt its law. A preliminary draft is to be drawn up by early 2027. Its effects for SMEs are not yet known.
For a specific question, the FDPIC runs a hotline from Monday to Friday, from 10 am to 11:30 am, on 058 462 43 95.
What data should not be entered into ChatGPT?
Confidential information comes first. On 16 October 2026, the NCSC pointed out that carelessly entering personal, confidential or commercial information into an AI can lead to excessive data sharing.
The FDPIC gives two general rules, which also apply to an AI tool: only pass on the data that is strictly necessary, and preferably work with anonymised test data.
| Type of information | Rule drawn from the sources | Origin |
|---|---|---|
| Data about customers, suppliers or employees | Know where it is processed, for what purposes and who has access to it before passing it on | Alexandre Buga, PME magazine |
| Personal, confidential or commercial information | Do not enter it carelessly into an AI | NCSC, 16 October 2026 |
| Data needed for a task | Stick to what is strictly necessary, preferably use anonymised data | FDPIC |
Which decisions should not be entrusted to ChatGPT?
Decisions that commit the company or a person remain human. Alexander Finger, chief technology officer of SAP Switzerland, cites in PME magazine a chatbot that had granted discounts on cars, which were then sold at a reduced price. In his view, AI should not be used to assess employees either.
Finance follows the same logic. In the analysis of the chief financial officer as seen by Deloitte, final approval of a payment remains subject to the usual controls. The tool prepares, management decides.
Human error remains the main weak point. Adrian Lobsiger, the Federal Data Protection and Information Commissioner, received 455 data security breach reports in 2026, up to 25 October. In his view, the weak point is rarely the technology: in the vast majority of cases, it is human error. He considers the AI-related threat "real", without ranking it as the leading cause.
How should employees' use of ChatGPT be governed?
A written directive is a start, not a guarantee. According to the swissVR Monitor cited by Alexandre Buga, many companies report having a governance framework for generative AI. But fewer than one in five has all content validated by a person.
Internal charters influence practices, not the law. Many organisations adopt them, but these texts do not set general obligations: those are a matter for the legislator.
Our analysis: by combining the recommendations of the FDPIC, the NCSC and Alexandre Buga, a company rule for using ChatGPT can cover six points.
- The authorised tool, chosen from professional offerings whose data processing location is known.
- Excluded information: personal, confidential or commercial data entered carelessly.
- The principle of strict necessity and, where possible, anonymised data.
- Human validation of content that is sent or published.
- Decisions reserved for a person: prices, discounts, payments, employee assessments.
- A person in charge, and an evaluation of the tool after a set period, before adapting or discontinuing it.
Training complements these rules. The NCSC lists staff awareness among its basic organisational measures. The practical AI guide announced on 10 March 2026 by digitalswitzerland and Implement Consulting, aimed at SME managers, also counts AI governance among its four "success factors".
What limits should you keep in mind?
Financial gains are not automatic. According to Alexandre Buga, investing in AI does not necessarily mean savings, and the return is not immediate.
Finally, customer trust matters. According to the DigitalBarometer 2026, 76% of respondents put data protection ahead of convenience.
What we do not yet know
- The data processing terms specific to each ChatGPT plan: the sources consulted do not detail them.
- The share of Swiss SMEs that use ChatGPT, and the share that have set written rules for its use.
- The content of the preliminary draft expected by early 2027 and any obligations it may impose on companies.
- The details of the FDPIC note "AI and data protection", beyond its summary.
Sources
- Federal Data Protection and Information Commissioner: FDPIC home page, with the note "AI and data protection" of 24 September 2025
- PME magazine: analysis by Alexandre Buga of 23 October 2026 and article "Entreprise autonome: jusqu'où laisser l'IA décider?"
- Inside IT, 26 October 2026: "Bei Enterprise-KI entscheidet nicht Modell, sondern Kontext"
- Federal Office for Cyber Security (NCSC): warning of 16 October 2026 and basic protection for companies
- TechRadar Pro: OpenAI report on agentic AI in Europe
- SME Portal of the State Secretariat for Economic Affairs (SECO)
- SWI swissinfo.ch (Keystone-ATS), 25 October 2026: "Data security breaches rise in 2026"
- digitalswitzerland: DigitalBarometer 2026
