AI Regulation: What Requirements Are Relevant for Swiss Companies?
Regulatory requirements for artificial intelligence (AI) are constantly evolving. Many articles and webinars focus on the EU AI Act. For Swiss companies, however, it often remains unclear which of these requirements actually apply to them.
A nuanced approach is essential here. Swiss companies are neither generally exempt from the EU AI Act nor are they automatically required to implement all of its requirements. The key factors are which AI systems are used, how they are used, and the markets in which the company operates.
To make an informed assessment, three regulatory levels should be considered:
- European law with extraterritorial effect
- Applicable Swiss law
- Industry-specific regulatory requirements
It makes sense to address these requirements early on, as AI applications are already in use at many companies. However, there is not always complete transparency regarding which systems are being used and what regulatory requirements are associated with them.
IBM’s 2025 Cost of a Data Breach Report shows that so-called “shadow AI” played a role in one out of every five companies surveyed that experienced a data breach. At the same time, 63 percent of the affected companies did not have an AI governance policy in place. An analysis by Cyberhaven also shows that approximately one-third of the data that employees enter into AI tools is now classified as sensitive.
These developments highlight how important it is to systematically track and regulate the use of AI within companies.
Level 1: EU AI Act—Also Relevant for Swiss Companies
The EU AI Act is one of the most comprehensive regulatory frameworks for artificial intelligence. Its scope is not limited exclusively to companies based in the European Union.
Swiss companies may also fall under the EU AI Act, for example, if they place AI systems on the EU market or if the results of an AI system are used within the EU. Thus, the decisive factors are not only the company’s registered office but also its market positioning and the specific use of the systems.
What obligations apply and when?
The requirements of the EU AI Act will take effect in phases. The following overview shows the most important milestones.
Provider or Deployer: What Role Does Your Company Play?
For regulatory classification, the distinction between providers and deployers is key.
Providers develop AI systems or place them on the market under their own name. Deployers, on the other hand, use existing AI systems as part of their business operations.
The most extensive regulatory requirements generally apply to providers. These include, among other things:
- Risk management
- Technical documentation
- Conformity assessments
- Quality management systems
Companies that use, for example, Microsoft Copilot or AI features in purchased software are generally considered deployers. They are generally subject to less extensive requirements.
These include, in particular, the intended use of the systems, compliance with the manufacturer’s instructions, and appropriate human oversight. In the case of high-risk AI, additional operator obligations may apply, such as monitoring the systems or, where necessary, conducting an impact assessment on fundamental rights.
It is important to note, however, that the regulatory role can change. If an AI system is substantially modified or redistributed under the operator’s own name, the operator may legally become a provider and thus assume additional obligations.
Regulatory Requirements Along the Supply Chain
Even companies without direct market activities in the EU may be indirectly subject to the requirements of the AI Act.
This is the case, for example, when European customers are themselves subject to the AI Act and pass on corresponding requirements to their suppliers. Such requirements may be part of contracts, security questionnaires, or audits.
For Swiss SMEs, this is a particularly relevant aspect, as regulatory requirements can thus gain significance even in the absence of a direct legal obligation.
Risk-Based Regulation and High-Risk Applications
The EU AI Act distinguishes between different risk levels. A large portion of AI use in business falls into lower-risk categories. More extensive compliance requirements arise particularly for high-risk applications.
These include, for example, AI systems in the following areas:
- Hiring
- Lending
- Critical infrastructure
- Education
The use of AI in human resources deserves special attention. If systems are used to pre-screen applications, analyze resumes, or evaluate candidates, they may be classified as high-risk applications. At the same time, such systems process personal data that requires adequate protection.
Companies should therefore carefully review their AI applications in the HR sector in particular.
As of September 2026, no fines had yet been imposed under the EU AI Act. This is due, among other things, to the fact that the relevant enforcement powers have only been gradually activated. Regardless, registration and documentation requirements are already in place, and compliance with them should be ensured at an early stage.
Level 2: The revised Data Protection Act is already in effect today
While the applicability of the EU AI Act depends on various factors, the revised Swiss Data Protection Act (revDSG) is already directly relevant to many companies.
The revDSG has been in effect since September 2023 and also applies to AI applications that process personal data. These include, for example:
- Customer data
- Employee information
- Job application documents
- support requests
In 2025, the Federal Data Protection and Information Commissioner (FDPIC) explicitly confirmed that the revDPA applies to AI-supported data processing.
At the same time, the FDPIC clarified that applications that infringe on the protection of privacy—such as widespread real-time facial recognition or social scoring—may already be prohibited under current law.
Data Protection in AI Applications in Practice
The fact that data protection is also relevant from a regulatory perspective in the context of AI applications became evident in March 2025.
Following a preliminary investigation into the X platform, the FDPIC secured a ruling allowing users to object to the use of their public posts for training the AI system Grok. The case illustrates that the use of data for AI training is also subject to data protection reviews in Switzerland. Another example comes from Australia. In March 2025, an external contractor working for a government agency uploaded a spreadsheet containing more than 12,000 rows to ChatGPT. Among other things, it contained names, addresses, and, in some cases, health data of individuals affected by a flood. Data from more than 2,000 people was demonstrably exposed.
Under Swiss law, a comparable incident could involve several data protection requirements, including the lawfulness and transparency of data processing as well as the implementation of appropriate security measures.
This example illustrates why companies need clear guidelines for handling sensitive data in AI applications.
AI governance is also a leadership responsibility
The responsibility for ensuring that AI is used in compliance with data protection laws should not rest solely with the IT department.
The revDSG contains penal provisions that may apply to natural persons. Depending on their level of responsibility, executives may also be affected.
Furthermore, the EU AI Act explicitly requires human oversight and appropriate governance structures for high-risk applications.
Effective AI governance therefore requires clear responsibilities, defined processes, and appropriate integration at the executive level. A structured Governance, Risk, and Compliance (GRC) approach helps companies align regulatory requirements, risk management, and internal responsibilities.
Similar to information security, this is a company-wide responsibility.
Level 3: Industry-Specific Requirements and the Information Security Act
In addition to the EU AI Act and the revDSG, Swiss companies may be subject to additional industry-specific requirements.
These depend in particular on the company’s field of activity and regulatory classification.
Examples include:
- Financial sector: FINMA requirements, particularly regarding governance and outsourcing.
- Critical infrastructure: Requirements under the Information Security Act (ISG), including the obligation to report cyberattacks to the Federal Office for Cybersecurity.
- Healthcare, energy supply, and public administration: Additional regulatory and industry-specific requirements.
The use of AI does not replace these existing obligations. Rather, AI applications must be operated within the applicable regulatory frameworks.
For example, an AI-supported credit check remains a credit check. Similarly, an AI assistant that processes patient data remains subject to the relevant data protection requirements.
How is AI regulation evolving in Switzerland?
In February 2025, the Federal Council decided against enacting comprehensive, standalone AI regulation.
Instead, Switzerland is pursuing an approach based on the Council of Europe’s AI Convention, which was signed in March 2025, as well as on targeted adjustments to existing and industry-specific regulations.
For Swiss companies, this means that the regulatory assessment of AI should not be conducted in isolation. Rather, existing legal obligations and potential additional requirements must be considered together.
What impact does AI regulation have on Swiss companies?
When addressing AI compliance, the focus is often on potential fines and legal sanctions. For many Swiss SMEs, however, the operational and business implications are also relevant.
In particular, companies without direct market activities in the EU may be less affected by the extensive penalty provisions of the EU AI Act. At the same time, requirements may arise from customer relationships, tenders, or data protection obligations.
Possible challenges include, for example:
- Tenders that require evidence of AI governance.
- Security reviews by customers that require answers to questions about AI usage.
- Data breaches resulting from the improper use of AI tools.
- Loss of trust when sensitive customer data is processed without adequate safeguards.
Transparent AI governance therefore not only helps companies comply with regulatory requirements; it can also contribute to meeting customer requirements more efficiently and building trust in the responsible use of AI.
From Regulatory Requirements to Practical Implementation
The regulatory framework forms the basis for the responsible use of AI. Companies should first clarify which AI applications are being used, what data is processed in the process, and what legal requirements arise from this.
Building on this, it is important to assess relevant risks and integrate appropriate security and governance measures into existing processes. An information security management system (ISMS) compliant with ISO 27001 can provide a structured foundation for this. It is crucial to consider the requirements within the specific corporate context and to prioritize measures in a targeted manner.
AI Security Playbook: Structured Assessment and Management of AI Risks
How can these requirements be implemented in practice?
Our AI Security Playbook for Swiss CIOs & CISOs shows how companies can achieve transparency regarding their AI workloads, prioritize risks using an AI Risk Heatmap, and establish appropriate governance and security structures.
Learn how to systematically integrate AI security into your organization and lay the groundwork for the secure and responsible use of AI.
How companies can specifically secure AI workloads in a structured way and regain control over emerging risks is outlined in the AI Security Playbook for Swiss CIOs & CISOs by Axians.
How Axians Provides Support
Safe AI Use with Axians
For companies, the first question that often arises is which regulatory requirements related to AI are actually relevant and what specific measures these entail.
Axians helps you systematically assess your regulatory exposure and gain clarity on the applicable requirements.
Together, we identify the AI solutions in use, analyze the processing of personal data, and assess the relevance of the EU AI Act, the revDSG, and industry-specific requirements.
Based on this, we develop practical recommendations tailored to your organization’s specific requirements and framework conditions.
Our support is available in various formats:
- Workshops
- Gap Assessments
- Compliance Checks
- CISO as a Service Mandate
In addition to regulatory assessment, we also assist you in establishing a practical AI governance framework. In doing so, we take existing security, data protection, and compliance processes into account to enable the most efficient integration possible.
Would you like to know which regulatory requirements are relevant to your company?
In a free 30-minute consultation, we’ll work together to identify which requirements may be significant for your organization—both today and in the future.
LAZAR JOVANOV
Information Security Consultant, Axians BNC
