In many Swiss SMEs, AI arrived without an announcement. Someone translates an email with ChatGPT, a colleague asks for a contract summary, another polishes a quote with Copilot. A Sotomo survey for AXA, published in September 2026, found that three in four Swiss SMEs already use AI in their daily work, and 39% are still at the testing stage. That is often when the rules are missing.
An AI usage policy answers three questions: which tools are allowed, what data may go into them and who checks the output. The template above covers this in 12 sections that you can adapt, print or save as a PDF. This guide explains each section, what Swiss law says and how to roll the policy out in 30 days.
Why an AI policy now
Your team already uses AI. Often with personal accounts and free versions that each person picked. Management doesn’t always know which tools are in use, or for which tasks.
Data leaves without anyone noticing. A client email pasted into a consumer chatbot has left the company. Depending on the settings and the terms of service, it may be stored by the provider, sometimes abroad, and used to train the model.
Quality isn’t guaranteed. A language model can state something false with great confidence: a legal article that doesn’t exist, a figure copied wrongly, a translation that changes the meaning of a clause. Without a review rule, those errors reach your clients.
The authorities recommend it. In October 2026, Switzerland’s National Cyber Security Centre (NCSC) and the Federal Data Protection and Information Commissioner (FDPIC) ran a joint campaign on generative AI at work. The NCSC advises organisations to set clear internal guidelines on which tools are permitted and which data must not be entered, and to train their staff.
A good policy doesn’t add red tape. It reassures the people who don’t dare use AI and sets limits for those who use it without a second thought.
What Swiss law says, in brief
Switzerland has no AI-specific law yet. On 12 February 2025, the Federal Council decided that Switzerland should ratify the Council of Europe’s AI Convention, with any changes to the law kept as sector-specific as possible. On 28 October 2026 it announced that the consultation on a draft prepared by the Federal Office of Justice would open in spring 2027. For the details, see our guide to Swiss AI law.
Meanwhile, existing law applies. The FDPIC has made clear that the Federal Act on Data Protection (FADP), in force since 1 September 2023, applies directly to AI-supported data processing. Four points matter for a policy:
- Processors. If an AI provider processes personal data on your behalf, you need a contract, and you must make sure the provider can guarantee data security (Art. 9 FADP).
- Fines. On complaint, the FADP provides for fines of up to CHF 250,000 for certain wilful breaches, such as handing data to a processor without meeting those conditions (Art. 61 FADP). They are aimed at the individuals responsible, as a rule, not at the company.
- Employment law. Employers may issue general directives on how work is done, and employees must follow them in good faith (Art. 321d of the Code of Obligations). An AI policy is one of these. The employee’s duty not to use or reveal confidential information such as business secrets (Art. 321a para. 4 CO) also applies to AI tools.
- The EU. The EU AI Act can apply to a Swiss company in some cases, for example when the output of an AI system is used in the EU.
The 12 sections of the template
The generator above contains full wording for each section. Here is what each one does and what to adapt.
1. Purpose and scope
Who the policy applies to (employees, trainees, freelancers working for you) and which tools it covers: chat assistants, AI features built into your software, browser extensions, agents. One sentence on its purpose is enough: getting the benefits of AI without putting data or quality at risk.
2. Principles: AI assists, people stay responsible
AI suggests, a person decides. Whoever sends an email, a quote or an analysis remains its author and is responsible for it, even if AI drafted it.
A short list giving, for each tool, the version (free or business), what it may be used for and the highest level of data it may receive. Prefer business plans whose contract rules out training on your data, as the NCSC recommends. Any new tool goes through the AI contact person first.
4. Data rules
This is the heart of the policy. The template sorts information into four levels:
| Level |
Examples |
Rule |
| Public |
Website, adverts, brochures |
Any approved tool |
| Internal |
Procedures, letter templates, notes without personal data |
Approved tools, with a company account |
| Confidential |
Client and staff data, contracts, figures, business secrets |
Only tools approved for this level, anonymised where possible |
| Sensitive |
Health, private sphere, racial or ethnic origin, religious, philosophical, political or trade union views, genetic or biometric data, criminal and administrative proceedings or sanctions, social assistance |
Never in an unapproved tool; case by case with the AI contact person |
The sensitive level follows the definition of sensitive personal data in Art. 5 let. c FADP. One simple habit helps a lot: replace names with “Client A” before pasting any text.
5. Checking outputs
Anything leaving the company is checked first: figures, names, dates, legal references, quotations. The higher the stakes, the deeper the check. The FADP also requires anyone processing personal data to make sure it is accurate (Art. 6 para. 5 FADP).
6. Transparency towards clients
Tell clients when AI plays a significant part, for instance in a report or an automatic reply. According to the FDPIC, people have a right to know whether they are talking or writing to a machine. If an AI provider processes client data, your privacy notice should reflect it: the FADP requires you to state the recipients or categories of recipients of the data (Art. 19 FADP).
7. Intellectual property and confidentiality
Business secrets and client documents stay within approved tools. For professions bound by professional secrecy (lawyers, notaries, doctors, physiotherapists…), the secrecy rule in Art. 321 of the Swiss Criminal Code also covers what is typed into an AI tool. On copyright, the Swiss Federal Institute of Intellectual Property (IPI) points out that Swiss copyright only protects works created by humans, so AI output without creative human input may not be protected. Finally, check that generated content doesn’t reproduce someone else’s work.
8. Automated decisions
No decision that significantly affects a person (hiring, turning down a rental application, ending a contract) is left to AI alone. The FADP requires you to inform people of any decision based exclusively on automated processing that has legal consequences for them or a considerable adverse effect on them, and they may ask for a human to review it (Art. 21 FADP). The policy goes further: a person always reviews such decisions.
9. Security
Company accounts only, protected by two-factor authentication. Never put passwords, API keys or access codes into an AI conversation. Where the tool allows it, switch off the use of your conversations for training.
Everyone completes a short training session before using the approved tools. A named AI contact person keeps the list of tools, answers questions and receives reports. In a small business this is often a manager or whoever looks after IT.
11. Incidents
A serious error or possible leak is reported to the AI contact person straight away: reporting quickly beats hiding. Entering client data into an unapproved tool can amount to a data security breach under the FADP (Art. 5 let. h). If it is likely to result in a high risk for the people concerned, the company must notify the FDPIC as quickly as possible (Art. 24 FADP).
12. Review, date and signature
The policy is reviewed every 12 months, and sooner if a new tool arrives or the law changes. It carries a date, management’s signature and each employee’s confirmation that they have read it.
Rolling it out in 30 days
A policy filed away in a binder changes nothing. Here is a realistic plan for a business of 5 to 50 people.
Week 1: take stock. Ask everyone which tools they use and for what, without judgement; five questions are enough. Name the AI contact person.
Week 2: team workshop. Spend two to three hours with the team going through the template. Agree on the approved tools and sort real examples from your own files into the four data levels. Rules agreed together are more likely to be followed.
Week 3: short training and settings. One to two hours for everyone: writing a clear request, checking an output, spotting sensitive data. The AI contact person sets up company accounts, switches on two-factor authentication and adjusts history and training settings.
Week 4: sign and share. Management signs and everyone confirms they have read it. The policy goes into the onboarding pack, and the next review date goes into the calendar.
After that, a quick check after three months fixes what doesn’t work, and a full review follows every year.
The week 2 workshop and the week 3 training can fit into half a day. That is the format of our team AI workshop: at your office, we cover using AI safely at work, write your policy with the team and pick a first task to automate.
Common mistakes
- Banning everything. Use simply moves to personal phones, beyond any control. It is safer to approve a suitable tool with clear rules.
- Copying a policy found online. If it names none of your tools, file types or contact person, it stays theoretical. Adapt every section to your business.
- Being vague about data. “Don’t enter confidential information” isn’t enough. Give examples from your own files.
- Forgetting built-in AI. Email, office suites, business software, meeting transcription: AI also arrives through software updates.
- Mixing up free and business versions. The same product name can come with very different terms for your data.
- Signing and filing. Without training, a contact person and a review date, the policy is forgotten within weeks.
- No channel for incidents. If nobody knows who to tell about a mistake, it gets hidden.
For questions specific to ChatGPT, see our guide to ChatGPT at work and data protection. Once the rules are in place, the next step is often to automate one specific task: our free AI audit helps you choose which one.
This guide gives general information and is not legal advice. Check providers’ current terms and, if in doubt, ask a specialist.