Switzerland’s AI laws: what applies now and what is coming

Switzerland does not yet have a general law on artificial intelligence. That does not mean AI is unregulated: data protection, unfair competition, employment and criminal law already apply. The Federal Council is preparing targeted changes so that Switzerland can ratify the Council of Europe’s AI Convention.

We track the file on this page and update it at each step. It separates law in force, what the authorities say and our advice for SMEs. General information, not legal advice.

Latest (30 October 2026)

• 28 October 2026. The Federal Council took note of progress. The consultation on binding rules, prepared by the Federal Office of Justice, is planned to open in spring 2027. Its February 2025 plan had aimed for a consultation draft by the end of 2026. No draft has been published yet.
• 28 October 2026. Alongside this, OFCOM published a report on sector-specific measures and a guide to help associations and companies draw up a voluntary AI code.
• 2 August 2026. Most of the EU AI Act now applies, including the transparency duties in Art. 50, and enforcement of the AI literacy duty (Art. 4) has started.
• 27 July 2026. The EU’s Digital Omnibus on AI, Regulation (EU) 2026/1744, came into force: high-risk rules postponed, Art. 4 softened.
• Coming up, 2 December 2026. New EU prohibitions (non-consensual sexual deepfakes and child sexual abuse material) and the deadline for marking AI-generated content from systems already on the market (Art. 50(2)).

The Federal Council’s approach

The decision of 12 February 2025

The Federal Council set three aims: strengthen Switzerland as a place for innovation, protect fundamental rights including economic freedom, and build public trust in AI. In practice:

• Switzerland is to ratify the Council of Europe Framework Convention on AI and bring it into Swiss law;
• legal changes will be sector-specific wherever possible, for example in health or transport;
• cross-sector rules will be limited to a few areas that touch fundamental rights, such as data protection;
• non-binding measures complete the picture: industry dialogues, guidelines, standards and voluntary commitments.

The Federal Department of Justice and Police was to deliver a consultation draft by the end of 2026, working with DETEC and the Federal Department of Foreign Affairs. In other words, the Federal Council decided against a horizontal ‘Swiss AI Act’ modelled on the EU’s.

The update of 28 October 2026

The planned federal act is to cover transparency, data protection, non-discrimination, oversight and risk assessment, with the consultation now due in spring 2027. Alongside it:

• OFCOM’s report lists current and planned measures across the federal administration, in sectors such as transport, energy, health and the media;
• the guide for an AI code offers model text on ten topics at three levels of detail, plus a process for drawing one up;
• industry dialogues are under way with the cultural sector (since November 2025), the electricity sector and the media.

The Council of Europe Convention

The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first binding international treaty on AI. It requires its parties to ensure that the use of AI systems respects these principles.

Switzerland signed it on 27 March 2025 in Strasbourg, through Federal Councillor Albert Rösti. It has not yet ratified it: Swiss law must be adapted first, which will go through Parliament. The Convention only enters into force after five ratifications, at least three of them by Council of Europe member states; the Council of Europe publishes the current list.

Swiss law that already applies

Data protection

The FDPIC’s position (9 November 2023, updated 8 May 2025) is that the Federal Act on Data Protection (FADP), in force since 1 September 2023, applies directly to AI-supported processing. The Commissioner highlights:

• transparency about the purpose, functioning and data sources of AI processing;
• the right to know whether you are dealing with a machine, and whether your data is used to improve it;
• the right to have an automated individual decision reviewed by a person (Art. 21 FADP);
• impact assessments where the risk is high (Art. 22 FADP);
• a ban, from a data protection point of view, on uses such as large-scale real-time facial recognition or ‘social scoring’.

For the practical side of ChatGPT and similar tools, including data processing agreements, transfers abroad and professional secrecy, see our guide to ChatGPT at work and Swiss data protection.

Unfair competition

The Unfair Competition Act (UCA) prohibits inaccurate or misleading statements about your own services (Art. 3(1)(b)), and that includes what you claim about AI in your marketing. Mass advertising emails without prior consent remain banned (Art. 3(1)(o)), even when an AI writes them.

Liability

The Code of Obligations governs contracts and damage caused with the help of AI, as it does elsewhere. The Product Liability Act may apply when a defective product containing AI causes harm; whether stand-alone software counts as a product is still debated.

Copyright

Copyright protects intellectual creations with an individual character, so AI output with no human creative input is generally not protected, according to the prevailing view. On the use of works by AI providers, Parliament adopted motion 24.4596 on 11 December 2025, in a version amended by the National Council. The Federal Council must create the conditions for journalistic content and other protected works to be fully protected when AI providers use them, without weakening Switzerland as a place for innovation. The adopted text does not yet set out how.

Criminal law

There is no AI-specific offence, but existing ones apply. Identity misuse (Art. 179decies SCC, in force since 1 September 2023) can cover a deepfake, and breach of professional confidentiality (Art. 321 SCC) can apply when client secrets are entered into an AI tool.

Employment law

An employer may only process data about an employee if it concerns their suitability for the job or is needed to perform the employment contract (Art. 328b CO). Systems designed to monitor employees’ behaviour at work are prohibited (Art. 26 ArGV 3). AI tools that assess or monitor staff must stay within these limits.

Sector rules

In finance, FINMA Guidance 08/2024 of 18 December 2024 sets out what the regulator expects from supervised institutions: identify, assess, manage and monitor AI risks, from model and data risks to cyber risks, reliance on third parties and legal risks. Other sectors, such as health and transport, are adapting their rules case by case.

The EU AI Act and Swiss companies

When a Swiss SME is in scope

Regulation (EU) 2024/1689, the AI Act, applies among others (Art. 2(1)) to:

• providers placing AI systems on the market or putting them into service in the EU, wherever they are based;
• providers and deployers based outside the EU, where the output produced by the system is used in the EU.

A Swiss SME may therefore be in scope if it sells an AI-based product in the EU, runs a chatbot for EU customers or delivers AI-generated output to clients in the EU. Most SMEs are ‘deployers’: they use AI tools in their work. Their duties mainly concern AI literacy (Art. 4) and transparency (Art. 50), such as labelling deepfakes. High-risk duties only apply to certain uses, such as recruitment.

AI Act timeline

The Digital Omnibus on AI

Proposed by the Commission on 19 November 2025 and politically agreed on 7 May 2026, Regulation (EU) 2026/1744 of 8 July 2026 was published on 24 July and has been in force since 27 July 2026. Three points matter for SMEs:

• High-risk rules postponed to 2 December 2027 for Annex III and 2 August 2028 for Annex I, instead of August 2026 and August 2027.
• Art. 4 softened: providers and deployers must take measures to ‘support the development of AI literacy’ of their staff. The text adds that this does not require them to guarantee any specific level for any individual.
• Enforcement from 2 August 2026: the Commission says AI literacy remains an obligation, supervised by national authorities. No certificate is needed; the Commission suggests keeping an internal record of training.

What a Swiss SME can do now

Our advice, in six steps, without waiting for the Swiss law:

1. Inventory. List the AI tools in use, who uses them, for what and with which data. Note any whose output goes to clients in the EU.
2. AI policy. Write down which tools are allowed, which data is off limits and when a person must review the output. Our AI usage policy template gives you a starting point.
3. Training. Cover the basics, the risks and your rules, then keep a record: date, content, attendees. Our half-day team workshop covers these points.
4. Transparency. Update your privacy notice, flag your chatbots and label generated content where needed.
5. Contracts. Sign a data processing agreement with each provider, check where data is processed and switch off training on your data.
6. EU exposure. If your AI tools serve clients in the EU, work out your role (provider or deployer) and the duties that follow.

In every case, keep a person in the loop for decisions that affect clients or staff.

What to watch

• Spring 2027: the consultation on the Swiss draft opens. We will update this page the same day.
• Afterwards: the Federal Council’s dispatch to Parliament, then ratification of the Convention. No timetable has been set.
• Copyright: how motion 24.4596 is implemented.
• Industry codes: associations adopting an AI code, using OFCOM’s guide.
• EU, 2 December 2026: new prohibitions and marking of AI-generated content.
• EU, 2 December 2027: high-risk rules and the technical standards that support them.
• FDPIC and FINMA: new guidance and supervisory practice.

Timeline

Want to take stock of how your team uses AI today? Start with a free AI audit.