Switzerland has no AI law. The Federal Office of Communications puts it plainly: there is still no overarching legislation specific to AI in Switzerland.
That sounds like an all-clear. It is not one.
Anyone searching for a Swiss AI law is rarely after legal history. They want to know whether they have to do something before sales turns the next AI tool loose on customer data. That answer is not in an AI law. It is in laws that have been in force for years.
What the Federal Council actually decided in February 2025
On 12 February 2025 the Federal Council decided that Switzerland should ratify the Council of Europe Convention on Artificial Intelligence. Switzerland signed it in March 2025. Legislative adjustments are to be made on a sector-specific basis wherever they are needed, separately for healthcare or transport. A broad cross-sector act on the EU model is not the plan.
That comes with a dated mandate. The Federal Office of Justice writes that the Federal Council has instructed the Federal Department of Justice and Police to prepare a consultation draft for new rules on the use of AI by the end of 2026. The draft is to cover four areas: transparency, data protection, non-discrimination and supervision.
The whole timeline hangs on the word consultation draft. A consultation draft is a proposal that goes out for comment. The administration then evaluates the responses, the Federal Council writes a dispatch, parliament debates it in two chambers, and at the end a referendum deadline runs. End of 2026 is therefore the date for a paper that gets put up for discussion. It is not the date from which you have to comply, and it is not a date you can plan an AI rollout around.
The law with hard dates just moved its dates
For Swiss companies with EU business a different set of rules is the relevant one anyway: the EU AI Act. That one has real deadlines. They just move.
It entered into force on 1 August 2024 and became applicable on 2 August 2026. The prohibitions on certain applications have applied since 2 February 2025, the rules for general-purpose AI models since 2 August 2025. That includes the duty to train your own people.
Then came the AI Omnibus, in force since 27 July 2026. It pushed the high-risk rules back. Systems in sensitive areas such as biometrics, critical infrastructure, education or employment only apply from 2 December 2027. Systems embedded in products, in lifts or toys for example, from 2 August 2028. Against the original dates that is sixteen months more time for the first group and twelve for the second. The Commission justifies the extension by saying companies need time until standards and support tools are available.
A postponement of more than a year for a law that was already in application at that point. Anyone who hung their AI roadmap on a regulatory date has just learned that this date is negotiable. Dates from legislative processes make poor project milestones.
Which rules already apply to AI in Switzerland today?
The Data Protection Act. In its statement of 8 May 2025 the Federal Data Protection and Information Commissioner holds that the act is formulated in a technology-neutral way and is therefore directly applicable to the use of AI-supported data processing. The word AI does not have to appear in the legal text for the law to bite. Three provisions affect an SME directly.
You have to say what the AI does
According to the Commissioner, manufacturers, providers and users of AI systems must be transparent about the purpose, the functioning and the data sources of AI-based processing. On top of that comes a point that affects every answering assistant on a website: users have a statutory right to know whether they are speaking or corresponding with a machine.
A chatbot that appears on the customer-facing page like an employee is therefore not a model problem but a disclosure question. You solve it in an afternoon, as soon as someone asks it.
Art. 21 DSG applies to automated decisions
In our experience this provision is the least known of them. Art. 21 of the Data Protection Act, in the version of 1 September 2023, requires the controller to inform the data subject about a decision that is based exclusively on automated processing and that has a legal consequence for them or significantly affects them. Then comes a second sentence that does the work: the data subject can request that the automated individual decision be reviewed by a natural person.
So the law requires a person who reviews the decision on request, and that person has to be named before the request arrives. This becomes relevant as soon as a model at your company pre-sorts applications or rejects requests.
Two terms decide the reach. Exclusively means this: if a human sits between the model and the decision, one who actually assesses the case rather than just signing it off, there is no automated individual decision. And significantly affects draws the line between a pre-sort that saves a team reading time and a rejection that is the outcome for the person. The law names two further exceptions: where the decision is directly connected with a contract and the person's request is granted, or where they have expressly consented to the decision being automated.
The bottleneck therefore sits in an unspectacular place. Someone in the house has to own that decision, and no legal text names that person for you.
The AI tool is a processor
As soon as personal data flows into an external tool, Art. 9 of the Data Protection Act applies. Paragraph 2, in the wording of the law, requires the controller to satisfy itself in particular that the processor is able to guarantee data security. Satisfy yourself, not agree in writing. A signed document on its own does not meet that sentence. What the check behind it has to look like is in the article on the data processing agreement for AI tools, and which data may go into a public model at all is covered in the article on company data in ChatGPT.
The contract arrives before the law
In our experience the first binding AI requirement does not reach an SME through the federal gazette. It sits in the supplier questionnaire or in a new clause at contract renewal. An industrial customer with EU business, or a hospital, passes its own obligations down the supply chain. The date that counts then is your contract signature, not 2 December 2027.
The uncomfortable part is that you do not control that date. The practical part is that the answers are identical. A questionnaire like that wants to know which AI tools are in use, which account they run under, which data they see, whether inputs are reused for training, and who at your company is answerable for it. The Data Protection Act demands exactly those details today. So you are not doing the work twice. And if a Swiss AI law does come into force one day, that groundwork is already sitting in your house.
What tends to stall, in our experience, is ownership of those answers. The questionnaire lands with sales, moves on to IT, and there someone answers by feel what would be a decision for the management board.
The way in is therefore not a study of legislation but an AI inventory: the list of tools actually used in the house, with account, data access and a responsible person. That list is the first column in every regulatory variant discussed so far. The single page of rules follows from it, not the other way round.
Who should not read this as an interim status
For some readers none of this is a relaxation, and that belongs here.
Under Art. 2(1) the AI Act expressly also covers providers who place AI systems on the Union market or put them into service, irrespective of whether they are established in the Union or in a third country. It also bites on providers and deployers established in a third country where the output produced by the AI system is used in the Union. Switzerland is such a third country.
So if you build AI into a product that goes to the EU, or if the output of your system is used by EU customers, a future Swiss AI law is not what sets your pace. You then have a project under EU law with the deadlines above, regardless of what Bern puts out for consultation by the end of 2026.
What you can skip in the meantime
Uncertainty about a Swiss AI law generates offers. Two of them you can leave alone.
An AI compliance platform for a regime whose text does not yet exist buys you nothing but a subscription line. The same goes for a legal opinion on the consultation draft: it does not exist yet. And selling a certificate as the first step gets the order wrong, as set out in the article on the cost of ISO 42001.
What pays off costs no licence. You fill the inventory with questions and a spreadsheet. The management board sets the ownership in one meeting. Both survive the coming versions of the law, and both are what the customer questionnaire asks for. The frame behind all of it is described in the article on the revised Data Protection Act.
The line that is missing today
In the mandates where this topic sits idle, a law is rarely what is missing. What is missing is a line in the allocation of duties: who decides which AI is allowed in the house, and who reviews an automated decision when someone asks for it.
You can write that line today. It needs no legal text, and it does not change when a draft goes out for consultation at the end of 2026.
If you want to set this up properly once, without waiting for Bern, that is exactly the work we do in our AI governance mandates. A first conversation is without obligation.
One question interests us most here: who at your company would answer if a customer asked tomorrow which AI sees their data?
Frequently asked questions
Is there an AI law in Switzerland?
No. The Federal Office of Communications states that there is still no overarching legislation specific to AI. On 12 February 2025 the Federal Council decided to ratify the Council of Europe AI Convention and to adapt existing laws on a sector-specific basis. A consultation draft is due by the end of 2026.
Which rules already apply to AI in Switzerland today?
Mainly the Data Protection Act. The Federal Data Protection Commissioner holds that it is technology-neutral and therefore directly applicable to AI-supported processing. From that follow a transparency duty covering purpose, functioning and data sources, the processor rules under Art. 9, and the duties for automated individual decisions under Art. 21.
Does the EU AI Act apply to Swiss companies?
It can. Under Art. 2(1) it covers providers from third countries placing AI systems on the Union market, and providers and deployers in third countries where the output of the system is used in the Union. Since the AI Omnibus the high-risk rules apply from December 2027 and August 2028.
