Setting up AI governance: roles, inventory and obligations

Short answer: Neither the EU AI Act (Regulation (EU) 2024/1689) nor Swiss law requires an AI officer. The AI Act does, however, require clear responsibilities: since 2 February 2025, providers and deployers must avoid prohibited AI practices (Art. 5) and take measures to build the AI literacy of their staff (Art. 4, amended with effect from 27 July 2026). Transparency duties (Art. 50) have applied since 2 August 2026, and duties for high-risk systems listed in Annex III apply from 2 December 2027. AI governance built on an AI inventory, assigned roles and a governance committee is therefore the practical route.

This guide is for general counsel, heads of compliance, data protection leads and CIOs in Switzerland and Germany. It covers whether you need an AI governance officer, how to build an AI inventory, which duties apply to which role, what applies in Switzerland and what a realistic project plan looks like.

No mandatory AI officer, but clear responsibility

The AI Act attaches duties to roles such as provider and deployer, not to a specific function within a company. It contains no obligation to appoint an AI officer. Some provisions do, however, require people with clear responsibility to act:

• Human oversight: deployers of high-risk systems assign human oversight to natural persons with the necessary competence, training and authority (Art. 26(2) AI Act).
• AI literacy: providers and deployers take measures to promote the AI literacy of their staff (Art. 4 AI Act).
• Informing the workforce: employers inform workers' representatives and affected workers before putting a high-risk system into use at the workplace (Art. 26(7) AI Act).

Many companies therefore name a person responsible for AI governance and set up a committee with legal, compliance, data protection, information security, HR and the business. This is an organisational choice, not a statutory role. In Germany, the Federal Network Agency (Bundesnetzagentur) has been the central market surveillance authority since 29 July 2026, unless another sector authority is responsible (KI-MIG, the German AI Act implementation law).

AI inventory and risk classification

An AI inventory is the foundation of any AI governance framework: without a list of the AI systems a company uses and develops, it cannot determine its role or the risk. An AI system under Art. 3(1) AI Act is a machine-based system that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions.

What the inventory records for each system

• purpose, business unit and owner,
• origin: purchased, embedded in software, developed in-house or built on a foundation model,
• the company's role: provider, deployer or both,
• EU nexus: placed on the EU market or output used in the EU,
• personal data processed and people affected,
• risk class and resulting duties.

Classification in six steps

1. Is it an AI system under Art. 3(1) AI Act?
2. Does it fall under a prohibited practice in Art. 5?
3. Is it high-risk, because it is a safety component of a product under Annex I or is used in an Annex III area such as biometrics, critical infrastructure, education, employment and workforce management, or access to essential services such as creditworthiness assessment?
4. Do the Art. 50 transparency duties apply, for example to chatbots or generated content?
5. Does the company itself offer a general-purpose AI model?
6. Is it a low-risk system? Then mainly AI literacy and internal rules apply.

Roles under the AI Act: provider, deployer, governance committee

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name (Art. 3(3) AI Act). A deployer uses an AI system under its own authority in a professional context (Art. 3(4) AI Act). Most companies are deployers; a company that puts its name on a high-risk system, substantially modifies it or changes its intended purpose so that it becomes high-risk is treated as a provider (Art. 25(1) AI Act).

The governance committee

An AI governance committee is not a role under the AI Act, but it is the usual way to manage the duties. It approves new AI use cases, decides on risk classes, maintains policies and reports to management. It typically includes legal, compliance, data protection, information security, HR and the main business units. Where personal data is involved, the Swiss DSG and the GDPR must be considered too; how this plays out in product development is shown in data protection for product launches.

AI literacy for staff

Under the amended Art. 4 AI Act, AI literacy means that providers and deployers take measures to promote the AI literacy of their staff. They do not have to ensure a specific level of competence; the European Commission publishes practical examples. The duty has applied since 2 February 2025, the new wording since 27 July 2026.

• Train by role: users, development teams, managers and people exercising human oversight need different content.
• Set rules: approved tools, handling of confidential and personal data, labelling of AI-generated content.
• Keep records: document attendance, content and updates.
• Refresh regularly: add new features and use cases from the inventory to the training.

Switzerland: where AI regulation stands

Switzerland has no dedicated AI law. On 12 February 2025, the Federal Council decided to ratify the Council of Europe's AI Convention and adapt Swiss law accordingly. On 28 October 2026, it took note of an interim report on AI regulation. The Federal Office of Justice is drafting binding measures on transparency, data protection, non-discrimination, oversight and risk assessment; in addition, the federal government relies on guidelines, industry standards and voluntary commitments, supported for example by a toolkit for an AI code of conduct. The consultation on the binding measures is due to open in spring 2027.

Three things nevertheless apply to Swiss companies:

• The AI Act reaches beyond the EU: it covers providers that place AI systems on the EU market, wherever they are based, and providers and deployers in third countries where the output is used in the EU (Art. 2(1)(a) and (c) AI Act).
• Data Protection Act: for automated individual decisions there is a duty to inform, with the right to have the decision reviewed by a human (Art. 21 DSG). New technologies can trigger a data protection impact assessment (Art. 22 DSG).
• Financial sector: in Guidance 08/2024 of 18 December 2024, FINMA set out its expectations on governance and risk management when using AI, including inventory, risk classification, responsibilities, data quality, testing and explainability.

Resources and project plan

Building AI governance can be planned in six steps; most companies need legal, compliance and data protection capacity on top of day-to-day work.

1. Mandate and committee: assign responsibility at management level, define the committee and decision routes.
2. Inventory: capture AI systems across all business units, including features embedded in standard software.
3. Classification: determine role and risk class per system, prioritise gaps.
4. Rules and contracts: AI policy, approval process for new use cases, contract clauses with vendors.
5. Literacy: introduce a role-based training programme and document it.
6. High-risk readiness: for Annex III systems, prepare human oversight, logging, workforce information and, where required, a fundamental rights impact assessment by December 2027.

Roles in the project

• AI governance lead: project management, committee, reporting.
• Technology and data legal counsel: classification, role questions, contracts, policy.
• Compliance officer: controls, training records, integration into compliance management.
• Data protection lawyer: DPIAs, transparency duties, automated decisions.

Alpinum Solutions provides such professionals through staff leasing (Personalverleih in Switzerland, Arbeitnehmerüberlassung in Germany) or freelancing, in Switzerland and Germany, part time or full time, individually or as a team. The client steers the assignment: in staff leasing it gives the professional instructions; in freelancing the professional works independently within the agreed mandate. How the AI Act deadlines drive capacity needs is covered in AI Act deadlines, duties and capacity; the data protection basics are in legal support for data protection projects.

Example (assumption)

A manufacturing company based in Switzerland with subsidiaries in Germany uses an AI tool to pre-screen job applications, several chatbots and generative AI in marketing. The screening tool is a high-risk system under Annex III point 4, and the company is its deployer. One legal counsel (60%, six months) and one compliance officer (40%, four months) build the inventory, policy and training programme and prepare the Art. 26 duties. All figures are assumptions for illustration.

Limits and risks

• Responsibility stays with the company: AI Act duties fall on providers and deployers; external professionals prepare and implement.
• No legal advice: Alpinum is not a law firm. Disputed classifications or conformity assessments are for the company to resolve, where necessary with external counsel or a notified body.
• Rules in motion: the Digital Omnibus has moved dates, and Commission guidance and national laws are following. The inventory and classification should be reviewed regularly.
• Fines: prohibited practices can lead to fines of up to EUR 35 million or 7% of worldwide annual turnover, other breaches up to EUR 15 million or 3% (Art. 99(3) and (4) AI Act; the higher amount applies).

Frequently asked questions about AI governance and AI officers

Does the AI Act apply to Swiss companies?

Yes, in certain cases. The AI Act covers providers that place AI systems on the market or put them into service in the EU, wherever they are based, and providers and deployers in third countries where the system's output is used in the EU (Art. 2(1) AI Act). Swiss companies with EU customers or EU subsidiaries should therefore inventory their systems.

What does AI literacy mean?

Under Art. 4 AI Act as amended with effect from 27 July 2026, providers and deployers must take measures to promote the AI literacy of their staff. They do not have to ensure a specific level. In practice, this means role-based training, clear usage rules and documented records.

Does my company need an AI officer?

Not by law: the AI Act contains no obligation to appoint an AI officer. It does require duties to be assigned, such as human oversight of high-risk systems by competent people with authority (Art. 26(2)). A person responsible for AI governance, supported by a committee, therefore makes sense for most companies.

What is the difference between a provider and a deployer?

Providers develop an AI system, or have one developed, and place it on the market under their own name (Art. 3(3) AI Act). Deployers use an AI system under their own authority in a professional context (Art. 3(4)). A deployer becomes a provider if it offers a high-risk system under its own name, substantially modifies it or changes its purpose so that it becomes high-risk (Art. 25(1)).

What fines does the AI Act provide for?

Prohibited practices can lead to fines of up to EUR 35 million or 7% of worldwide annual turnover, other breaches up to EUR 15 million or 3%, and supplying incorrect information up to EUR 7.5 million or 1%. In each case the higher amount applies (Art. 99(3) to (5) AI Act). For SMEs and, since the Digital Omnibus, small mid-caps, the lower amount applies.

Next step

If the inventory, classification or training programme needs extra capacity, Alpinum provides legal, compliance and data protection professionals for AI governance. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the client and Alpinum.

• Data protection and AI governance
• AI Act deadlines, duties and capacity
• Data protection for product launches
• Discuss your requirements

Last updated: 30 October 2026.