AI regulation in Switzerland: status, Council of Europe convention and the EU AI Act

Short answer: Switzerland has no dedicated AI law yet. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI convention and to adapt Swiss law in targeted areas; consultation on a federal act is planned for spring 2027. Until then, AI regulation in Switzerland rests mainly on the Data Protection Act. Swiss companies whose AI systems or outputs are used in the EU are also covered by the EU AI Act.

This article is for general counsel, compliance and data protection leads at Swiss companies and financial institutions. It sets out where Swiss AI regulation stands, what the Council of Europe convention means, how the EU AI Act reaches into Switzerland and which roles implementation requires.

What is AI regulation in Switzerland about?

Switzerland is not adopting a comprehensive AI law on the EU model; instead it is implementing the Council of Europe's AI convention. The Federal Council took this decision on 12 February 2025 after a review of regulatory options. Legislative changes are to be sector-specific where possible, and cross-cutting rules are limited to areas that affect fundamental rights, such as data protection.

Since then the work has followed two tracks (Federal Office of Communications OFCOM, status 28 October 2026, in German):

• Legally binding measures: the Federal Department of Justice and Police (Federal Office of Justice) is drafting a federal act for consultation together with the environment, transport, energy and communications department and the foreign ministry. It is to cover transparency, data protection, non-discrimination, oversight and risk assessment.
• Non-binding measures: OFCOM coordinates industry dialogues, guidelines, industry standards and voluntary commitments. The first results are a report on sector-specific measures and guidance for drafting an AI code of conduct, both dated 26 October 2026.

The Council of Europe convention

The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first binding international treaty on AI. Federal Councillor Albert Rösti signed it for Switzerland in Strasbourg on 27 March 2025. Switzerland has not ratified it yet; ratification depends on the implementing act. As an international treaty, the convention binds states; obligations for companies only arise through Swiss implementing law.

Who is affected?

Today AI regulation reaches Swiss companies in three ways: through existing data protection law, through the EU AI Act and, for financial institutions, through FINMA's supervisory practice.

• Any company processing personal data with AI: according to the Federal Data Protection and Information Commissioner (FDPIC), the Data Protection Act applies directly to AI-supported data processing.
• Companies with an EU link: the AI Act also covers providers outside the EU if they place AI systems on the EU market or if the output of their systems is used in the EU (Art. 2(1)(a) and (c) AI Act). This includes software providers with EU clients and groups with EU subsidiaries.
• Banks, insurers and other FINMA-supervised firms: in Guidance 08/2024 of 18 December 2024 FINMA set out its expectations for governance and risk management when using AI.
• In future: who the new federal act will cover will only become clear with the consultation draft.

Deadlines and status: Switzerland, the Council of Europe and the EU AI Act

Switzerland itself has no AI-specific deadlines yet; the binding dates at present are those of the EU AI Act for companies with an EU link. The table reflects the position on 10 November 2026.

All AI Act dates and the roles under the regulation are covered in AI Act: deadlines, obligations and capacity.

What companies need to do now

Companies should not wait for the Swiss act; they should meet the duties that already apply and build AI governance that can absorb later rules. A practical approach:

1. Build an AI inventory: record AI applications in use or purchased, with purpose, data sources, owners and any use in the EU. FINMA found gaps at financial institutions in inventories, data quality, testing and explainability.
2. Check data protection: inform people about purpose, functionality and data sources, allow automated individual decisions to be reviewed by a person on request and carry out a data protection impact assessment where high risk is likely (Art. 22 FADP). Our GDPR vs Swiss FADP comparison shows the differences.
3. Clarify the EU link: for each system, check whether it is offered in the EU or its output is used there, and determine your role under the AI Act (provider, deployer, importer).
4. Set governance: define responsibilities, approvals, model risks such as robustness, bias and explainability, and due diligence on purchased software. See setting up AI governance.
5. Consider a voluntary code: use OFCOM's guidance on an AI code of conduct if your industry or company wants to set voluntary rules.
6. Track the consultation: review the draft in spring 2027 and plan a response, directly or through your industry association.

Which roles and how much capacity you need

AI compliance cuts across functions: legal, data protection, compliance and IT have to work together, and most of the effort goes into the inventory and documentation.

Example (assumption): A company records 40 AI applications at six hours each for collection, classification and documentation, which is 240 hours. Ten high-risk applications need an impact assessment at 16 hours each, adding 160 hours, so around 400 hours in total. At 1,600 productive hours per full-time role a year, that is about five months at a 60 % workload.

How interim support helps

Interim professionals bring specialist knowledge for the inventory, impact assessments and AI Act classification for as long as the project runs, while the company keeps control. Alpinum Solutions provides data protection and IT lawyers, compliance specialists and project teams through staff leasing (Personalverleih, Swiss staff leasing) and freelancing, part-time or full-time from 20 to 100 %. Under staff leasing the client directs the work; freelancers work on their own responsibility within the agreed mandate. For staff leasing in Switzerland, Alpinum holds the cantonal licence.

• Project reinforcement: specialists for AI inventories, data protection impact assessments and contract reviews with AI vendors.
• Cover: experienced data protection lawyers during vacancies, see covering a data protection officer vacancy with interim support.
• Teams: mixed legal and compliance teams where EU and Swiss duties are implemented in parallel.

Alpinum is not a law firm and does not provide legal advice; whether an application falls under the AI Act is for the company to assess case by case.

Frequently asked questions about AI regulation in Switzerland

Does Switzerland have an AI law?

Not yet. Switzerland currently has no legislation specific to artificial intelligence. The Federal Council has instructed the Federal Department of Justice and Police to draft a federal act implementing the Council of Europe AI convention for consultation. According to OFCOM, the consultation is planned for spring 2027. Until then, the Data Protection Act and sector rules apply.

Does the EU AI Act apply to Swiss companies?

Not as Swiss law, but through its scope. Swiss companies are covered if they place AI systems on the EU market or if the output of their systems is used in the EU (Art. 2(1)(a) and (c) AI Act). Groups with EU subsidiaries are also covered there as deployers. Purely domestic applications are governed by Swiss law.

What is the Council of Europe AI convention?

The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first binding international treaty on AI. It requires the states that join it to protect fundamental rights, democracy and the rule of law when AI is used. Switzerland signed it on 27 March 2025 and intends to ratify it once the implementing act is in place.

What applies to AI and data protection in Switzerland today?

According to the FDPIC, the Data Protection Act applies directly to AI-supported data processing. Companies must disclose purpose, functionality and data sources. Individuals can ask for an automated individual decision to be reviewed by a person. Where high risk is likely, a data protection impact assessment is required (Art. 22 FADP), and falsified images, voices or faces must be labelled.

What does FINMA expect when financial institutions use AI?

FINMA expects financial institutions to identify, limit and control the risks arising from AI. In Guidance 08/2024 it highlights model risks such as lack of robustness, bias and poor explainability, as well as IT and cyber risks. It found that institutions focus more on data protection risks than on model risks, and saw gaps in inventories, data quality and testing.

Next step

If your AI inventory, impact assessments or AI Act classification need more capacity than your team has, talk to us about scope and profiles. Alpinum Solutions is the leading provider of interim legal & compliance in Switzerland; your company directs the assignment. Selected profiles are usually available within 48 hours; the start date is agreed jointly by the company and Alpinum.

• Data protection and AI governance: professionals and project teams
• Interim legal and compliance support in Switzerland
• AI Act: deadlines, obligations and capacity
• Regulatory radar: all articles on regulatory change
• Discuss your requirements

Last updated: 10 November 2026.