Often, yes. Switzerland is not in the EU, but the EU AI Act has extraterritorial reach: it applies to Swiss providers and deployers whose AI systems are placed on the EU market or whose outputs are used within the EU (Art. 2). Swiss firms serving EU customers must comply, and Switzerland is separately preparing domestic AI rules aligned with the Council of Europe AI Convention.
A common misreading is that Switzerland sits outside the EU AI Act because it is not an EU member state. In practice the Regulation reaches many Swiss organisations through its extraterritorial scope, in the same way the GDPR did for data protection.
Article 2 extends the Act to providers that place AI systems on the EU market regardless of where they are established, and to providers and deployers located outside the EU where the output of the AI system is used in the EU. A Swiss software vendor selling an AI product to EU clients, or a Swiss group whose model outputs are consumed by an EU subsidiary, is therefore captured. The trigger is the EU market and EU use, not the company's registered address.
Separately, the Federal Council has signalled that Switzerland will regulate AI in a way compatible with the Council of Europe Framework Convention on Artificial Intelligence, which it signed. The direction of travel is convergence rather than divergence, so building to the EU AI Act now is a defensible baseline for Swiss-only operations as well.
Expert view: for a Swiss CISO or DPO, the pragmatic move is to scope EU exposure first, then adopt an ISO/IEC 42001 AI management system as the control framework. It satisfies the EU AI Act's governance expectations and positions you for the coming Swiss rules without maintaining two parallel programmes.
Do the market-exposure analysis before assuming you are out of scope. Most Swiss firms with EU customers or EU-based group entities will find at least some AI systems in scope, and the safest baseline is to govern to the EU AI Act standard.
This ISO/IEC 42001 Lead Implementer course trains professionals to design and deploy an Artificial Intelligence Management System that stands up to regulatory, ethical, and operational scrutiny.
View courseThis training is designed for professionals who must structure, operate, and defend an information security risk management process aligned with ISO/IEC 27005:2022. Participants work through the full risk lifecycle, from context definition to treatment decisions and executive reporting.
View courseThis course prepares participants to manage, govern, and scale AI initiatives aligned with business objectives. It addresses growing pressure to control AI risks, ensure transparency, and deliver measurable value from AI investments. Participants evaluate AI opportunities, structure governance, design dashboards, and automate workflows using no-code tools. Abilene Academy teaches through real case execution, Power BI and n8n labs, and exam-focused coaching led by active consultants. It is designed for AI project managers, business leaders, compliance professionals, and transformation leads.
View courseThe EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. Bans on prohibited AI have applied since 2 February 2025; governance and general-purpose AI (GPAI) obligations since 2 August 2025; the transparency rules since 2 August 2026; and, since the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Annex III high-risk rules apply from 2 December 2027. High-risk systems embedded in already-regulated products have until 2 August 2028.
The EU AI Act applies to AI systems placed on the EU market, put into service there, or whose outputs are used in the EU, wherever the company is based. Applicability is decided per system and per use case.
A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority. One organization can hold both roles for different systems.
Identify AI risks through lifecycle analysis: data risks (bias, quality), model risks (drift, overfitting), deployment risks (adversarial attacks, misuse), and operational risks (feedback loops, unintended impacts).
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. Bans on prohibited AI have applied since 2 February 2025; governance and general-purpose AI (GPAI) obligations since 2 August 2025; the transparency rules since 2 August 2026; and, since the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Annex III high-risk rules apply from 2 December 2027. High-risk systems embedded in already-regulated products have until 2 August 2028.
AI risks are dynamic, probabilistic, and context-dependent. Unlike static IT systems, AI models degrade over time, produce unexpected outputs, and fail in ways difficult to predict or test comprehensively.
The exam is domain-based, covering AI risk concepts and regulations, governance, identification and analysis, evaluation/treatment/monitoring, and organizational learning and performance improvement.
ISO/IEC 42006 changed who can certify you, ISO 19011:2026 changed how the audit runs, and the Omnibus moved the AI Act deadlines. What an AIMS audit demands, evidence by evidence.
ISO 27001 gives you a head start on ISO 42001, not a free pass. Here is what carries over, what is new, and how to extend your ISMS to an AIMS, step by step.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.