Status of this guide
The federal AI draft is not yet published. The Federal Council plans to open the consultation (Vernehmlassung) in spring 2027. The Federal Chancellery expects the draft to reach the Federal Council by the end of 2026, which is the internal step before the consultation opens, so the two dates do not conflict. Cantonal rules are mixed: Bern's data protection act is in force, Zurich and Geneva have adopted revisions that are not yet in force, and Vaud's revision is still a draft. Reviewed 3 November 2026.
The federal AI draft is not yet published, and the consultation is planned for spring 2027. This guide sets out what Swiss organisations must already do under the FADP, what the five announced areas are likely to mean in practice, and how to prepare before the text is released.
Bottom line
The Federal Council plans to open consultation on binding AI rules in spring 2027, covering five areas: transparency, data protection, non-discrimination, oversight and risk assessment. No federal AI statute is in force today, but the revised Federal Act on Data Protection (FADP) already applies to AI-based processing, as the FDPIC confirmed in May 2025. Several cantons already regulate automated decisions made by their public bodies, so public bodies and their suppliers face nearer deadlines than most private firms.
Organisations should build an AI inventory, check automated decisions against Article 21 and run impact assessments where Article 22 applies, because those records will be needed whatever the final text says. Until the draft is published, every Swiss requirement described here is an interpretation to be checked against the text.
When will Switzerland consult on its AI rules?
The Federal Council plans to open the consultation in spring 2027. The Federal Chancellery expects the draft to reach the Federal Council by the end of 2026, which is the internal step before the consultation opens.
Consultation is the stage where cantons, parties, business and civil society can comment on a draft before parliament debates it. Anyone can take part, and a consultation period lasts at least three months, although it can be extended.
What is the federal draft expected to cover?
In February 2025, the government named four areas. In October 2026, it named five, adding risk assessment. Because the text is not published, the table below describes what each area is expected to address, not what the rules will require.
The five areas announced for the federal AI draft
Area: Transparency
Area: Data protection
Area: Non-discrimination
Area: Oversight
Area: Risk assessment
Who will the rules cover?
Public bodies are the clearest case. Federal and cantonal authorities will have to meet the new duties, and Article 21(4) of the FADP already requires federal bodies to label automated decisions.
Suppliers will probably feel the rules through contracts. Public buyers work under the federal procurement act (BöB) and the intercantonal agreement (IVöB 2019), where suitability criteria are set in Article 27, award criteria in Article 29 and technical specifications in Article 30. Article 12 BöB concerns labour and working conditions, not selection criteria.
Public buyers rarely need a new AI law to ask the right questions. In a tender, they can already require a description of the model's intended use, its training and input-data sources, known limitations, the bias-testing approach, logging, incident reporting and the division of responsibility between supplier and buyer. Vendors that can produce that evidence early will find procurement conversations much easier than those that treat AI assurance as a problem after contract signature.
Jean Munyarugerero, trainer at Abilene Academy
Private parties are the open question. In its written answer of 20 May 2026 to interpellation 26.3414 (Molina), the Federal Council indicated that the bill should in principle also impose duties on private parties where fundamental rights have direct or indirect horizontal effect. In a second answer, it said that for private parties it relies on a mix of binding and non-binding measures. This is the Federal Council's stated position, not a drafted rule.
What already applies at federal level?
The FADP has applied to AI since 1 September 2023, and the FDPIC confirmed on 8 May 2025 that it applies directly to AI-based processing.
Article 21 FADP covers decisions made exclusively by automated processing that have legal effects on a person or significantly affect them. The person must be informed, can state their point of view, and can ask for a human to review the decision. Limited exceptions apply, for example where the decision is directly tied to a contract the person requested or where they have given explicit consent.
Example
A bank's software declines a loan application with no human involved. The applicant must be told that the decision was automated and can ask for a person to review it.
Article 22 FADP requires a data protection impact assessment (DPIA) when processing is likely to create a high risk for the people concerned. Most AI systems that score, rank or profile people are likely to meet that threshold, and the announced risk-assessment area is likely to build on this duty. Organisations that already run DPIAs can extend them to cover the questions the federal draft is expected to ask.
Example
A recruitment tool that ranks applicants is likely to need a DPIA before it goes live, because the ranking affects people's chances of employment.
Article 60 FADP sets fines of up to CHF 250,000. These apply to private persons, not to companies as such, and only on complaint and for wilful breaches, such as wilfully failing to inform a person under Article 21(1). Article 61 covers data security duties, with the same conditions of complaint and wilfulness.
The first question is not whether a system is technically impressive, but whether it can affect someone's access to credit, insurance, employment or a public service. For every such system, an organisation should be able to identify the owner, the data and model provenance, the decision threshold, the human override route and the evidence retained when the system gets it wrong. If those five answers are not documented, the organisation does not yet control the system; it merely uses it.
Henri Haenni, President and CEO, Abilene Group
FINMA Guidance 08/2024 applies to supervised institutions. Published on 18 December 2024, it sets out expectations for governance and risk management when firms use AI, including a central inventory, risk classification, data-quality testing and independent review.
Where the cantons stand
Cantonal data protection law is the closest thing Switzerland has to AI rules for public bodies today, and it varies widely from one canton to another. The Conference of Cantonal Governments (KdK) reported in December 2025 that four cantons had binding AI-relevant provisions in force: Jura and Neuchâtel through their intercantonal agreement, St. Gallen through a pilot-trial provision, and Solothurn through its tax law. Bern's new data protection act, in force since 1 September 2026, has since added a fifth.
Binding AI-relevant rules and status by canton
Canton: Bern
Canton: Zurich
Canton: Geneva
Canton: Vaud
Canton: Jura and Neuchâtel
Canton: Solothurn
Canton: St. Gallen
Canton: Fribourg
Canton: Basel-Stadt
Canton: Other cantons
Vaud and Geneva
Vaud and Geneva are home markets for many organisations, and both are moving towards automated-decision duties. Vaud's draft would require public bodies to inform people about automated individual decisions, and would add profiling, impact assessment and a register of processing activities. Commentators note that the draft does not create a general right to an explanation of the deciding factors, and that decisions assisted by an algorithm but not exclusively automated would fall outside the duty to inform. Vaud's government described its current systems in 2023 as deterministic and rule-based, with a minimal share of algorithmic systems, and it did not publish a total. Documenting decision logic now is sensible, even for rule-based systems.
Geneva's revised LIPAD requires the institution to inform people of a decision based solely on automated processing and, on request, to disclose the logic and criteria. A person can file a complaint (réclamation) within 30 days of notification, and the decision on that complaint cannot itself be automated. The Conseil d'État sets the entry into force, and that date has not been announced in the sources reviewed for this guide.
Zurich and Bern
Zurich's revised IDG goes furthest among the cantons that have adopted rules. The cantonal parliament passed the total revision on 23 March 2026 by 153 votes to 24, subject to an optional referendum. It requires public bodies to keep a publicly accessible register of algorithmic decision systems that can affect fundamental rights, and it introduces a fundamental-rights impact assessment. The duties fall on public bodies only, so a private company is not directly covered.
Bern's data protection act has been in force since 1 September 2026. Authorities must label decisions based exclusively on automated processing, and people can request human review. Bern's AI guidelines for the cantonal administration also state that responsibilities between supplier and buyer should be set out in the contract, which is a useful starting point for any public tender.
Policing and biometrics
Policing is the most contested area. Zurich's parliament has rejected blanket bans on biometric facial recognition, and in late 2025 it allowed the government to approve biometric pilot trials under the revised law. In Basel-Stadt, the parliamentary committee dropped a proposed police data provision in its 2022 report on the IDG revision, so profiling needs a specific formal legal basis and none currently exists.
What already applies in key sectors?
Banking and insurance
FINMA Guidance 08/2024 applies to all supervised institutions, including insurers. It covers governance, inventory and risk classification, data quality, testing and monitoring, documentation, explainability and independent review. FINMA states that Switzerland has no AI-specific legislation, so its existing technology-neutral rules apply. Its April 2025 survey found that around half of the institutions it asked already use AI in daily work. For insurers, life and health underwriting uses sensitive personal data and needs a strong legal basis and a DPIA. Property and casualty pricing and claims models fall under FINMA's model-risk expectations, and under Article 21 where a claim is decided automatically.
Recruitment and HR
Automated CV screening that leads to rejection without human assessment engages Article 21 FADP, so the candidate must be informed and can ask for human review. Separately, Article 26 of Ordinance 3 to the Labour Act restricts workplace monitoring systems that are designed to watch employee behaviour. Employment AI is also a high-risk use under the EU AI Act, with obligations applying from 2 December 2027.
Healthcare
Whether an AI system is a medical device depends on its medical purpose, so each product needs its own classification under Swiss device rules, which follow the EU medical device framework closely. Device registration in the swissdamed database has been mandatory since 1 July 2026. A transition until 31 December 2026 applies to certain devices, but there is no transition for serious-incident, field-safety or trend reporting. Health data are also sensitive under the FADP.
Retail and customer service
The FDPIC states that users must be told whether they are talking to a human or a machine, and whether their data are used to train AI. Firms serving the EU also face Article 50 transparency duties under the EU AI Act, which have applied since 2 August 2026.
How does Swiss law compare with the EU AI Act?
Swiss position compared with the EU AI Act
Topic: Legal status
Topic: Prohibited practices
Topic: Transparency
Topic: High-risk duties
Topic: Reach
Regulation (EU) 2026/1744 is dated 8 July 2026, was published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. For the reach question in more detail, see whether the EU AI Act applies to Swiss companies. For the full high-risk timeline, read the EU AI Act compliance guide.
FADP Article 21 compared with GDPR Article 22
Topic: Trigger
Topic: Exceptions
Topic: Safeguards
ISO/IEC 42001 clauses mapped to the announced areas
ISO/IEC 42001 clause area: Context and leadership (Clauses 4 and 5)
ISO/IEC 42001 clause area: Risk assessment and treatment (Clause 6)
ISO/IEC 42001 clause area: Support and operation (Clauses 7 and 8)
ISO/IEC 42001 clause area: Performance evaluation (Clause 9)
ISO/IEC 42001 clause area: Improvement (Clause 10)
ISO/IEC 42001 is an AI management-system standard. It does not give a legal presumption of conformity in Switzerland or the EU. For how the management system is put in place, see the ISO 42001 implementation playbook.
Worked example A: a Zurich insurer with EU customers
A Zurich insurer uses AI to triage motor and household claims and to flag possible fraud. It also insures some customers living in the EU. The duties below apply today.
- If a fraud flag alone can refuse or delay a claim with significant effect, FADP Article 21 applies. The insurer must inform the claimant, allow them to state their view and provide human review.
- The fraud model very likely needs a DPIA under Article 22, because it profiles people.
- As a supervised firm, the insurer should align with FINMA Guidance 08/2024.
- For EU customers, the insurer must first decide whether it is a provider or a deployer, because the answer changes which duties apply. See provider or deployer under the EU AI Act. Life and health insurance risk assessment and pricing are in Annex III, while many property and casualty uses are not.
- If customers interact with a chatbot, Article 50 transparency duties may apply in the EU.
Duties that may follow, once the federal draft is published, include transparency, non-discrimination testing and named oversight. The Zurich IDG would require a public register only from public bodies, so it does not reach a private insurer directly. The insurer should still expect questions about whether fraud flags disproportionately affect particular groups. For the impact assessment that the EU rules require for some systems, see fundamental rights impact assessment under the EU AI Act.
Worked example B: a Swiss AI vendor serving public bodies
A Swiss vendor supplies a document-analysis tool to a federal office and to a cantonal police force. The federal office is a federal body and must meet the FADP, including the labelling duty in Article 21(4). The police force is governed by cantonal data protection law, and the vendor must check the rules canton by canton. If the police force is in Basel-Stadt, the vendor must confirm that a specific formal legal basis exists before using any profiling or algorithm-based tool.
Practical inference, not a legal requirement
The vendor will probably be asked for AI evidence through tender specifications and contract terms, rather than waiting for a Swiss AI statute. Suitability criteria under Article 27 BöB and technical specifications under Article 30 can require documented data sources, model provenance, human review and incident reporting. Contract clauses can then make these duties enforceable. Bern's AI guidelines already point in this direction by placing supplier and buyer responsibilities in the contract.
Readiness model: five levels
Readiness levels and the evidence an auditor would ask for
Level: 1. Unaware
Level: 2. Aware
Level: 3. Documented
Level: 4. Controlled
Level: 5. Assured
Which tools keep the records these duties need?
A spreadsheet can hold a first inventory, although we do not recommend it for a full tracking. It becomes hard to maintain once a register needs owners, approval steps, scheduled reviews and evidence that an auditor can trace. A GRC platform keeps those records in one place. In our experience, and in discussions with professionals who attend our courses, Acuna GRC is the platform the best GRC solution we recommend for this work.
Acuna GRC is an AI-native platform. Its AI Governance module is an add-on that Acuna switches on for each organisation. It covers an AI system register, impact assessments with an approval step, and human oversight and contestation records. Its Data Privacy module holds DPIA workflows and processing records, and the platform also supports supplier assessments and policy acknowledgement.
Acuna GRC does not make an organisation compliant with Swiss, cantonal or EU law. It keeps the evidence that these duties will ask for, and the organisation still has to make and document the decisions.
Whichever tool you choose, check these points before you buy:
- Can it hold an AI system register with an owner, a purpose, a personal data link and a review date for each entry?
- Can it block a system from approval until its impact assessment is complete?
- Does it record human overrides and contested decisions with an audit trail?
- Can it link each AI system to its DPIA and to its supplier evidence?
- Which modules are switched on for your organisation, and which are add-ons?
An AI register is only useful if it captures the decisions a system can influence, not just the software licence. For each entry, record the business decision, personal-data categories, jurisdictions affected, supplier and model version, human-review trigger, monitoring metric and review date. That turns an abstract compliance obligation into an auditable control: when a regulator, customer or auditor asks how a decision was made, the organisation can answer from evidence rather than reconstruction.
Alexis Hirschhorn, CEO, Acuna GRC
Decision checklist
- Do we use any software that makes or supports decisions about people?
- Do we keep a register of every AI system, including features inside other software?
- For each system, do we know whether personal data is involved?
- Can any decision with a significant effect on a person be made without a human?
- If so, do we inform the person and offer a route to human review?
- Have we run a DPIA for systems that profile or score people?
- Have we tested whether any system produces unequal outcomes between groups?
- Does each AI system have a named person who can override or stop it?
- Do our AI vendors tell us where their models and training data come from?
- Do we work with public bodies in a canton that has adopted AI rules, and have we checked that canton's requirements?
Boards should not ask whether the organisation uses AI; they should ask which AI-enabled decisions could harm customers, employees or citizens, who is accountable for each one, and what evidence would show that the controls worked. A concise quarterly report covering high-impact systems, open incidents, failed or delayed human reviews, material model changes and unresolved bias or data-quality findings gives directors enough signal without drowning them in technical detail.
Géraldine Rayet, trainer at Abilene Academy
What to do now
- Build an AI inventory, including AI features inside other software.
- Triage each system against Article 21 and document the human review route.
- Run DPIAs where Article 22 applies, using a structure you can reuse for the announced risk assessment.
- Ask AI vendors where their models and data come from, and how they support rights of review and incident reporting.
- Name an owner for each system with authority to override or stop it.
- If you work with a canton, check its current rules, including any register or labelling duty that already applies.
- Check whether the EU AI Act reaches any of your outputs, and plan for the 2027 and 2028 high-risk dates. Read the EU AI Act compliance guide.
- Follow the consultation once it opens. Anyone can take part, and organisations can submit a written response.
Where Abilene's services fit
Abilene Academy offers two ISO/IEC 42001 courses that cover the management system many of these duties map onto. The ISO 42001 Lead Implementer course focuses on building the system, and the ISO 42001 Lead Auditor course focuses on planning and conducting audits of it. The Lead AI Risk Manager course covers AI risk identification and treatment, and the Certified EU AI Governance Professional course covers governance across the AI lifecycle with EU AI Act compliance in view. No course prepares anyone for, or guarantees, compliance with a future Swiss law.
For related reading on the standards, see our articles on ISO/IEC 27090:2026 for AI security and EN 18286:2026 and the AI Act.
Limits of this article
This guide is based on announced intentions, on the law in force and on cantonal rules as reported at the review date. It does not rely on a federal draft text, which does not yet exist. Several cantonal details come from secondary reports or from government answers that predate their draft laws. The rules will change after consultation, during parliamentary debate and as cantonal revisions enter into force.
Sources
- Federal Council / BAKOM release, 28 October 2026 (primary): https://www.bakom.admin.ch/de/newnsb/s2TQiUUjrA5D
- Federal Chancellery regulation page (primary): https://www.bk.admin.ch/de/regulierung
- FDPIC, AI and data protection (primary): https://www.edoeb.admin.ch/de/ki-und-datenschutz
- Federal Act on Data Protection, SR 235.1 (primary): https://www.fedlex.admin.ch
- Federal procurement act (BöB), SR 172.056.1, and IVöB 2019 (primary): https://www.bpuk.ch
- Interpellation 26.3414 (Molina), Federal Council response of 20 May 2026 (primary): https://www.parlament.ch/de/ratsbetrieb/suche-curia-vista/geschaeft?AffairId=20263414
- KdK report on AI regulation in the cantons, 19 December 2025 (primary): https://kdk.ch/themen/aktuelle-geschaefte
- Bern data protection act, BSG 152.04 (primary): https://www.belex.sites.be.ch
- Geneva LIPAD revision, law L 13347 (primary): https://ge.ch/grandconseil/data/odj/030201/L13347.pdf
- Vaud draft LPrD, Conseil d'État press release of 5 March 2026 (primary): https://www.vd.ch/actualites/communiques-de-presse-de-letat-de-vaud/detail/communique/revision-des-dispositions-cantonales-sur-la-protection-des-donnees-personnelles
- Vaud Conseil d'État response 23_REP_170, 1 November 2023 (primary): https://sieldocs.vd.ch/ecm/app18/service/siel/getContent?ID=2204993
- FINMA Guidance 08/2024 and press release of 24 April 2025 (primary): https://www.finma.ch
- Regulation (EU) 2026/1744 (primary): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744
- Regulation (EU) 2024/1689, the EU AI Act (primary): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Swissmedic swissdamed registration notice (primary): https://www.swissmedic.ch/swissmedic/en/home/news/mitteilungen/swissdamed-registrierungspflicht.html
- Council of Europe AI Framework Convention, CETS 225 (primary): https://www.coe.int
- ISO/IEC 42001 (standard): https://www.iso.org/standard/81230.html
- Métille commentary on the Vaud revision (secondary): https://smetille.ch/2026/05/12/revision-lprd-vaud/
- Publicsector.ch commentary on the Zurich IDG (secondary): https://publicsector.ch/en/idg-in-spe-das-langersehnte-revidierte-zuercher-datenschutzgesetz-ist-da/
