How does Switzerland regulate AI?

On 12 February 2025, the Federal Council chose not to copy the EU AI Act. Switzerland signed the Council of Europe Framework Convention on Artificial Intelligence on 27 March 2025 and plans to ratify it. The legal changes needed for that are to be sector-specific where possible, with general rules limited to areas that touch fundamental rights such as data protection, and supported by non-binding measures such as self-declaration agreements. The Federal Council announced the consultation draft for the end of 2026.

• The FADP is technology-neutral and applies directly to AI that processes personal data, as the FDPIC has stated. Controllers must be transparent about the processing, run a DPIA where the risk is high, and under Article 21 inform people of decisions based solely on automated processing that significantly affect them and let them ask for a review by a person.
• Sector rules apply to AI like any other technology, for example anti-discrimination, product liability, copyright and financial market law.
• FINMA set out its expectations for supervised institutions using AI in Guidance 08/2024 on governance and risk management.

The EU AI Act reaches companies outside the EU when they place AI systems or general-purpose AI models on the EU market, or when the output of their AI system is used in the EU (Article 2). A Swiss provider selling an AI product to EU customers, or a Swiss group whose EU subsidiary deploys AI, needs to meet it for those cases.

In AI Governance in Acuna GRC, each AI system you build, buy or deploy has one record with its provider, autonomy, affected parties and a classification with a required rationale. Impact assessments, human oversight, incidents and contestations hang off that record, and linking a system to its processing activities in Data Privacy keeps the DPIA beside it. The module keeps the records these obligations ask for; it does not certify conformity. See AI Governance in Acuna GRC.