The FADP already applies to AI, whether or not your organisation has a dedicated AI policy

A common assumption among Swiss organisations deploying AI tools is that dedicated AI legislation is still some way off, and that current data protection law does not really reach AI-driven processing. The Federal Data Protection and Information Commissioner has already confirmed otherwise.

The FADP’s scope was never technology specific

Switzerland’s revised Federal Act on Data Protection took effect on 1 September 2023, bringing Swiss data protection broadly into line with the EU’s GDPR while retaining some Swiss specific differences. The FADP was written to be technology neutral rather than built around any one processing method.

The FDPIC’s confirmation on AI

On 8 May 2025, the FDPIC confirmed directly that the FADP is fully applicable to AI supported data processing. That means any AI system, whether an internally built model or a third party tool, that processes personal data relating to individuals in Switzerland falls within scope the moment personal data is involved, regardless of whether a company has adopted a formal AI governance policy.

What this means in practice for AI deployments

The FADP’s general requirements apply across the AI processing lifecycle, from data collection through to model output.

• Transparency and data minimisation obligations apply to AI based processing in the same way they apply to any other processing activity
• Data protection impact assessments are expected for high risk automated processing, which covers a meaningful share of practical AI use cases
• Organisations are expected to provide clear, understandable information on how a given algorithm works and on the rights of the individuals whose data it processes

Switzerland versus the EU AI Act, a separate question from GDPR

It is worth being precise about what does, and does not, apply to a Swiss organisation using AI.

Switzerland is not an EU member state, and Swiss incorporation, hosting, or model inference does not create an automatic exemption from the EU AI Act where that Act’s own scope conditions are met, nor does it create an automatic exemption from the GDPR where EU market activity or monitoring of individuals in the EU is involved. A mature GDPR compliance programme supplies useful infrastructure, data inventories, privacy notices, vendor reviews, impact assessments, but it still requires a specific Swiss gap assessment against the FADP rather than an assumption that GDPR compliance automatically satisfies Swiss requirements.

The penalties sit with individuals, not just the organisation

Unlike many data protection regimes, Swiss law places criminal liability for certain wilful violations on the responsible natural person rather than solely on the company. Reported maximum criminal fines run up to CHF 250,000, applied to individuals found responsible, which changes the internal conversation about accountability considerably compared with a purely corporate fine.

Switzerland’s broader AI strategy is still developing

While the FDPIC has been clear that existing law already provides meaningful coverage, the Federal Council has separately initiated a process to define a more specific regulatory approach to AI, positioned within the wider Swiss Digital Strategy 2025, which names artificial intelligence as one of its core focus areas alongside information security.

What organisations should be doing now

Waiting for a dedicated Swiss AI law before addressing data privacy and AI risk services Switzerland organisations need is not a defensible position given the FDPIC’s clear statement. Practical steps include applying the FADP’s existing requirements to every AI system that touches personal data, running data protection impact assessments on higher risk automated processing, and building the kind of internal culture and training around AI use that regulators consistently point to as a marker of genuine, rather than superficial, compliance.

Automated decision making deserves particular attention

Where an AI system makes or materially influences a decision affecting an individual, hiring screening, credit assessment, insurance pricing, the FADP’s requirements around transparency and individual rights become especially relevant. Individuals generally have a right to understand the basis for decisions that significantly affect them, and an organisation using an AI system for this kind of decision needs to be able to explain, in plain terms, how the system reaches its outputs, not simply point to the vendor’s own documentation.

Vendor AI tools carry the same obligations as internally built systems

A common gap organisations discover during a gap assessment is that AI risk has been considered for internally developed models but not for third party AI tools embedded in everyday software, a customer service chatbot, an HR screening tool, a document analysis feature bundled into existing software. The FADP does not distinguish between these categories. If personal data relating to individuals in Switzerland flows through a third party AI feature, the same obligations apply as if the organisation had built the system itself, which means vendor AI tools need to be captured in the same data inventory and impact assessment process as anything built in-house.

Practical starting points for a Swiss AI gap assessment

Organisations beginning this work typically start by cataloguing every system, internal or vendor supplied, that uses AI to process personal data, then working through which of those systems qualifies as high risk automated processing under the FADP’s criteria. From there, the practical work involves closing specific gaps: missing data protection impact assessments, unclear documentation of how a given system reaches its outputs, and gaps in the transparency information provided to the individuals whose data is being processed.