AI and data protection go hand in hand as soon as an AI tool works with personal data. And that happens faster than many people think: a customer enquiry in the chat window, a CV to be summarised, the minutes of a conversation to be analysed. Just like that, a machine is processing information about people.
Switzerland has no dedicated AI law. Yet this is no legal vacuum: since 1 September 2023, the Swiss Federal Act on Data Protection (FADP) has applied to AI as well. According to the Federal Statistical Office, more than two in five people were already creating texts or images with AI in 2025.
Our article on data-sovereign AI shows where data is located. This one covers the obligations: we show what Swiss law requires for AI and data protection and how to recognise a privacy-friendly solution.
Key facts at a glance
- Switzerland has no dedicated AI law, but since 1 September 2023 AI and data protection have been governed by the technology-neutral FADP.
- Anyone processing personal data with AI must inform data subjects transparently – according to the Federal Data Protection and Information Commissioner (FDPIC), also about whether they are communicating with a machine.
- Automated individual decisions must be disclosed; data subjects can request that a human reviews them.
- Where the risk is high, the FADP requires a data protection impact assessment beforehand.
- If the AI runs abroad, separate rules apply to disclosing personal data.
Does the FADP apply to AI? What the FDPIC says about AI and data protection
The short answer: yes. As early as 2023, the FDPIC made it clear that the FADP, being technology-neutral in its wording, applies directly to AI-supported data processing. This was reaffirmed in an updated statement of 8 May 2025.
It is not the AI that counts, but the personal data
On Data Protection Day 2026, the FDPIC stressed that AI as such is not subject to the FADP. As soon as personal data is processed, however, the Act applies directly. This covers any information relating to an identified or identifiable natural person – even a name in a prompt may be enough.
According to the FDPIC, manufacturers, providers and users of AI systems must make the purpose, functionality and data sources transparent – including companies that merely use AI.
Transparency: knowing that you are talking to AI
The FDPIC is particularly clear when it comes to language models: anyone writing or speaking to a chatbot has a legal right to know whether a machine is answering. Users are likewise entitled to know whether their input is processed further to improve the programs or for other purposes.
For your company, this means that an AI assistant on your website should identify itself as such, and your privacy policy should say what happens to the input. In short: no machine in human disguise.
AI as a focus of the new annual report
How seriously the FDPIC takes the issue is shown by the 33rd Annual Report of 30 June 2026, in which AI is a focus topic in its own right. In it, the FDPIC recalls the duty of transparency and the data protection impact assessment for high-risk processing.
One assessment concerning the Federal Administration, which is preparing its own AI assistance systems, stands out: according to the report, the Confederation’s own systems ensure that prompts and the data they contain are stored internally. With commercial language models, by contrast, data is stored at least temporarily on the provider’s cloud infrastructure, the report says – and that poses a risk to data security.
Five FADP obligations when using AI
You should know these five articles before data from your customers or your team flows into an AI system.
1. Inform when collecting data (Art. 19)
You must inform data subjects appropriately when you collect their data. As a minimum, you state your identity and contact details, the purpose and, if applicable, the recipients, which may include an external AI provider. If data is disclosed abroad, you also name the destination country.
2. Disclose automated decisions (Art. 21)
If a system decides on its own and the decision has a legal consequence or a considerable adverse effect, it is an automated individual decision. An AI that rejects job applications without human review, for example, may fall into this category. You then inform the data subject, who can request a review by a human. Neither applies where, for instance, the person has explicitly consented.
3. Assess risks in advance (Art. 22)
If processing is likely to result in a high risk to personality or fundamental rights, you carry out a data protection impact assessment beforehand. As indicators, the Act cites new technologies and the large-scale processing of sensitive personal data such as health data. The assessment describes the processing, evaluates the risks and sets out protective measures.
4. Choose providers carefully (Art. 9)
An AI service provider usually processes personal data as a processor. This is permitted if it processes the data only as you yourself would be permitted to, and no duty of confidentiality prohibits it. You must also satisfy yourself that the provider is able to guarantee data security.
So check the contract: may the provider use your input for its own purposes, for example for training? The FADP ties personal data to a specific purpose that the data subject can recognise (Art. 6).
5. Clarify the route abroad (Art. 16)
If the AI runs outside Switzerland, personal data is disclosed abroad. This is permitted if the Federal Council has decided that the destination country guarantees an adequate level of protection, as the list in the Data Protection Ordinance does for Germany, France or Italy, for example.
The United States has been on the list since 15 September 2024, but only for organisations certified under the Swiss-US Privacy Framework (commonly known as the Swiss-U.S. Data Privacy Framework). Otherwise, appropriate guarantees are needed, such as standard data protection clauses recognised by the FDPIC.
AI and data protection in practice: a checklist
Before you introduce an AI tool, a quick check pays off. You should ask your provider these questions – and yourself:
- Where are inputs, documents, logs and backup copies processed and stored?
- Is your content used to train or improve models?
- Is there a data processing agreement, and who are the sub-processors?
- Which technical and organisational measures protect the data, such as roles and access rights?
- Can you delete data and respond to requests for information?
Also decide internally which data belongs in AI tools at all. A clear AI strategy answers this question once for everyone, instead of anew in every team. That is how AI and data protection become routine.
AI and data protection: not a brake, but a blueprint
AI and data protection are not opponents. The FADP requires data protection from the planning stage (Art. 7). If you factor in the obligations early, you build AI applications that customers and teams trust.
At BE BRAVE, we therefore rely on Swiss infrastructure. All BE BRAVE offerings are operated on our own servers in Switzerland. Customer data, processing, logs and backups remain in Switzerland and are never used to train AI models.
EagleCHAT was built for high Swiss and European data protection requirements. Swiss data residency, our own infrastructure and an ISMS certified to ISO/IEC 27001:2022 support companies in using it in a privacy-compliant way. The controller’s obligations remain with your company; find out more under Data Sovereignty & Security.
This article is for general information only and does not constitute legal advice.
FAQ
Is there a law on AI and data protection in Switzerland?
There is no dedicated AI law. AI and data protection are governed by the FADP, which has been in force since 1 September 2023 and applies directly to AI-supported data processing.
Does a company have to disclose that its chatbot is an AI?
In the FDPIC’s view, yes. Anyone communicating with a language model has a right to know whether a machine is answering and whether their input is used further.
When does AI require a data protection impact assessment?
In principle, whenever processing is likely to result in a high risk to the personality or fundamental rights of the data subjects – and before it starts.
May personal data be passed to an AI tool from a foreign provider?
Only if disclosure abroad is permitted under Art. 16 or 17 FADP and you inform the data subjects. With international providers, the place of processing, the applicable law and the use of the content entered depend on the respective contractual terms.
What are the penalties for breaching the FADP when using AI?
For wilful breaches of the duty to provide information under Art. 19 or 21, private persons face, on complaint, a fine not exceeding 250,000 francs (Art. 60). The same applies, for example, to wilfully disclosing personal data abroad in breach of the rules (Art. 61). Fines are imposed primarily on the responsible natural persons, and only exceptionally on companies (Art. 64).
