AI under Swiss Law and the GDPR: Key Differences

The legal framework

Switzerland has no AI act. AI services that process personal data fall under the revised Federal Act on Data Protection (FADP, in German DSG), in force since 1 September 2023. The Swiss regulator, the FDPIC (EDÖB), said so in plain words: current data protection legislation is directly applicable to AI, a position it confirmed in May 2025. If you also serve people in the EU, the GDPR applies alongside it, and often the EU AI Act too.

Scope

• FADP: protects personal data of natural persons only (Articles 2 and 5). It applies to circumstances that have an effect in Switzerland, even if they started abroad (Article 3).
• GDPR: reaches companies outside the EU when they offer goods or services to people in the EU or monitor their behaviour there (Article 3(2)).

A Swiss AI start-up with EU customers will usually face both.

Legal bases

This is the biggest difference. The GDPR allows processing only on one of the bases in Article 6. The FADP has no such list for private companies: processing must respect the principles (Article 6 FADP), and a justification (consent, an overriding private or public interest, or the law) is only needed when processing breaches personality rights (Articles 30 and 31). That is the case, for instance, when you depart from the principles or process data against someone's express wishes.

Transparency and automated decisions

Both laws require you to inform people when you collect their data (Article 19 FADP, Articles 13 and 14 GDPR). For decisions based exclusively on automated processing with legal or considerable adverse effects, the FADP requires you to inform the person and, on request, let them state their view and have a human review the decision (Article 21). The GDPR goes further: a right not to be subject to such decisions, with exceptions (Article 22). The FDPIC adds that users have a right to know whether they are talking to a machine.

Impact assessments and design

Both require a data protection impact assessment where processing is likely to result in a high risk, in particular with new technologies (Article 22 FADP, Article 35 GDPR), and prior consultation of the regulator if a high risk remains (Article 23 FADP, Article 36 GDPR). Both require privacy by design and by default (Article 7 FADP, Article 25 GDPR).

Transfers, both ways

The European Commission recognised Switzerland as adequate in Decision 2000/518/EC and confirmed this in January 2024. In the other direction, Article 16 FADP allows disclosure abroad to states the Federal Council has found adequate. Annex 1 of the Data Protection Ordinance lists every EU and EEA state and, since 15 September 2024, US organisations certified under the Swiss-US Privacy Framework. More on transfers in international data transfers.

Sanctions

Here the systems differ completely. GDPR fines are imposed on companies by supervisory authorities, up to EUR 20 million or 4% of worldwide turnover (Article 83). FADP fines, up to CHF 250,000, target the responsible individuals, only for wilful breaches (Articles 60 to 63), some only on complaint. A company can be fined, up to CHF 50,000, only when tracing the responsible person would be disproportionate (Article 64). The FDPIC investigates (Article 49) and can order processing to be changed or stopped and data deleted (Article 51), but it has no power to fine. The cantons prosecute and fine; the FDPIC can report offences and act as a private claimant (Article 65).

The EU AI Act

The AI Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers in third countries when the output is used in the EU (Article 2(1)). Providers of high-risk systems outside the EU must appoint an authorised representative in the Union (Article 22). After the Digital Omnibus on AI, the high-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I); see the AI Act timeline.

Switzerland itself chose a different route: on 12 February 2025 the Federal Council decided to ratify the Council of Europe AI Convention and to adapt Swiss law sector by sector. A consultation draft is planned for spring 2027.

In practice

A Zurich company offers an AI recruitment-screening tool to employers in Switzerland and Belgium. For Swiss candidates it applies the FADP: it informs candidates, carries out a DPIA because screening candidates is likely to carry a high risk, and tells them when a rejection is fully automated so they can ask for human review. For Belgian candidates the GDPR also applies, so it needs a legal basis under Article 6 and must respect the Article 22 limits. AI that filters applications and evaluates candidates is high-risk under Annex III, point 4(a) of the AI Act, so the company appoints an EU representative and prepares for 2 December 2027.

A Geneva retailer uses a customer chatbot built on a US model. Following the FDPIC's position, it tells customers they are talking to a machine, checks that the US provider is certified under the Swiss-US Privacy Framework, and documents the processing in its records.

Frequently asked questions

Does a Swiss company need a GDPR representative?

Yes, if Article 3(2) GDPR applies to it, unless an exception in Article 27(2) applies. The FADP has a mirror rule for foreign companies (Article 14), but only for large-scale, regular, high-risk processing.

Is the FADP stricter or looser than the GDPR?

It depends on the point. It is lighter on legal bases and on fines for companies. But it is tougher in one way that matters to managers: the fine can hit them personally.

Do we have to report a data breach within 72 hours in Switzerland?

No fixed deadline: the FADP says "as quickly as possible", and only where a high risk is likely (Article 24). Under the GDPR the 72-hour rule applies (Article 33).

Does the AI Act apply to purely Swiss operations?

No. It applies when you place AI on the EU market or when the output is used in the EU.

How this connects

Combining both laws starts with one DPIA and one record of processing that cover Swiss and EU rules. Our AI Act compliance work maps your systems against the AI Act, and an external DPO can keep both regimes in view. See also AI Act meets GDPR.