--- title: "AI under Swiss Law and the GDPR: Key Differences | Pitch" description: "What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the…" url: https://www.pitch.law/academy/ai-under-swiss-fadp-and-gdpr --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # AI under Swiss Law and the GDPR: Key Differences What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the EU AI Act. - - By Bart Lieben, Attorney-at-Law - 30 October 2026 - Updated 30-10-2026 ## The legal framework Switzerland has no AI act. AI services that process personal data fall under the revised [Federal Act on Data Protection](https://www.fedlex.admin.ch/eli/cc/2022/491/en) (FADP, in German DSG), in force since 1 September 2023. The Swiss regulator, the FDPIC (EDÖB), said so in plain words: current data protection legislation is [directly applicable to AI](https://www.edoeb.admin.ch/en/09112023-current-data-protection-legislation-is-directly-applicable-to-ai), a position it [confirmed in May 2025](https://www.edoeb.admin.ch/en/update-current-legislation-directly-applicable-ai). If you also serve people in the EU, the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) applies alongside it, and often the [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) too. ### Scope - **FADP:** protects personal data of natural persons only (Articles 2 and 5). It applies to circumstances that have an effect in Switzerland, even if they started abroad (Article 3). - **GDPR:** reaches companies outside the EU when they offer goods or services to people in the EU or monitor their behaviour there (Article 3(2)). A Swiss AI start-up with EU customers will usually face both. ### Legal bases This is the biggest difference. The GDPR allows processing only on one of the bases in Article 6. The FADP has no such list for private companies: processing must respect the principles (Article 6 FADP), and a justification (consent, an overriding private or public interest, or the law) is only needed when processing breaches personality rights (Articles 30 and 31). That is the case, for instance, when you depart from the principles or process data against someone's express wishes. ### Transparency and automated decisions Both laws require you to inform people when you collect their data (Article 19 FADP, Articles 13 and 14 GDPR). For decisions based exclusively on automated processing with legal or considerable adverse effects, the FADP requires you to inform the person and, on request, let them state their view and have a human review the decision (Article 21). The GDPR goes further: a right not to be subject to such decisions, with exceptions (Article 22). The FDPIC adds that users have a right to know whether they are talking to a machine. ### Impact assessments and design Both require a data protection impact assessment where processing is likely to result in a high risk, in particular with new technologies (Article 22 FADP, Article 35 GDPR), and prior consultation of the regulator if a high risk remains (Article 23 FADP, Article 36 GDPR). Both require privacy by design and by default (Article 7 FADP, Article 25 GDPR). ### Transfers, both ways The European Commission recognised Switzerland as adequate in [Decision 2000/518/EC](https://eur-lex.europa.eu/eli/dec/2000/518/oj) and [confirmed this in January 2024](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024DC0007). In the other direction, Article 16 FADP allows disclosure abroad to states the Federal Council has found adequate. Annex 1 of the [Data Protection Ordinance](https://www.fedlex.admin.ch/eli/cc/2022/568/en) lists every EU and EEA state and, since 15 September 2024, US organisations certified under the Swiss-US Privacy Framework. More on transfers in [international data transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii). ### Sanctions Here the systems differ completely. GDPR fines are imposed on companies by supervisory authorities, up to EUR 20 million or 4% of worldwide turnover (Article 83). FADP fines, up to CHF 250,000, target the responsible individuals, only for wilful breaches (Articles 60 to 63), some only on complaint. A company can be fined, up to CHF 50,000, only when tracing the responsible person would be disproportionate (Article 64). The FDPIC investigates (Article 49) and can order processing to be changed or stopped and data deleted (Article 51), but it [has no power to fine](https://www.edoeb.admin.ch/en/new-fdpics-role). The cantons prosecute and fine; the FDPIC can report offences and act as a private claimant ([Article 65](https://www.fedlex.admin.ch/eli/cc/2022/491/en#art_65)). ### The EU AI Act The AI Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers in third countries when the output is used in the EU (Article 2(1)). Providers of high-risk systems outside the EU must appoint an authorised representative in the Union (Article 22). After the [Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj), the high-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I); see the [AI Act timeline](https://www.pitch.law/academy/ai-act-compliance-timeline). Switzerland itself chose a different route: on [12 February 2025](https://www.admin.ch/en/nsb?id=104110) the Federal Council decided to ratify the Council of Europe AI Convention and to adapt Swiss law sector by sector. A consultation draft is [planned for spring 2027](https://www.bakom.admin.ch/en/artificial-intelligence). ## In practice A Zurich company offers an AI recruitment-screening tool to employers in Switzerland and Belgium. For Swiss candidates it applies the FADP: it informs candidates, carries out a DPIA because screening candidates is likely to carry a high risk, and tells them when a rejection is fully automated so they can ask for human review. For Belgian candidates the GDPR also applies, so it needs a legal basis under Article 6 and must respect the Article 22 limits. AI that filters applications and evaluates candidates is high-risk under [Annex III, point 4(a)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) of the AI Act, so the company appoints an EU representative and prepares for 2 December 2027. A Geneva retailer uses a customer chatbot built on a US model. Following the FDPIC's position, it tells customers they are talking to a machine, checks that the US provider is certified under the Swiss-US Privacy Framework, and documents the processing in its records. ## Frequently asked questions ### Does a Swiss company need a GDPR representative? Yes, if Article 3(2) GDPR applies to it, unless an exception in Article 27(2) applies. The FADP has a mirror rule for foreign companies (Article 14), but only for large-scale, regular, high-risk processing. ### Is the FADP stricter or looser than the GDPR? It depends on the point. It is lighter on legal bases and on fines for companies. But it is tougher in one way that matters to managers: the fine can hit them personally. ### Do we have to report a data breach within 72 hours in Switzerland? No fixed deadline: the FADP says "as quickly as possible", and only where a high risk is likely (Article 24). Under the GDPR the 72-hour rule applies (Article 33). ### Does the AI Act apply to purely Swiss operations? No. It applies when you place AI on the EU market or when the output is used in the EU. ## How this connects Combining both laws starts with one [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) and one [record of processing](https://www.pitch.law/technologies/privacy-register) that cover Swiss and EU rules. Our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) work maps your systems against the AI Act, and an external [DPO](https://www.pitch.law/solutions/dpo-as-a-service) can keep both regimes in view. See also [AI Act meets GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ## In short - When the FADP, the GDPR or both apply to your AI service - Legal bases, DPIAs and automated decisions compared - Data flows between Switzerland and the EU - Fines on individuals versus fines on companies - What the EU AI Act asks of Swiss providers ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [Data Protection Officer as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) ## Technology we use - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [Data Protection Impact Assessment](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) ## More in Privacy & Data Protection - ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - ### [GDPR Breach Notification: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [Article 33 GDPR: notify the authority within 72 hours of becoming aware of a personal data breach. When to notify, how hours count, when to tell people.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [GDPR Data Retention: How Long to Keep Personal Data](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The GDPR sets no fixed retention period: Article 5(1)(e) allows no longer than necessary. How to set retention periods, handle backups and delete data.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [How to Answer a DSAR Within the GDPR Deadline](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [Answer a data subject access request within one month, extendable by two (Articles 12 and 15 GDPR): what to send, what you may refuse, how to keep time.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)