AI and employee data in Switzerland, what employers can and cannot do

AI has arrived in HR quietly. It drafts job adverts, summarises interviews, transcribes meetings and, in some software suites, offers dashboards on how staff spend their time. Each of these touches employee data, and Switzerland has long-standing rules on what employers may do with it. Some AI features sit comfortably within those rules. Others sit squarely outside them, often switched on by default.

This article explains the Swiss framework, the EU dimension for firms with staff across the border, and the practical steps that keep an SME on the right side. It is general information, not legal advice.

The Swiss legal frame

The FDPIC's guidance on monitoring systems in the workplace brings the relevant rules together. Article 328 of the Code of Obligations and Article 26 of Ordinance 3 to the Employment Act protect employees' personality rights. Article 328b of the Code of Obligations allows employers to handle employee data only where it concerns suitability for the job or is needed to perform the employment contract. The FADP applies on top whenever monitoring involves personal data.

The core prohibition is this: systems whose sole or main purpose is to monitor how employees actually behave are not allowed. The FDPIC's examples of prohibited systems are specific, and several of them describe AI features on the market today:

• AI evaluation of vision, movement, speech, communication patterns or psychological results.
• Spyware, activity trackers and logs of apps or websites used.
• Email content scanners, and keyboard or mouse logging, including during telework.

By contrast, the FDPIC lists examples that can be acceptable for performance or security reasons, such as access badges, recording entry and exit times, quality control of output, or counting calls in a call centre. Even then, employees must be informed in advance, the least intrusive option should be chosen, and consent should not be extracted under pressure.

Where AI features cause trouble

The risk for SMEs is rarely a deliberate decision to spy on staff. It is a productivity or wellbeing feature inside an office suite that analyses activity patterns. Swissinfo reported that tools such as Microsoft Teams can analyse staff activity and even estimate burnout risk, and that such features are often active in software used in Switzerland despite the legal limits on monitoring.

The same report highlights a gap in Swiss practice. According to Isabelle Wildhaber, a labour law professor at the University of St. Gallen, Swiss employers have no general obligation to consult staff on new technology that does not directly affect health and safety, and staff are usually not consulted when AI is introduced. Her advice to employers was blunt: "It is never a good idea not to involve employees."

The other direction: what staff put into AI

Employee data protection is not only about what the company does to staff. It is also about what staff do with colleagues' and customers' data. In a KPMG survey reported by Swissinfo in April 2025, 77% of Swiss workers said they used AI at work, and around half of respondents admitted to using it in ways that broke company rules, such as uploading sensitive company data to free public tools. Fewer than half said they had completed any AI training.

The FDPIC and the National Cyber Security Centre made this the focus of their October 2026 Cyber Security Month campaign, noting that data entered into AI tools at work often concerns third parties such as customers, patients and employees.

If you employ people in the EU

Swiss SMEs with staff or applicants in neighbouring countries should also look at the EU AI Act. The European Commission lists emotion recognition in the workplace among the prohibited practices, which have applied since February 2025. It also classifies AI used for employment and the management of workers, such as CV-sorting software, as high-risk, with those obligations now applying from 2 December 2027.

There is also a difference on automated decisions. Swissinfo noted that the GDPR generally bars fully automated decisions of this kind, while Swiss law permits them if the person is informed. Under Swiss law, the FDPIC adds that people can ask for a human to review an automated individual decision.

A checklist for employers

1. Audit the features, not just the tools. Check analytics, "insights" and wellbeing modules in your office, communication and HR software. Switch off anything that profiles individual behaviour.
2. Keep AI in HR to assistance. Drafting adverts or summarising applications is very different from ranking or rejecting candidates automatically. Keep a person accountable for every decision about a person.
3. Tell staff before, not after. Write down which AI tools process employee data, for what purpose, and who can see the results.
4. Involve employees early. Even without a legal duty to consult, a short briefing and a chance to raise concerns avoids most of the friction.
5. Publish a one-page AI use rule. Approved tools, what must never be pasted in, and who to ask.
6. Offer basic training. Even a short session on safe use speaks directly to the behaviours the KPMG figures describe.
7. Plan for 2027 if you hire in the EU. If any recruitment tool scores or filters candidates, find out now what its provider is doing about the high-risk rules.

The bottom line

Swiss law gives employers room to use AI for genuine business purposes, and draws a firm line at monitoring behaviour. Most problems come from features nobody consciously chose and from tools staff adopted on their own. A short audit, a clear rule and an honest conversation with the team resolve the majority of them.

Want to see where AI touches employee data in your business? The free AI Readiness Audit maps your tools and flags what needs attention.

Sources

• Federal Data Protection and Information Commissioner (FDPIC), "Monitoring systems in the workplace", accessed 7 November 2026. link
• Swissinfo, "Swiss employees less protected from AI risks than in the EU", 10 August 2024. link
• Swissinfo (Keystone-SDA), "AI employed by 77% of Swiss workers, often breaking company rules", 30 April 2025. link
• FDPIC, "Cyber Security Month: Generative AI in the workplace: Data Protection Challenges – Joint Campaign by FDPIC and NCSC", 16 October 2026. link
• European Commission, "AI Act" (regulatory framework page), last updated 19 October 2026. link
• FDPIC, "AI and data protection", 24 September 2025. link