Buying an AI tool used to feel like buying any other software subscription: compare features, check the price, sign up. The difference is that most AI tools work by receiving your data, processing it somewhere else, and sometimes passing it to further providers along the way. For a small business, the questions you ask before signing are often the most effective security control you have.
Why "trusted brand" is not an answer
Swisscom's 2026 threat report, covered by Swissinfo, made a point that applies well beyond large enterprises. Companies increasingly depend on cloud platforms, external code and AI models, and organisations that do not know where their data is processed or which legal frameworks apply to their providers risk losing control. Swisscom's conclusion was that trust in providers alone is no longer sufficient.
A concrete example: in November 2025, OpenAI confirmed that a breach at Mixpanel, a third-party analytics provider it used, had exposed names, email addresses and user identifiers linked to some of its API platform users, according to Euronews. OpenAI said its own systems were not breached and that no conversations, passwords or API keys were exposed. It ended its use of Mixpanel and warned users to watch for phishing. The lesson for an SME is not about one vendor. It is that your exposure includes your vendor's vendors.
ENISA's 2025 threat landscape makes the broader point: the EU cybersecurity agency describes AI both as a tool for attackers and as a new point of exposure, and reports that attacks on the AI supply chain are rising.
The Swiss data protection angle
Two pieces of the Swiss framework are worth knowing before you talk to a vendor.
First, the FDPIC has confirmed that the Data Protection Act applies directly to AI-supported processing. It expects transparency about the purpose, functionality and data sources of AI processing, and says users have a right to know whether the data they enter is used to improve self-learning systems. You cannot give your own customers that transparency if your vendor will not give it to you.
Second, many AI tools are hosted in the United States. Since 15 September 2024, Switzerland has recognised certified US companies under the Swiss-US Data Privacy Framework as offering adequate protection. The key word is certified: the recognition applies to companies in the framework, not to US providers in general. Whether a particular vendor is certified, and what applies if it is not, is a question worth putting in writing and, where the data is sensitive, checking with a lawyer.
Twelve questions to ask
Send these before you sign, and keep the answers on file. A good vendor will answer most of them from existing documentation.
Data use
- Is our input or output data used to train or improve your models? Is that off by default on our plan, and can we confirm it contractually?
- How long do you retain prompts, files and outputs, and can we delete them on request?
- Where is data processed and stored? Is Swiss or EU hosting available, and for which parts of the service?
Who else is involved
- Which sub-processors handle our data, including model providers and analytics tools? How will we be notified of changes?
- If you transfer data to the United States, are you, and your relevant sub-processors, certified under the Swiss-US Data Privacy Framework?
Security and access
- Do you support single sign-on and multi-factor authentication for our users?
- Can we restrict which integrations and permissions the tool uses, for example read-only access to email or CRM?
- What logs are available to us: who used the tool, which data it accessed, which actions it took?
When things go wrong
- How and how quickly will you inform us of a security incident affecting our data?
- What is your approach to prompt injection and other AI-specific risks? The UK NCSC advises caution with any vendor that claims to fully stop prompt injection, and to prefer those who explain how they reduce it.
Exit
- Can we export our data and configuration in a usable format if we leave?
- What happens to our data, including backups, after the contract ends?
Reading the answers
You are not looking for perfect answers. You are looking for clear ones. A vendor that can tell you exactly where data goes, who else touches it and what you can switch off is usually one that has thought about the rest. Vague answers about "industry-standard security", or reluctance to name sub-processors, are worth more weight than any single feature.
It also helps to match scrutiny to risk. A tool that rewrites marketing copy from public information needs a light check. A tool that reads client files, handles HR data or connects to your finance system deserves the full list, a look at the contract terms, and a short note in your records explaining why you chose it.
Keep a simple register
For each AI tool in use, record its purpose, the data it touches, where that data is processed, who approved it and when it was last reviewed. A spreadsheet is enough. It makes the annual review quick, gives you an answer if a customer asks, and is the first thing you will want if a vendor reports an incident.
Evaluating AI tools for a specific workflow? The free AI Readiness Audit includes a review of the data flows and vendor questions that matter for your case.
Sources
- Swissinfo (Keystone-SDA), "Telecoms firm warns of sharp rise in cyber threats in Switzerland", 27 April 2026. link
- Euronews, "OpenAI confirms ChatGPT data breach. Here is everything we know", 27 November 2025. link
- ENISA, "EU consistently targeted by diverse yet convergent threat groups", 1 October 2025. link
- Federal Data Protection and Information Commissioner (FDPIC), "Update - Current data protection legislation is directly applicable to AI", 8 May 2025. link
- Swiss Federal Council, "Swiss-US Data Privacy Framework: Certified US companies offer adequate protection for personal data", 14 August 2024. link
- UK National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)", 8 December 2025. link