Ask a Swiss business owner what the "Swiss AI law" requires and the honest answer is that there isn't one, at least not in the form people expect. Switzerland has deliberately chosen a different route from the EU. That does not mean AI use is unregulated here. It means the rules sit in places many SMEs are not looking.

This article explains the Federal Council's approach, where the work stood at the end of October 2026, and what a small business should do in the meantime. It is general information, not legal advice.

The 2025 decision that set the direction

On 12 February 2025 the Federal Council decided that Switzerland would ratify the Council of Europe's convention on artificial intelligence and bring it into Swiss law. According to Swissinfo, the government said that any legal changes should be as sector-specific as possible, and that general rules cutting across all sectors would be limited to core areas tied to fundamental rights, such as data protection. Switzerland then signed the convention in March 2025, as the FDPIC has noted.

The stated aims were threefold: strengthen Switzerland as a place to innovate, protect fundamental rights, and build public trust in AI. In plain terms, Bern wants to avoid a heavy horizontal regime while still meeting its international commitments.

For an SME, the practical consequence is that there will be no single Swiss rulebook to read. The relevant rules will keep arriving through existing laws and sector regulators.

Where things stood at the end of October 2026

On 28 October 2026 the Federal Council took note of interim progress on implementing the convention. Several points matter for businesses:

  • Binding rules are still being drafted. The Federal Office of Justice is preparing legally binding measures covering transparency, data protection, non-discrimination, supervision and risk assessment. The consultation is now scheduled to begin in spring 2027. That is later than the original plan: in February 2025, Swissinfo reported that a consultation draft was due by the end of 2026.
  • Sector regulators are already active. An OFCOM report, based on a survey of all federal agencies, describes current and planned measures in transport, energy, health, media and other sectors.
  • Voluntary commitments are being encouraged. OFCOM has published a guide to help associations and companies write their own AI code of conduct. It offers suggested text on ten topics at three levels of detail, plus a process for reviewing and improving the code over time.
  • Industry dialogues are under way. The Federal Office of Energy has asked the electricity sector to develop guidelines and voluntary commitments, and the Federal Office of Culture has been running a dialogue with the creative sector since November 2025.

The OFCOM AI page lists both documents, dated 26 October 2026, in the national languages.

What already applies, whatever happens in 2027

The absence of an AI act does not leave a gap. The Federal Act on Data Protection, in force since September 2023, applies directly to AI-supported processing of personal data, the FDPIC has made clear. That brings concrete expectations: be transparent about the purpose, functioning and data sources of AI processing; let people know when they are talking to a machine; allow human review of automated individual decisions; and carry out an impact assessment where the risk is high.

On top of that come the rules of your own sector, whether that is health, finance, transport or something else, and, if you serve EU customers, the EU AI Act.

What this means for a 10 to 50 person business

The Swiss approach rewards firms that get their basics in order early, because the binding measures in the pipeline are built around the same themes as existing data protection law. A sensible programme for the coming year:

  1. Treat the FADP as your AI rulebook for now. Most of the obligations you will face in 2027 and beyond will build on transparency and data protection duties that already apply.
  2. Write a short internal AI code. The OFCOM guide is designed for exactly this. A two-page document covering approved tools, what data may be entered, who reviews outputs and how customers are informed is a solid start.
  3. Check what your industry association is doing. If your sector is drafting voluntary commitments, it is easier to help shape them than to adapt later.
  4. Keep a simple register of AI use. Tool, purpose, data involved, owner. This will make any future consultation outcome far easier to absorb.
  5. Diarise spring 2027. When the consultation opens, read the summary. Associations and businesses can respond.

A measured outlook

The Swiss model asks more of individual businesses than a prescriptive law would. There is no checklist from Bern that says "comply with these forty articles and you are done". Instead, you are expected to apply principles you already know from data protection, follow your sector's guidance and, increasingly, sign up to voluntary codes. For SMEs that already handle data carefully, the transition should be manageable. For those that have adopted AI tools informally, the next eighteen months are a good window to tidy up.

Want a clear picture of where AI already sits in your business? The free AI Readiness Audit maps your tools, data flows and quick wins.

Sources

  • Swissinfo, "Swiss government wants to adopt Council of Europe AI conventions", 12 February 2025. link
  • The Federal Council (admin.ch), "Federal Council takes note of interim progress on AI regulation", 28 October 2026. link
  • Federal Office of Communications (OFCOM), "Artificial intelligence", 28 October 2026. link
  • Federal Data Protection and Information Commissioner (FDPIC), "Update - Current data protection legislation is directly applicable to AI", 8 May 2025. link