"Is the data stored in Switzerland?" is usually the first question a Swiss business asks about an AI tool. It is a good question, but it is only the start. Over the past year, digital sovereignty has moved from a niche IT topic to a Federal Council agenda item, and the debate has shifted from where data sits to who can reach it.
This article sets out the main developments and turns them into a decision framework for SMEs. It is general information, not legal advice.
The legal starting points for cross-border data
Two decisions shape where Swiss businesses can send personal data with relatively little friction.
From the EU to Switzerland. In January 2024 the European Commission confirmed that Switzerland continues to offer an adequate level of data protection, so personal data can keep flowing from the EU and EEA to Switzerland without additional safeguards, as the FDPIC reported. For Swiss firms serving EU customers, that is a competitive asset worth protecting.
From Switzerland to the United States. In August 2024 the Federal Council recognised the Swiss-US Data Privacy Framework, with effect from 15 September 2024. Personal data can be sent to US companies certified under the framework without additional guarantees. The decision covers certified companies only, so the certification status of a US provider is a practical question to ask before you sign.
Why sovereignty is now on the federal agenda
In November 2025 the Federal Council adopted a report on Switzerland's digital sovereignty. It describes sovereignty as the state's ability to act in, and keep oversight of, the digital space so it can carry out its duties. The report points to existing measures such as open source software and a hybrid multi-cloud strategy, sets up an interdepartmental working group, and commits to examining technical and international-law tools to protect official data from access by other states.
The same month, privatim, the conference of Swiss data protection commissioners, published a resolution on international cloud services. It considers outsourcing sensitive personal data held by public bodies to international cloud providers impermissible in most cases, unless the public body encrypts the data itself and the provider has no access to the key. Its reasoning includes limited transparency from global providers, a significant loss of control, and the reach of the US CLOUD Act even where data sits in Swiss data centres. The canton of Fribourg's data protection authority summarised the position as acceptable only with complete, self-managed encryption.
Neither document binds a private SME. Both are useful signals, though. If you supply cantons, communes, hospitals or schools, expect these expectations to appear in tenders. And the emphasis on self-managed encryption tells you where regulators think the real risk sits.
What providers are offering
Large vendors have responded. In November 2025 Microsoft announced that in-country processing for Microsoft 365 Copilot interactions would expand to 15 countries, including Switzerland, by the end of 2026. Swiss providers and other international vendors are making similar claims about local hosting.
These offers are welcome, but read them carefully. "Data stored in Switzerland" and "AI processing in Switzerland" are different promises, and neither tells you who holds the encryption keys or which entity operates the service.
Residency versus control
A useful way to frame the decision is to separate three questions:
- Residency. In which country is the data stored, and in which country does the AI model actually process your prompts and documents?
- Access. Which companies, and therefore which legal systems, can technically or legally reach the data?
- Control. Who holds the keys, who can switch the service off, and how hard would it be to leave?
A Swiss data centre answers the first question. The privatim resolution is essentially about the second and third.
A practical framework for SMEs
You do not need sovereign infrastructure for everything. You need to match the tool to the data.
- Tier 1, public or low-sensitivity data. Marketing copy, published product information, internal drafts without personal data. Mainstream AI tools with sensible settings are usually fine.
- Tier 2, ordinary business and customer data. Contact details, orders, routine correspondence. Prefer business plans with no training on your inputs, a clear data processing agreement, and storage and processing in Switzerland or the EU, or with a certified US provider.
- Tier 3, sensitive or confidential data. Health, HR files, legal matters, anything under professional secrecy. Consider Swiss-hosted or self-hosted models, customer-managed keys, or keeping AI out of the workflow altogether.
Before signing with any AI provider, ask:
- Where is data stored, and where is it processed during inference?
- Which sub-processors are involved, and in which countries?
- Is the US entity certified under the Swiss-US Data Privacy Framework, if relevant?
- Are prompts and files used to train or improve models, and can that be disabled?
- Who manages the encryption keys?
- How do we export our data and leave?
The bottom line
Data residency is a sensible default for Swiss SMEs, and it is becoming easier to get. But the questions regulators now ask are about access and control. Classify your data first, then choose tools that fit each tier, and you will be well placed whatever the next round of sovereignty decisions brings.
Want to know which of your workflows can safely use which tools? The free AI Readiness Audit maps your data and recommends a fitting setup.
Sources
- Federal Data Protection and Information Commissioner (FDPIC), "EU adequacy decision regarding Switzerland", 15 January 2024. link
- The Federal Council (admin.ch), "Swiss-US Data Privacy Framework: Certified US companies offer adequate protection for personal data", 14 August 2024. link
- The Federal Council (admin.ch), "Federal Council adopts report on Switzerland's digital sovereignty", 26 November 2025. link
- privatim, homepage item on the resolution on international cloud solutions, 24 November 2025. link
- Canton of Fribourg, Authority for Transparency, Data Protection and Mediation, "privatim verabschiedet eine Resolution zur Auslagerung von besonders schützenswerten Personendaten in die Cloud", 24 November 2025. link
- Microsoft, "Microsoft Expands Digital Sovereignty Capabilities", 5 November 2025. link