A common assumption in Swiss SMEs is that AI is a regulatory blank space until Bern passes something specific. The Federal Data Protection and Information Commissioner (FDPIC) has said the opposite, more than once. The revised Federal Act on Data Protection (FADP), in force since 1 September 2023, applies directly to AI-supported processing of personal data, as the FDPIC confirmed in May 2025. In practice, the same principles that govern your CRM also govern the AI tool that reads it.

This article summarises what that means in practice. It is general information, not legal advice.

What the FDPIC expects from businesses using AI

The FDPIC's guidance on AI and data protection sets out a fairly clear set of expectations:

  • Transparency. Be open about the purpose, the functioning and the data sources of AI-based processing.
  • Chatbots. People have a right to know whether they are communicating with a machine, and whether what they type is used to improve self-learning systems or for other purposes.
  • Automated decisions. People can object to automated processing and ask for a human to review automated individual decisions.
  • High-risk processing. Permitted in principle, with appropriate safeguards, and a data protection impact assessment is required in high-risk cases.
  • Synthetic media. Content that manipulates the face, image or voice of an identifiable person must be clearly labelled.
  • Red lines. Applications that undermine privacy and informational self-determination are prohibited, with real-time facial recognition and social scoring given as examples.

The SME portal of the Confederation adds the general FADP duties that sit underneath all of this: privacy by design and by default, prompt notification of data security breaches to the FDPIC, and a register of processing activities, with exemptions for SMEs whose processing poses limited risk. It also notes that biometric data is now classed as sensitive.

Two 2026 rulings worth knowing

Guidance is one thing. Two recent decisions of the Federal Administrative Court show how these principles play out when a case is contested.

Voice recognition needs explicit consent. PostFinance used voiceprints to authenticate customers by phone. The FDPIC ordered it to obtain express consent and delete voiceprints held without it. In judgments dated 13 October 2026, the court upheld that position: voiceprints are personal data requiring special protection, and a customer simply continuing to speak after being told about the recording does not count as express consent. Any SME considering voice bots or biometric login should note that standard.

Fixing a breach does not cancel the duty to tell people. An online shop operator argued it did not need to notify customers after a data breach. The court rejected the appeal in April 2026, holding that technical remediation afterwards does not change the obligation, and allowed notice by public announcement because the firm could no longer identify those affected.

Neither case is about a large language model. Both are about the kind of decisions SMEs make when they automate customer contact or handle an incident.

The everyday risk is what staff type into tools

Breaches are rising. The FDPIC recorded 455 data security incidents in 2026 by late October, against 343 in the whole of 2025, Swissinfo reported. The same report notes that, in most reported attacks, the weak point was human error rather than the technology.

That is directly relevant to generative AI. In a joint Cyber Security Month campaign with the National Cyber Security Centre, the FDPIC warned that when personal data goes into an AI tool, "there is a risk of disclosing far more information than one realises". In a business, that data usually belongs to customers, patients or employees.

A practical checklist for SMEs

You do not need a compliance department to get this right. You need a few deliberate decisions, written down:

  1. List the AI tools in use. Include the ones staff adopted on their own. Note what personal data each one sees.
  2. Check the vendor terms. Does the provider use your inputs to train its models? Can that be switched off? Where is the data processed?
  3. Update your privacy notice. Explain where AI is used, for what purpose, and how people can ask for a human.
  4. Keep a human in the loop for decisions about people. Credit limits, job applications, complaints. Make sure a person can review and override.
  5. Assess before you deploy anything high-risk. If an AI use touches sensitive data or makes consequential decisions, run a data protection impact assessment first.
  6. Get explicit consent for biometrics. Voice, face or fingerprint features need a clear opt-in, not an implied one.
  7. Give staff a one-page rule. Which tools are approved, what may never be pasted in, and who to ask.
  8. Rehearse a breach. Know who decides on notifying the FDPIC and customers, and how quickly.

The bottom line

The FADP is not a barrier to using AI. It is a framework that asks you to know what data you process, tell people honestly, and keep a person accountable. Firms that do that for their AI tools today will find any future Swiss AI rules much easier to absorb.

Unsure what personal data your AI tools can see? The free AI Readiness Audit maps your tools and data flows before you scale.

Sources

  • Federal Data Protection and Information Commissioner (FDPIC), "Update - Current data protection legislation is directly applicable to AI", 8 May 2025. link
  • FDPIC, "AI and data protection", 24 September 2025. link
  • SME portal of the Swiss Confederation (kmu.admin.ch), "New Federal Act on Data Protection (nFADP)", accessed 7 November 2026. link
  • FDPIC, "Authentication by means of voice recognition: Federal Administrative Court upholds the FDPIC's position on obtaining explicit consent", 21 October 2026. link
  • FDPIC, "Data Breach: Federal Administrative Court Confirms Duty of Online Shop Operators to Inform Affected Individuals", 6 November 2026. link
  • Swissinfo (Keystone-SDA), "Data security breaches rise in 2026", 25 October 2026. link
  • FDPIC, "Cyber Security Month: Generative AI in the workplace: Data Protection Challenges – Joint Campaign by FDPIC and NCSC", 16 October 2026. link