Cybersecurity 2026

SWITZERLAND Trends and Developments Contributed by: David Vasella, Jürg Schneider, Hugh Reeves and Yannick Caballero Cuevas, Walder Wyss Ltd

The AI Act is initially applicable in the EU. However, it will be incorporated into EEA law and will then also apply to Norway, Iceland and Liechtenstein. The AI Act is currently at the EEA review stage; it will only be formally incorporated into EEA law after a decision by the Draft Joint Committee. Moreover, a Swiss company may therefore be subject to the AI Act if it sells an AIS to or in the EU (as a provider, importer or distributor); sells another product in the EU that uses an AIS as a component; or generates output that is used in the EU. Unlike the GDPR, the AI Act itself does not contain any provisions for fines, but in Article 99 it requires mem - ber states to introduce provisions for fines, as well as other enforcement measures. Fines can be imposed on all actors – ie, on all entities involved in the value chain. Depending on the type of violation, the fines can reach up to EUR35 million or 7% of the turnover. In Switzerland, however, there is currently no over - arching regulation on the use of AI (see 6.2 Cyberse- curity and AI in the Swiss Law and Practice chapter in this Guide). At the end of 2023, the Swiss Federal Council commissioned the Federal Department of the Environment, Transport, Energy and Communications (DETEC) to explore possible approaches for regulation within the framework of the Interdepartmental Coordi - nation Group on EU Digital Policy, by the end of 2024, and a report was published on 11 February 2025. As a result, AI is currently governed in Switzerland by general laws, depending on the legal object affected by the use of AI, such as: • the data protection law (if personal data is pro - cessed during training or use); • the secrecy protection law (if secret information is used for training or as an input); • the employment contract law (if the personal data of applicants and employees is processed and if AI affects the employer’s duty of care); • public labour law (eg, when duties to co-operate take effect or when monitoring behaviour is dis - cussed); • personal rights (eg, when conversations or team calls are recorded); • unfair competition law (when AI-generated content can be misleading);

• copyright law (eg, when AI is trained with works or uses works as input, and when the protection of output is under discussion); • criminal law (when recording non-public conversa - tions or when using AI for punishable behaviour in general); • product liability and other liability laws; and • other areas of law. Private actors have also issued rules for themselves in the meantime. On 18 December 2024, FINMA pub - lished its Guidance 08/2024 – Governance and risk management when using AI, and numerous private companies have also issued or are in the process of issuing guidelines, codes and instructions, some of which are public and some of which are not. At the end of 2023, the Swiss Federal Council com - missioned DETEC to explore possible approaches for regulation within the framework of the Interdepart - mental Coordination Group on EU Digital Policy, by the end of 2024. Based on this mandate, on 12 Febru - ary 2025, DETEC and the Federal Department of For - eign Affairs (FDFA) presented an overview to the Swiss Federal Council of possible regulatory approaches to AI. On the basis of this overview, the Swiss Federal Council has decided on a Swiss regulatory approach for AI based on three objectives: strengthening Swit - zerland’s location for innovation; safeguarding the protection of fundamental rights, including economic freedom; and increasing public trust in AI. To achieve these objectives, the Swiss Federal Council has set the following key steps for the future: incorporation of the Council of Europe’s AI Convention (which Switzer - land signed on 27 March 2025) into Swiss law; sec - tor-specific legislation as far as required (cross-sector regulation, to be limited to central areas relevant to fundamental rights); and non-binding measures. Final - ly, the Swiss Confederation has developed a strategy for the use of AI within the federal administration. This strategy is structured around three pillars: strength - ening AI‑related competencies within the federal administration; enhancing trust in AI by establishing the conditions under which AI systems may be used in accordance with shared values and rules; and improv - ing administrative efficiency.

389 CHAMBERS.COM

Powered by