Does the EU AI Act apply to your Swiss company?

This paper reflects the regulatory position as of 25 July 2026. The EU AI Act’s timeline moved once, in a simplification package adopted in June 2026, and it could move again. None of what follows is legal advice. Use it as a starting point for the conversation with your own counsel.

Executive summary

Switzerland is not in the EU and has no standalone AI law. The EU AI Act can still apply to a Swiss company. It reaches into Switzerland through two extraterritorial triggers in Article 2(1)(c) and the surrounding scope provisions, wherever the company is headquartered. If either trigger applies, you are in scope, on a timeline that recently changed.

Before you scope an AI project against the Act, you need four answers:

• whether either trigger applies to your use case
• what the revised phasing requires, and by when
• which penalty tier applies to your risk
• how the Act sits alongside Switzerland’s sector-specific approach and its unratified international commitments

Part 1: the two triggers that pull a Swiss company into scope

The Act applies to providers and deployers established outside the EU in two situations, both under Article 2(1)(c) and the scope provisions around it.¹

Trigger one: placing a system on the EU market, or putting it into service there. A Swiss company that sells, licenses or otherwise makes an AI system available in the EU, or puts one into operational use there, is in scope for that system. Where the company is headquartered, or where the system was built, does not matter. EU product rules generally follow the product, and the AI Act is no exception.

Trigger two: the AI system’s output is used within the EU. This trigger catches companies that never thought of themselves as selling into the EU. A Swiss company with no EU establishment, no EU sales entity and no plan to place anything on the EU market is still in scope if its system’s output is used in the Union. Two examples: a Swiss manufacturer whose AI-assisted quality reports feed an EU customer’s compliance process, and a Swiss financial firm whose AI-driven analysis reaches EU clients.

So “we are a Swiss company, we do not sell into the EU” is not enough to settle scope. Ask instead: does any output of this system end up used by anyone in the EU, directly or through a customer, partner or downstream integration? Ask it per use case, because the answer can differ between projects in the same organization.

Part 2: the revised phasing

Timelines published before June 2026 are out of date. In June 2026 the European Parliament (16 June) and the Council of the EU (29 June) adopted a “Digital Omnibus” simplification package that pushed back both high-risk deadlines.² The current timeline:

• 2 August 2026: transparency obligations (Article 50) and most enforcement structures apply. This date did not move.
• 2 December 2027: standalone high-risk AI systems under Annex III, such as recruitment, credit scoring and law enforcement tools, face full obligations. Deferred from 2 August 2026.
• 2 August 2028: high-risk AI embedded in regulated products under Annex I, where the AI is a safety component of something like a medical device or machinery, faces full obligations. Deferred from 2 August 2027.

The Annex III deadline moved by sixteen months and the Annex I deadline by twelve. The transparency and enforcement date did not move. If you track only the high-risk deadlines, you may miss what applies from August 2026.

Scope can also change during a build. A system outside the high-risk obligations today may fall inside them by the time it reaches production, especially one started before June 2026 and due to ship in 2027 or 2028. Recheck applicability as the timeline moves, up to launch.

Part 3: penalties, and the tier that applies

The EUR 35 million or 7% of global annual turnover ceiling applies only to Article 5, the list of prohibited practices such as social scoring and manipulative or exploitative AI.³ It is not the ceiling for AI Act violations in general. If your use case is not a prohibited practice, quoting it as your worst case overstates the risk.

The tiers:

Violation category	Maximum penalty
Prohibited AI practices (Article 5)	EUR 35 million or 7% of total worldwide annual turnover, whichever is higher
Most other operator obligations (e.g. high-risk system requirements)	EUR 15 million or 3% of turnover
Supplying incorrect or misleading information to authorities	EUR 7.5 million or 1% of turnover

Penalties are calculated on worldwide turnover, not on the EU-facing part of the business. For a Swiss company with most of its revenue outside the EU, exposure is not capped at the EU share. Most AI use cases are not prohibited practices, so their exposure sits in the second or third tier. A risk assessment scoped against the wrong tier will overstate or understate the exposure.

Part 4: how this interacts with Switzerland’s own approach

Switzerland has no standalone AI law comparable to the EU AI Act. The Federal Council’s approach is sector-specific: existing frameworks in finance, healthcare, data protection and elsewhere are read and, where needed, adjusted to cover AI in their domain.⁴ For a Swiss-only use case, ask which existing sector framework governs the activity.

Two further points apply.

Switzerland has signed, but not ratified, the Council of Europe’s Framework Convention on Artificial Intelligence. It signed on 27 March 2025. The Federal Council will implement the Convention through targeted, sector-specific amendments to existing law, not a new horizontal statute.⁴ As of 25 July 2026 the Convention is not ratified, and drafting of implementing legislation is expected to continue through 2026. It is not yet binding, but it shows where Swiss law is heading.

Swiss companies operating in or selling into the EU do not get to choose the more favourable regime. A company whose domestic activity falls only under Swiss sector rules can be inside EU AI Act scope for another part of its business, through either trigger in Part 1. The two regimes apply in parallel, so map both.

What this means in practice

Before a build decision on a new AI use case, ask four questions in this order:

1. Does either extraterritorial trigger apply to this system’s outputs?
2. If so, which revised deadline governs it, given its category and likely production date?
3. Which penalty tier applies, given what the system does?
4. Which Swiss sector framework applies in parallel, whatever the EU answer?

Answering them before development starts costs less than a pre-launch compliance review. That is why a regulatory applicability check is part of the first stage of every AI engagement we scope.⁵

What is still unsettled

• The Digital Omnibus package was adopted in June 2026, weeks before this paper was written. A further amendment, delegated act or implementing guidance could still change the dates, particularly the 2027 and 2028 deadlines.
• How the two triggers apply to specific data flows depends on the facts, especially indirect ones where output reaches the EU through an intermediary or customer. No general guide can resolve that for your case.
• Switzerland’s implementation of the Council of Europe Framework Convention is still being drafted. The sector-specific amendments are not yet public in final form.

Where this fits

A regulatory applicability check for a specific use case covers both triggers and the relevant Swiss sector frameworks. It is a standard part of the first stage of the KARPINITY method, the AI opportunity assessment. The wider regulatory picture, including revFADP and GxP, is on AI regulation in Switzerland.

Footnotes

1. EU AI Act (Regulation (EU) 2024/1689), Article 2(1)(c): the Act applies to providers and deployers established outside the EU where the output produced by their AI system is used within the EU, in addition to anyone placing a system on the EU market or putting it into service there, regardless of where the provider is established. Not Switzerland-specific; this is EU law reaching into Switzerland through its extraterritorial scope. Regulation entered into force 1 August 2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng ↩

2. EU AI Act implementation timeline, as revised by the AI “Digital Omnibus” simplification package the European Parliament adopted on 16 June 2026 and the Council of the EU adopted on 29 June 2026: transparency obligations (Art. 50) and most enforcement structures apply from 2 August 2026; the deadline for stand-alone high-risk systems under Annex III was deferred from 2 August 2026 to 2 December 2027; the deadline for high-risk AI embedded in regulated products under Annex I was deferred from 2 August 2027 to 2 August 2028. Not Switzerland-specific. Council of the EU, “Artificial intelligence: Council gives final green light to simplify and streamline rules,” press release, 29 June 2026: https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/. Official AI Act text (pending consolidation of the amendment): https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng ↩

3. EU AI Act, Article 99(3): fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher, apply specifically to non-compliance with the Article 5 prohibition on unacceptable-risk AI practices, not to AI Act violations generally. Most other operator obligations are capped at up to EUR 15 million or 3% of turnover; supplying incorrect or misleading information to authorities is capped at up to EUR 7.5 million or 1%. Not Switzerland-specific. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng ↩

4. Federal Council, communication on Switzerland’s AI regulation approach, 12 February 2025: Switzerland will implement the Council of Europe’s Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law primarily through targeted, sector-specific amendments to existing law rather than a horizontal AI statute. Switzerland signed the Convention on 27 March 2025; as of this writing it has not yet been ratified, and implementing legislation is being prepared through 2026. Swiss-specific. https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-104110.html ↩ ↩²

5. See the KARPINITY method for the full six-stage structure and how a regulatory applicability note is produced as part of stage 01. ↩