Reference

AI regulation in Switzerland · a reference

revFADP, the EU AI Act’s reach into Switzerland, the Swiss sector-by-sector approach, GxP and sector rules for AI systems, with dates and primary sources.

As of October 2026. This page maps the frameworks likely to apply to an AI system built or used in Switzerland, for your compliance or legal team. None of it is legal advice; your counsel decides where you stand.

revFADP · Swiss data protection

The revised Federal Act on Data Protection has been in force since 1 September 2023.¹ On 8 May 2025 the Federal Data Protection and Information Commissioner (FDPIC) confirmed that it applies directly to AI systems that process personal data.² An AI system that touches personal data of people in Switzerland is already inside an enforced framework, whether or not anyone called it an AI project.

Article	What it requires	What it means for an AI system
Art. 21 · Automated individual decisions	A person must be informed of a significant decision taken solely by automated means, may give their view, and may ask for a review by a natural person, with exceptions	The review path is designed before go-live: who reviews, how fast, and how the outcome is logged
Art. 22 · Data protection impact assessment	A DPIA where processing is likely to carry a high risk to the people concerned	Scoped while the design can still change
Art. 24 · Breach notification	Notify the FDPIC as soon as possible; unlike the 72 hours under the GDPR, there is no fixed deadline	Monitoring and incident response must be able to detect and document a breach that involves the AI system
Art. 60 to 63 · Criminal provisions	Fines up to CHF 250,000 for intentional offences, imposed on the responsible individual	Each system needs a named accountable owner and evidence that duties were met

The criminal provisions cover intentional offences only.³ The fine falls on the responsible individual, usually in a managerial role. A company can be fined instead only where finding that person would take disproportionate effort and the fine would not exceed CHF 50,000.

The EU AI Act and Swiss companies

Switzerland is outside the EU, but the AI Act can still apply. Under Article 2(1)(c) it covers providers and deployers established outside the EU when the output of their AI system is used in the EU.⁴ It also covers anyone who places a system on the EU market or puts it into service there. A Swiss manufacturer selling into Germany can be in scope, and so can a Swiss service firm whose AI output reaches EU clients.

Date	What applies
2 August 2026	Transparency obligations under Article 50 and most enforcement structures, in force since that date
2 December 2027	Obligations for standalone high-risk systems listed in Annex III, such as recruitment, creditworthiness, law enforcement tools and some insurance pricing
2 August 2028	Obligations for high-risk AI embedded in products regulated under Annex I, such as machinery and medical devices

These dates moved in June 2026, when the EU adopted the Digital Omnibus on AI and deferred both high-risk deadlines: Annex III from 2 August 2026 and Annex I from 2 August 2027.⁵ They could move again. A system out of scope today may be in scope by the time it reaches production.

Penalties are calculated on total worldwide annual turnover:⁶

Violation	Maximum fine
Prohibited practices under Article 5, such as social scoring or manipulative systems	EUR 35 million or 7% of turnover, whichever is higher
Most other operator obligations	EUR 15 million or 3% of turnover
Incorrect or misleading information to authorities	EUR 7.5 million or 1% of turnover

Switzerland’s own approach

On 12 February 2025 the Federal Council chose to regulate AI through targeted changes to existing sector law, without a horizontal AI act.⁷ Switzerland signed the Council of Europe’s Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law on 27 March 2025. At our last check it had not been ratified, and the implementing changes were still being drafted.

For a given use case, the rule that applies is usually found in the law that already governs the activity: finance, healthcare, data protection or another sector.

GxP · pharma and life sciences

GxP validation assumes a system behaves the same way after validation as it did during it. AI systems can change when a model, a prompt or a retrieval source changes.

Framework	Status	What it means
GAMP 5	Published 2008; second edition July 2022⁸	The standard for computerised system validation; written before adaptive AI, with no native approach for a system whose behaviour can change after validation
ISPE GAMP AI Guide	Published July 2025⁹	ISPE’s guide to extending GxP validation to AI, used alongside GAMP 5
EU GMP Annex 22	Public consultation 7 July to 7 October 2025; final adoption expected by the end of 2026¹⁰	A new annex on AI in GMP manufacturing; check its status before relying on it

Quality functions most often ask what happens between validation events. A frozen evaluation set that reruns on every change, with drift measured on a schedule and every result kept with the change that caused it, is evidence a validation can use. Validation itself belongs to your quality system.

Sector notes

Sector	Rule to check	Why it matters
Financial services and insurance	EU AI Act Annex III 5(b) and 5(c)	Creditworthiness assessment of natural persons, and risk assessment and pricing in life and health insurance, are listed as high-risk
Manufacturing	EU Machinery Regulation (EU) 2023/1230, applicable from 20 January 2027	It adds AI safety components to its own scope; such a component can also be high-risk under the AI Act’s Annex I. Confirm the interaction of the two timelines with counsel
Energy and utilities	EU AI Act Annex III point 2	AI used as a safety component in critical infrastructure is high-risk only where the operator is designated a critical entity; designation is made by EU member states, so check with counsel whether it reaches a Swiss operator
Hospitality and food retail	Regulation (EU) 1169/2011 Art. 44; Swiss Ordinance on Food Information (LIV)	Allergen information is mandatory for non-prepacked food in the EU since 13 December 2014 and in Switzerland since 1 May 2018. An AI system that answers allergen questions must answer them correctly
Booking and self-service	European Accessibility Act (Directive (EU) 2019/882)	In force since 28 June 2025 for booking sites, apps and self-service check-in; existing self-service terminals have until 28 June 2030
Online platforms	Digital Services Act Art. 27	Platforms with recommender systems must explain the main ranking parameters in plain language

What is still unsettled

The FDPIC confirmed in May 2025 that revFADP applies to AI. Detailed guidance on how a DPIA should evaluate an AI system is still developing.
Under the EU AI Act’s phased timeline, the obligations that apply to a system at production may differ from those that apply today.
Annex 22’s consultation has closed, but at our last check the annex was not yet final.
Switzerland’s sector-by-sector approach means there is no single source of truth: the applicable rule depends on the sector and the use case.

Questions we are often asked

Does the EU AI Act apply to a Swiss company? It can. Under Article 2(1)(c) it applies to providers and deployers outside the EU when the output of their AI system is used in the EU, as well as to anyone placing a system on the EU market. A Swiss firm whose system serves EU customers or EU colleagues may be in scope.

Is there a Swiss AI law? Not a horizontal one. On 12 February 2025 the Federal Council chose to adjust existing law sector by sector. The revised data protection act already applies to AI that processes personal data, as the FDPIC confirmed on 8 May 2025.

Is a DPIA needed for an AI project? Under Article 22 of the revFADP, one is needed where processing is likely to carry a high risk to the people concerned. Running it early, while the design can still change, costs least.

Who validates an AI system under GxP? Your quality system. The evidence it can draw on includes the evaluation set, results per release, the change log, traces and the monitoring between validation events.

How KARPINITY builds these duties into a project is on trust and compliance built in.

Switzerland’s revised Federal Act on Data Protection (revFADP), formally the Federal Act on Data Protection (FADP), entered into force 1 September 2023. Swiss-specific. Official consolidated text: https://www.fedlex.admin.ch/eli/cc/2022/491/en. ↩
FDPIC, “Update - Current data protection legislation is directly applicable to AI”, 8 May 2025: confirms the FADP, in force since 1 September 2023, is technology-neutral and applies directly to AI-supported processing of personal data, and that providers and users of AI systems must keep the purpose, functioning and data sources of that processing transparent. Swiss-specific. https://www.edoeb.admin.ch/en/update-current-legislation-directly-applicable-ai. ↩
FADP Art. 60-63 set criminal fines of up to CHF 250,000 for intentional violations (breach of information or cooperation duties, breach of the data security duty of care, breach of professional confidentiality, or disregard of an FDPIC ruling). Liability falls primarily on the individual responsible, typically someone in a managerial position, under Art. 64 of the Federal Act on Administrative Criminal Law, not on the company as such; only where identifying that individual would require disproportionate investigative effort, and the fine would not exceed CHF 50,000, may the company be fined instead. These are intentional offences only; there is no criminal penalty for a negligent breach. Swiss-specific. Official text: https://www.fedlex.admin.ch/eli/cc/2022/491/en. FDPIC summary, “Criminal law”: https://www.edoeb.admin.ch/edoeb/en/home/datenschutz/grundlagen/strafbestimmungen.html. ↩
EU AI Act (Regulation (EU) 2024/1689), Article 2(1)(c): the Act applies to providers and deployers established outside the EU where the output produced by their AI system is used within the EU, in addition to anyone placing a system on the EU market or putting it into service there, regardless of where the provider is established. Not Switzerland-specific; EU law reaching into Switzerland through its extraterritorial scope. Official text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng. ↩
EU AI Act implementation timeline, as revised by the AI “Digital Omnibus” simplification package the European Parliament adopted on 16 June 2026 and the Council of the EU adopted on 29 June 2026: transparency obligations (Art. 50) and most enforcement structures apply from 2 August 2026; the deadline for stand-alone high-risk systems under Annex III (for example recruitment, credit scoring, law enforcement tools) was deferred from 2 August 2026 to 2 December 2027; the deadline for high-risk AI embedded in regulated products under Annex I (for example medical devices, machinery) was deferred from 2 August 2027 to 2 August 2028. Not Switzerland-specific. Council of the EU, “Artificial intelligence: Council gives final green light to simplify and streamline rules”, press release, 29 June 2026: https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/. Official AI Act text (pending consolidation of the amendment): https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng. ↩
EU AI Act, Article 99(3): fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher, apply specifically to non-compliance with the Article 5 prohibition on unacceptable-risk AI practices (for example social scoring, or manipulative or exploitative systems), not to AI Act violations generally. Most other operator obligations are capped at up to EUR 15 million or 3% of turnover; supplying incorrect or misleading information to authorities is capped at up to EUR 7.5 million or 1%. Not Switzerland-specific. Official text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng. ↩
Federal Council, “AI regulation: Federal Council to ratify Council of Europe Convention”, media release, 12 February 2025: Switzerland will implement the Council of Europe’s Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law primarily through targeted, sector-specific amendments to existing law rather than a horizontal AI statute. Switzerland signed the Convention on 27 March 2025; at our last check it had not been ratified, and implementing legislation was being prepared through 2026. Swiss-specific. https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-104110.html. ↩
ISPE, GAMP 5 Guide, Second Edition (July 2022; GAMP 5 was first published in 2008), the pharmaceutical industry’s standard framework for computerised-system validation. It predates adaptive, learning AI systems as the sector now uses the term, and does not natively provide a validation approach for a system whose behaviour can change after validation, which is ISPE’s own stated reason for publishing a dedicated AI guide. https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition. ↩
ISPE, “ISPE GAMP® Guide: Artificial Intelligence”, published July 2025 (290 pages), designed to be used alongside GAMP 5 (Second Edition) to extend GxP validation thinking to AI-enabled computerised systems across their lifecycle. https://ispe.org/publications/guidance-documents/gamp-guide-artificial-intelligence/. ↩
European Commission / European Medicines Agency, “Stakeholders’ Consultation on EudraLex Volume 4 - Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and New Annex 22”, public consultation open 7 July 2025 to 7 October 2025, covering a new Annex 22 setting requirements for AI and machine learning in the manufacture of medicinal products and active substances. At our last check no final version had been published; the working group was reviewing the consultation comments, with final adoption expected by the end of 2026. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en. ↩