Switzerland AI Compliance 2026: revFADP, FINMA Guidance 08/2024, and the Federal Council Roadmap

Switzerland has no horizontal AI Act in 2026. On February 12, 2025, the Federal Council formally decided to pursue a sectoral approach to AI regulation rather than transpose an EU-style horizontal statute, and to ratify the Council of Europe Framework Convention on Artificial Intelligence. Implementing legislation (sector-specific amendments where possible, plus the convention's transposition) is still being drafted: the FDJP, with DETEC and the FDFA, is to prepare a consultation draft by the end of 2026, covering transparency, data protection, non-discrimination and supervision. Enactment follows the consultation and Parliament.

That decision changes the compliance map in a specific way. Buyers and counsel who expected a Swiss AI Act on the German or EU model are reasoning from the wrong picture. The operative regimes today are the revised Federal Act on Data Protection (revFADP / nFADP / nDSG), in force since September 1, 2023; FINMA Guidance 08/2024 for supervised financial institutions, published December 2024; and the EU AI Act where it reaches Swiss-domiciled providers extraterritorially. Layered on top are sectoral overlays for pharma, medtech, and healthcare, and a research-funding architecture (Innosuisse, the Swiss AI Initiative) that materially affects how AI work is structured.

This is the cornerstone reference for what actually applies to AI deployment in Switzerland in 2026, written for general counsel, heads of risk, compliance officers, and AI program owners at Swiss-headquartered institutions and at non-Swiss firms with Swiss exposure. It covers each regime in the order it should be reasoned about, the EU AI Act extraterritorial pathway, and how AIDOLS structures engagements to satisfy each.

For broader context, see the AI consulting Switzerland country page, and the Zurich AI consulting financial-services hub page; AIDOLS serves Geneva and the rest of Switzerland remotely from Toronto, with on-site visits where an engagement requires them. For EU AI Act exposure specifically, see EU AI Act compliance. For governance program design specifically, see Governance and Trust.

The revised Federal Act on Data Protection — referred to interchangeably as revFADP (English), nFADP (French: nLPD), or nDSG (German) — entered into force on September 1, 2023. It replaces the 1992 FADP and aligns Swiss data protection materially with EU GDPR while retaining Swiss-specific architecture. The European Commission maintained Switzerland's adequacy decision on the strength of the revision, which preserves frictionless EU-to-Switzerland personal data transfers.

What revFADP Requires for AI

For AI systems, revFADP imposes a familiar set of principles plus a few Swiss-specific obligations:

• Lawfulness, good faith, proportionality, purpose limitation, data accuracy, and security. Standard data-protection principles, applied to ingestion, training, and inference.
• Transparency for automated individual decisions. Article 21 grants data subjects the right to be informed about decisions based exclusively on automated processing that produce legal effects or significantly affect them, and the right to express their point of view and request human review. The functional shape mirrors GDPR Article 22 with Swiss-specific phrasing.
• Data protection impact assessments (DPIA). Article 22 requires a DPIA where processing entails a high risk to the personality or fundamental rights of data subjects. AI systems that profile, score, or make consequential decisions about individuals routinely meet the threshold.
• Record of processing. Controllers and processors must maintain a record of processing activities. AI training pipelines, inference services, and downstream analytics each constitute distinct processing activities for inventory purposes.
• Data breach notification. Notification to the Federal Data Protection and Information Commissioner (FDPIC) without delay where the breach is likely to result in high risk to data subjects.

Cross-Border Transfers

revFADP does not impose data localization. Cross-border transfers are permitted to jurisdictions on the Federal Council's adequacy list, or under standard contractual clauses, binding corporate rules, or other recognized safeguards. The Federal Council's adequacy list overlaps materially but not identically with the EU adequacy list; Swiss-specific transfer assessments are required where the two diverge.

Penalties

Penalties under revFADP are criminal fines up to CHF 250,000 against natural persons. The headline number is lower than GDPR's corporate AMPs, but the structural difference matters: revFADP imposes criminal liability on individuals — typically executives or DPOs — rather than administrative penalties on the entity. Personal risk for accountable functions is therefore higher per-incident than the corporate-AMP comparison suggests.

Enforcement Posture

The FDPIC has been active since the September 2023 in-force date, with published activity reports and investigations covering AI, automated decision-making, biometrics, and cross-border transfers. As of 2026, the de facto compliance bar for AI deployments under revFADP is materially more demanding than the statutory text alone would suggest, particularly on transparency and DPIA depth.

Source: Federal Data Protection and Information Commissioner (FDPIC); SR 235.1 — Federal Act on Data Protection of 25 September 2020 (in force 1 September 2023).

FINMA published Guidance 08/2024 on governance and risk management for the use of artificial intelligence in December 2024. It is the operative AI compliance instrument for FINMA-supervised institutions — banks, insurers, asset managers, financial market infrastructures, and other licensed financial intermediaries — that develop, procure, or deploy AI systems.

FINMA does not create a separate AI license. The guidance applies through existing prudential and conduct frameworks: Circular 2017/1 on corporate governance, Circular 2023/1 on operational risks and resilience, the outsourcing rules, and the supervisory law underlying each license category.

What FINMA 08/2024 Requires

The guidance sets out FINMA's supervisory observations and expectations in seven areas:

• Governance. A centrally managed inventory, defined responsibilities and accountabilities for developing, implementing, monitoring and using AI, and, for outsourced AI, additional tests, controls and contractual clauses on responsibility and liability. The supervised institution remains accountable for AI risk regardless of the source.
• Inventory and risk classification. A maintained inventory of AI applications, classified by risk. Risk-tiering drives proportionate controls.
• Data quality. Controls over training and inference data — completeness, accuracy, representativeness and timeliness.
• Tests and ongoing monitoring. Accuracy, robustness, stability and bias tests, performance indicators defined in advance, and ongoing monitoring for data drift.
• Documentation. For material applications: purpose, data selection and preparation, model selection, performance measures, assumptions, limitations, testing and controls, and fallback solutions.
• Explainability. Proportionate to use case and impact. Where decisions must be justified to clients, employees, the supervisor or the audit firm, explainability is assessed in greater depth.
• Independent review. For material applications, a review of the model development process by qualified staff separate from development.

What FINMA 08/2024 Does Not Do

It does not create new licensing requirements, does not impose blanket prohibitions, and does not duplicate the EU AI Act's high-risk classification scheme. It is principles-based supervisory guidance, applied proportionately. The proportionality is the point — supervised institutions cannot use it as either a ceiling or a checkbox.

Practical Implications

Three implications follow:

• The inventory is the entry point. Without a maintained AI inventory and risk-tiering, none of the downstream controls can be evidenced to FINMA in supervisory dialogue. Building the inventory is the first deliverable, not a deferred one.
• Vendor documentation gaps are a flagged risk. Many third-party AI providers cannot deliver FINMA-aligned documentation by default. The supervised institution carries the residual risk. Procurement and SLA work must specify the documentation expectations explicitly.
• The guidance is supervisory, which means it shows up in the next supervisory review. Institutions that defer alignment to "after the next audit cycle" will be addressing it under findings rather than as a planned program.

Source: FINMA Guidance 08/2024 on governance and risk management for the use of artificial intelligence (December 2024); FINMA Circular 2017/1; FINMA Circular 2023/1.

On February 12, 2025, the Federal Council formally decided how Switzerland will regulate AI. The decision has three operative elements:

1. A sectoral approach, not a horizontal AI Act. Switzerland will not transpose an EU-style horizontal statute. Instead, where legislative amendments are needed, they are to be as sector-specific as possible, with general cross-sector regulation limited to central areas relevant to fundamental rights, such as data protection; work on AI rules continues in specific sectors such as healthcare and transport.
2. Ratification of the Council of Europe AI Framework Convention. The Federal Council decided to ratify the convention, and Switzerland signed it on March 27, 2025. Domestic transposition is the subject of the consultation draft.
3. A consultation draft by end of 2026. The Federal Department of Justice and Police (FDJP), with the Federal Department of the Environment, Transport, Energy and Communications (DETEC) and the Federal Department of Foreign Affairs (FDFA), prepares the draft; DETEC (OFCOM), with the FDJP, FDFA and EAER, draws up an implementation plan for legally non-binding measures such as industry solutions and voluntary commitments by the same date.

Why It Matters

The sectoral approach has two consequences for compliance planning:

• Switzerland is not adopting an EU-style horizontal AI Act. Compliance maps will continue to be assembled from data protection (revFADP), sectoral supervision (FINMA, Swissmedic, ENSI/IFSN, FOCA), and convention-level obligations. Buyers expecting a single horizontal compliance regime are mis-modelling.
• EU AI Act alignment is not the Swiss baseline. Where Swiss sectoral law diverges from the EU AI Act's classifications and obligations, Swiss firms operating only in Switzerland follow Swiss law. Swiss firms operating in the EU are dual-tracked.

What to Watch Through 2026

The consultation draft is due by the end of 2026 and will set out the legal measures implementing the convention, sector-specific where possible. Pre-positioning governance frameworks that anticipate convention-level obligations on risk and impact assessment, transparency, oversight, and remedy is materially cheaper than retrofitting after the consultation closes.

Source: Federal Council media release, 12 February 2025; Federal Office of Justice, Künstliche Intelligenz; OFCOM, Artificial intelligence.

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law was opened for signature on September 5, 2024, in Vilnius. It is the first binding international treaty on AI. Switzerland signed it on March 27, 2025, in Strasbourg. The Federal Council's February 12, 2025 decision set the ratification path and commissioned a consultation draft by end of 2026.

What the Convention Obliges

The convention obliges parties to ensure that activities within the lifecycle of AI systems are consistent with human rights, democracy, and the rule of law. The substantive obligations include:

• Risk and impact assessment frameworks for AI systems, proportionate to risk.
• Transparency about AI system use, including identifying AI-generated content where appropriate.
• Oversight and accountability mechanisms for AI lifecycle activities.
• Remedy — accessible procedures for individuals affected by AI systems.
• Safe innovation — regulatory sandboxes and similar mechanisms encouraged.

The convention is a ceiling-and-floor instrument. It does not preempt sectoral domestic regulation; it sets minimum substantive obligations that domestic law must meet or exceed.

How It Will Land in Swiss Law

The Federal Council's sectoral approach means the convention will be transposed primarily through targeted amendments to existing law rather than a single new statute. Where existing Swiss law already meets convention obligations — much of revFADP and FINMA 08/2024 already does — no further action is required. Where gaps exist, targeted amendments will close them.

Implications for Buyers

The convention is not, by itself, a compliance trigger today. The compliance triggers remain revFADP, FINMA 08/2024, EU AI Act extraterritorial, and sectoral overlays. But governance frameworks designed today should anticipate convention-level obligations, because the consultation drafts emerging through 2026 will be assessed against them.

Source: Council of Europe, Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225); Swiss Federal Council, 12 February 2025.

The EU AI Act is the most consequential AI compliance regime in the world by reach, and Swiss firms are not insulated from it by domicile. Two pathways bring Swiss firms into scope.

Extraterritorial Reach Under Article 2

Article 2 of the EU AI Act extends to providers and deployers established outside the EU where:

• The AI system is placed on the market or put into service in the EU; or
• The output produced by the AI system is used in the EU.

A Swiss-domiciled provider whose AI system serves EU users, or whose output is consumed in the EU, falls within scope. The "output used in the EU" branch is broad and catches many cross-border B2B and B2C deployments that are not formally placed on the EU market.

Market Access

Swiss firms selling AI-enabled products into the EU — medical devices, machinery, vehicles, financial services products with embedded AI — must satisfy the AI Act's substantive obligations regardless of Swiss domicile, because the products themselves enter the EU market.

Timeline

• August 1, 2024 — entry into force.
• February 2, 2025 — Article 5 prohibitions applied. Banned practices live now.
• August 2, 2025 — GPAI obligations applied. General-purpose AI providers in scope.
• July 27, 2026 — AI Omnibus in force. It extends the high-risk transition periods.
• August 2, 2026 — general application. National authorities and the AI Office supervise and enforce.
• December 2, 2027 — Annex III high-risk obligations.
• August 2, 2028 — Annex I high-risk obligations.

The dates follow the European Commission's AI Act page. Swiss exposure is therefore live now for prohibitions and GPAI, ramps in December 2027 for Annex III high-risk, and finishes ramping in August 2028 for Annex I.

What Swiss Firms Should Do

• Map the exposure. Identify which AI systems are in scope under Article 2 and at which Annex level.
• Appoint an EU representative where required for non-EU providers.
• Plan the conformity assessment for high-risk systems before the December 2027 (Annex III) and August 2028 (Annex I) dates.
• Do not assume Swiss-EU equivalence outside data protection. The Swiss adequacy decision under revFADP does not extend to AI Act conformity.

Source: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act).

revFADP and FINMA 08/2024 operate across financial services and the broader private sector. Layered on top are sector-specific overlays that apply additional obligations within their respective mandates.

Swissmedic — Pharma and Medical Devices

Swissmedic, the Swiss Agency for Therapeutic Products, is the authority for medicinal products and medical devices. For AI-enabled medical products, Swissmedic guidance converges with EU MDR/IVDR pathways and is increasingly aligned with the EU AI Act's high-risk medical device classification under Annex I.

Practical implications for AI-enabled medical devices:

• Device classification under the Therapeutic Products Act and Medical Devices Ordinance.
• Clinical evaluation evidence appropriate to the device class.
• Post-market performance monitoring with reporting obligations against pre-defined thresholds, including for AI/ML models that learn or update post-deployment.
• Quality management system integration covering AI/ML lifecycle.
• EU AI Act alignment for products placed on the EU market — Swissmedic registration alone does not satisfy Annex I high-risk obligations.

MedTech and Cantonal Healthcare Data

Healthcare data in Switzerland is governed by a layered regime: revFADP at federal level, the Federal Act on the Electronic Patient Record (EPRA) for the EPR system, and cantonal health legislation that imposes additional obligations on cantonal hospitals, clinics, and providers. Cantonal rules vary materially between Zurich, Vaud, Geneva, Bern, Ticino, and the rest. AI deployments in cantonal healthcare must map cantonal obligations explicitly; a federal-only compliance posture is incomplete.

Other Sectoral Overlays

• ENSI / IFSN (Swiss Federal Nuclear Safety Inspectorate) for AI in nuclear operations.
• FOCA (Federal Office of Civil Aviation) for AI in aviation, harmonized with EASA.
• OFCOM for AI in telecommunications and broadcasting.
• SECO for AI in employment-related contexts, particularly worker monitoring and automated hiring decisions, which intersect with revFADP Article 21 transparency obligations.

Two strands of Swiss research funding matter for AI program design.

Innosuisse — The Swiss Innovation Agency

Innosuisse funds AI work through several instruments:

• Innovation Projects. Collaborative R&D between Swiss companies and research institutions (ETH, EPFL, cantonal universities, universities of applied sciences). Continuous submission.
• Innovation Boosters. Pre-competitive ideation and early-stage exploration in thematic networks. Several boosters touch AI directly or adjacently.
• Flagship calls. Larger, multi-year, multi-partner programs on a theme Innosuisse sets for each call; the AI call (2024) was 'Artificial intelligence in life sciences with a focus on human health'.
• Start-up coaching and internationalisation programmes, and BRIDGE (joint with the SNSF) for the bridge from research to market.

Total Innosuisse spending runs in the range of CHF 300M+ per year across instruments. Innovation projects with an implementation partner, the usual route for an established company, require a Swiss research partner and substantive innovation content; start-up innovation projects need no research partner, and Innosuisse covers up to 70% of their direct costs. Pure deployment work does not qualify; novel model development, applied research, methodology innovation, and non-trivial integration of frontier models into industry-specific problems routinely do.

The Swiss AI Initiative — ETH Zurich, EPFL, and Alps at CSCS Lugano

Announced in December 2023 by ETH Zurich and EPFL, the Swiss AI Initiative is the national flagship effort to build sovereign AI research capacity. Its compute backbone is the Alps supercomputer at CSCS Lugano, with 10,000+ NVIDIA GH200 GPUs. Alps provides one of Europe's most substantial public-research AI compute resources and is the platform under which Swiss-domiciled foundation-model research, open-model releases, and academic-industry collaborations run.

For Swiss firms, the practical implication is that high-end AI research collaborations with ETH or EPFL come with credible compute access — a structural advantage for Swiss-domiciled work that is hard to replicate elsewhere in Europe.

Aligning Funding With Engagement Plans

Innosuisse and Swiss AI Initiative timelines should be integrated with engagement plans rather than treated as a year-end exercise. Innovation Projects run on continuous submission; Innovation Boosters and Flagship calls run on structured timelines. Real-time technical and methodological documentation produces a stronger application than retrospective reconstruction, and the documentation overlaps materially with FINMA 08/2024 validation packages and revFADP DPIA support.

Source: Innosuisse — Swiss Innovation Agency; Swiss AI Initiative (ETH Zurich and EPFL); Swiss National Supercomputing Centre (CSCS).

The table below maps each Swiss compliance regime to the corresponding AIDOLS engagement design choice. The principle: regulatory alignment is a design parameter, not bolt-on compliance work after deployment.

The cross-cutting principle is design for the strictest applicable regime. An engagement that satisfies revFADP plus FINMA 08/2024 plus EU AI Act extraterritorial obligations produces a system that is well-positioned regardless of how the Swiss transposition lands after the consultation. That structural posture is more valuable than chasing each consultation draft as it appears.

Three patterns are worth flagging because they show up consistently in 2026 Swiss deployments:

Multi-regime stacking is the rule, not the exception. A typical Zurich private-banking deployment is simultaneously subject to revFADP, FINMA 08/2024, banking secrecy under Article 47 of the Banking Act, and — if it serves EU clients — the EU AI Act extraterritorially. A Lausanne medtech deployment is subject to revFADP, Swissmedic guidance, EU MDR/IVDR for EU market access, and EU AI Act Annex I high-risk obligations from August 2028. Designing for one regime in isolation produces a system that fails another.

The "no Swiss AI Act" framing misleads buyers. It is technically accurate that Switzerland has no horizontal AI statute as of May 2026. It is not accurate that AI deployments face a light-touch regime. The combined effect of revFADP, FINMA 08/2024, EU AI Act extraterritorial reach, and pending convention transposition is a substantial compliance map. Buyers who hear "no AI Act" and infer "no compliance work" mis-model the cost.

The third-party AI provider gap is real and supervisory-visible. FINMA's outsourcing rules apply to AI sourced from vendors, foundation-model providers, and cloud platforms. The supervised institution carries the residual risk. Vendors who cannot deliver FINMA-aligned documentation force clients to retrofit it under supervisory dialogue, which is materially more expensive and less defensible than designing for it from the start.

If you are deploying AI in Switzerland in 2026, the practical sequence is:

1. Build the revFADP processing inventory. It is the foundational artefact for every downstream regime.
2. Identify the strictest applicable regime. For most financial services deployments, this is FINMA 08/2024 layered on revFADP. For most healthcare deployments, this is revFADP plus cantonal rules plus Swissmedic where medical-device classification applies. For most Swiss firms with EU activity, the EU AI Act extraterritorial pathway is the binding constraint.
3. Design for that regime as a parameter, not a constraint. Privacy-by-design, AI inventory and risk-tiering, explainability instrumentation, robustness testing, and third-party documentation are all easier to build in than to retrofit.
4. Default to Swiss-only data residency for regulated and government clients unless the client explicitly opts otherwise.
5. Choose providers who can deliver regime-aligned documentation as a deliverable. Vendors who ask you to do the FINMA, revFADP, or EU AI Act paperwork yourself are not reducing your cost — they are deferring it onto your supervisory dialogue.
6. Track the consultation draft due by end of 2026, which will set out the convention transposition and any sectoral amendments. Pre-positioned governance frameworks adapt at the margin; un-positioned ones rebuild.

If you are evaluating AI deployment in Switzerland, start with the free AI readiness assessment: 7–8 questions, about 5 minutes, and an instant 0–100 score across five dimensions with three next steps. It is a directional baseline, not a regulatory review. A prioritized opportunity map and a 90-day implementation roadmap come from a Sprint ($15K–$25K, 2–3 weeks). A Build then takes the system to production in 90 days.

Start Your Assessment — free, about 5 minutes. Boards comparing this against external counsel can review fixed-fee AI consulting pricing, the Zurich AI consulting buyer's guide, and the AI governance definition in our glossary to align Swiss compliance terminology before kickoff.

AIDOLS is an AI-native consulting firm delivering production AI systems in Switzerland under revFADP, FINMA Guidance 08/2024, EU AI Act extraterritorial obligations, and the Council of Europe AI Framework Convention. Learn more about our Switzerland country work, our Zurich financial-services hub work, EU AI Act compliance engagements, and our Governance and Trust program design.