AI governance for boards: what Swiss data protection, FINMA and the EU AI Act require today
Adam D. Wisniewski, Managing Partner17 October 2026
Switzerland does not yet have a dedicated AI act, but the board is already responsible today: through its non-transferable duties under the Swiss Code of Obligations, through the Data Protection Act and, in financial services, through FINMA's supervisory expectations. Companies serving the EU must also consider the EU AI Act. Five elements form a solid basis: a position, an inventory, guardrails, competence and regular reporting.
Why AI is already a board matter
Switzerland does not yet have a dedicated AI act. In February 2025 the Federal Council decided to ratify the Council of Europe’s AI convention and to adapt existing laws sector by sector where possible. A consultation draft has been announced for the end of 2026.
Concluding that AI is not yet a board topic would be wrong. Under Art. 716a of the Swiss Code of Obligations, overall management, determining the organisation and ultimate supervision are non-transferable duties of the board. When AI changes a company’s business model, cost structure or risks, it falls squarely within these duties.
The risk is not the missing AI act. It is the missing position of your own.
What applies today
| Framework | What it requires | Who it applies to |
|---|---|---|
| Federal Act on Data Protection (FADP) | Transparency about processing personal data, duty to inform about automated individual decisions, data security | All companies processing personal data with AI |
| FINMA Guidance 08/2024 | Governance, inventory and risk classification of AI applications, data quality, testing and ongoing monitoring, documentation | Supervised financial institutions |
| EU AI Act | Prohibited practices since February 2025, transparency obligations, high-risk obligations phased in from December 2027 | Swiss companies offering AI in the EU or whose AI outputs are used in the EU |
The EU AI Act deadlines for high-risk systems were postponed by the “Digital Omnibus” in July 2026. The basic obligations and transparency rules remain.
Five elements of lean AI governance
1. A position. The board decides which role AI plays in the strategy: lead, prepare or deliberately watch. A deliberate decision to wait is also a position, provided it is reasoned.
2. An inventory. Which AI applications are in use, including unofficial ones? FINMA expects financial institutions to keep such an inventory with risk classification. For any SME, it is the simplest way to make shadow AI visible.
3. Clear guardrails. A few binding rules achieve more than long policies: no confidential data in public tools, a human in the loop for sensitive outputs, role-based access and a simple data classification (confidential, internal, public).
4. Competence at every level. The board does not need to code. It does need to ask the right questions: what business value is expected, how will it be measured, which risks arise and who is accountable?
5. A reporting rhythm. AI keeps changing. A short quarterly report on portfolio, impact and risks keeps the board informed without slowing management down.
How to start in three steps
- Clarify the situation: ask management to show where AI is already used today and which data flows into it.
- Set a position: discuss in the board where AI could change your business model, and where it will not.
- Adopt guardrails: one page is enough to start. What matters is that it applies and that someone owns it.
Detailed legal questions belong with specialised legal counsel. The strategic assessment, and the questions the board should ask, are part of the board’s own work.
Sources
- Swiss Federal Council: overview of AI regulation, decision of 12 February 2025 (Federal Office of Justice)
- FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence, 18 December 2024
- Regulation (EU) 2024/1689 on artificial intelligence (EU AI Act)
- Digital Omnibus on AI, Regulation (EU) 2026/1744: overview of the amended deadlines
- Swiss Code of Obligations, Art. 716a (non-transferable duties of the board of directors)
- Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023
Frequently asked questions
Does a Swiss SME need an AI policy today?
Yes, as soon as employees use AI tools, which is the case almost everywhere. A short policy covering permitted tools, data classes and responsibilities protects against data leakage and gives employees certainty.
Does the EU AI Act apply to Swiss companies?
Yes, if you offer AI systems in the EU or their outputs are used in the EU. It does not apply directly to purely internal use in Switzerland, but many EU customers and partners expect comparable standards.
Is AI a topic for the board or for management?
For both. Management executes; the board sets the strategy, determines the organisation and oversees the risks. Under the Swiss Code of Obligations it cannot delegate these duties.
Which position will you take at the next board meeting?
In the Executive Briefing we clarify, in two confidential hours, your role, the relevant risks and a position you can defend.
See the Executive BriefingThis article belongs to Step 1: Vision and strategy. Why AI, and what role does it play for us?
