AI regulation at a glance: the EU AI Act and the Swiss approach

The overview: three ways to regulate AI

Worldwide, three broad approaches have emerged:

Approach	Examples	What it means
Comprehensive, risk-based law	EU (AI Act), South Korea (AI Basic Act, since January 2026)	Uniform rules across all sectors, stricter the higher the risk
Innovation first, individual rules	United States (state-level rules, federal focus on competitiveness), United Kingdom (sector regulators)	Few overarching requirements, many individual rules, partly contradictory
Targeted state steering	China (including mandatory labelling of AI content since September 2025)	Detailed requirements for specific applications, combined with state control

Alongside these stands the Council of Europe’s AI convention, the first binding international treaty on AI. It requires AI to respect human rights, democracy and the rule of law, and is aimed primarily at states. Switzerland signed it in March 2025.

For Swiss SMEs, what matters is not which model prevails worldwide, but which rules apply to their customers and markets. For most of them, besides Switzerland, that is the EU.

The EU AI Act in detail

The core idea: obligations by risk

The EU AI Act has been in force since August 2024 and takes effect step by step. It sorts AI applications into four levels:

Risk level	Examples	What applies
Unacceptable risk	Social scoring, manipulative techniques, emotion recognition at work and in schools, untargeted scraping of facial images	Prohibited since February 2025
High risk	AI in recruitment and people management, credit scoring, education, critical infrastructure, AI as a safety component in products	Strict requirements on risk management, data, documentation, human oversight
Limited risk	Chatbots, AI-generated or manipulated content, deepfakes	Transparency: people must be able to tell they are interacting with AI or seeing AI content
Minimal risk	Spam filters, translation, most office applications	No specific obligations

In addition, there are separate rules for general-purpose AI models such as large language models. They apply to the makers of these models, not to the companies using them.

Provider or deployer: the key question

The AI Act distinguishes mainly two roles:

• Providers develop an AI system or place it on the market under their own name. They carry most of the obligations.
• Deployers use an AI system under their own responsibility. That is most SMEs.

Deployers of high-risk systems must, among other things: use the system according to the instructions, ensure human oversight by trained staff, monitor operation, keep logs and inform employees before such a system is used in the workplace.

A word of caution: whoever substantially modifies a third-party system or offers it under their own name may become a provider themselves.

The timeline after the “Digital Omnibus”

In July 2026 the EU postponed some deadlines with the “Digital Omnibus”. The current state:

Since / from	What applies
February 2025	Prohibited practices; duty to promote AI literacy
August 2025	Obligations for makers of large AI models; penalty rules
August 2026	Transparency obligations for chatbots and AI content
December 2027	Obligations for high-risk systems (e.g. HR, credit scoring)
August 2028	Obligations for AI as a safety component in regulated products

The AI literacy duty was softened: companies must take measures that promote their employees’ AI literacy rather than ensure a specific level.

Fines

Prohibited practices can draw fines of up to EUR 35 million or 7 percent of worldwide annual turnover, most other breaches up to EUR 15 million or 3 percent. For SMEs, the lower amount applies.

When does the AI Act affect a Swiss company?

The AI Act reaches beyond the EU. It applies to Swiss companies when they offer AI systems in the EU or when their AI’s outputs are used in the EU. Typical cases: a website chatbot for EU customers, AI in recruitment for positions in the EU, an AI product sold to EU customers.

The Swiss approach

No AI act, but targeted adjustments

In February 2025 the Federal Council decided to ratify the Council of Europe’s AI convention and to make the necessary adjustments sector by sector where possible, rather than creating a comprehensive AI act. By the end of 2026, a consultation draft and a plan for non-binding measures such as guidelines and self-regulation are due. The focus is on transparency, data protection, non-discrimination and oversight.

What already applies in Switzerland today

Even without an AI act, AI is not unregulated in Switzerland:

• Data Protection Act: the FDPIC has made clear that the FADP applies directly to AI. Companies must be transparent about why, how and with which data AI processes personal data. Users should be able to recognise that they are communicating with a machine. Automated individual decisions trigger a duty to inform, and those affected can request a review by a human.
• Code of Obligations: the board of directors is responsible for strategy, organisation and oversight, and therefore also for how AI is used. Employment law also sets tight limits on processing employee data.
• Sector rules: FINMA expects supervised institutions to keep, among other things, an inventory of AI applications, a risk classification, testing and ongoing monitoring. Medical devices and other regulated products are subject to their respective product rules.
• Other laws: copyright, unfair competition law and product liability also apply to AI-supported products and content.

In practice, many Swiss companies follow the EU standard anyway, because their customers, partners and supply chains are there.

What you should do now

1. Build an inventory: which AI applications are in use, including unofficial ones?
2. Clarify your role: are you a provider or a deployer for each application?
3. Classify the risk: does an application fall into the EU AI Act’s high-risk areas, for example in HR?
4. Ensure transparency: label chatbots as such, make AI-generated content recognisable, update the privacy notice.
5. Build rules and competence: a short AI policy and training for employees.
6. Review contracts: clauses on data use, liability and security with AI vendors.
7. Track developments: the Swiss consultation at the end of 2026 and the European Commission’s guidelines.

Once these seven points are done, you are well positioned for today and prepared for what comes next. Detailed legal questions always belong with specialised legal counsel.