The EU AI Act and Swiss Companies: What Applies to You

Key Takeaways

• The AI Act is EU law, but it reaches Swiss firms that offer AI in the EU or whose AI output is used in the EU.
• If you only use AI in the office, your duties are usually few: avoid banned practices, build AI literacy and follow the transparency rules.
• The rules for high-risk AI, for example in recruitment, now apply from 2 December 2027.
• Switzerland is not adopting the AI Act. For now the Data Protection Act applies here, and a consultation draft is expected by the end of 2026.
• Write down which of your AI uses touch the EU, and sort them by risk.

The EU AI Act is an EU regulation and doesn't apply in Switzerland as such. It does reach Swiss companies in two situations: when they offer AI systems in the EU, and when the output of an AI system they use is used in the EU. For an SME that mainly uses AI in the office, little follows from this today: avoid the banned practices, build AI literacy in your team, follow the transparency rules, and keep an eye on the high-risk rules, which now apply from 2 December 2027.

As of October 2026. The rules are still moving, and this article is not legal advice.

What does the EU AI Act regulate?

The AI Act, formally Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. It sorts AI by risk. Certain practices are banned, high-risk systems must meet strict requirements, some systems carry transparency duties, and everything else has no specific obligations. You'll find the text on EUR-Lex and an overview from the European Commission.

Two roles matter. A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system under its own authority in a professional context. Most SMEs are deployers: they use tools that others have built.

When does the AI Act apply to a Swiss company?

From the EU's point of view, Switzerland is a third country. Even so, Article 2 says the AI Act applies to providers that place AI systems on the market or put them into service in the EU, wherever they are based. It also applies to providers and deployers in third countries where the output of the AI system is used in the EU. Typical cases:

• You sell software or a device with AI features to customers in the EU. That makes you a provider.
• You have an AI tool built under your name and offer it in the EU as well.
• You use AI and the result is used in the EU, such as your chatbot's answers to customers in Germany, or an AI-assisted shortlist of applicants for a building site in Vorarlberg.
• You have a branch in the EU that uses AI itself. There it is a deployer like any EU business.

If both the use and its result stay in Switzerland, the AI Act generally doesn't apply. Exactly when output counts as used in the EU isn't clear in every case, though. For borderline cases, a legal review is worth it.

Which deadlines apply?

The AI Act applies in stages. With the so-called Digital Omnibus, Regulation (EU) 2026/1744, the EU moved some deadlines and adjusted some duties in July 2026. Since 27 July 2026 this timetable has applied:

1. 2 February 2025.The bans and the AI literacy duty apply. Banned practices include social scoring, manipulative techniques that push people into harmful behaviour, and recognising emotions in the workplace, except for medical or safety reasons.
2. 2 August 2025.Duties for providers of general-purpose AI models, meaning the makers of the large language models, along with supervision and penalties.
3. 2 August 2026.The AI Act applies generally, including the transparency duties. Providers of generative systems already on the market before that date have until 2 December 2026 to mark AI content in a machine-readable way.
4. 2 December 2026.A new ban on AI systems that generate intimate images of real people without their consent, or child sexual abuse material.
5. 2 December 2027.Rules for high-risk systems in sensitive areas, such as recruitment and performance reviews, credit checks on individuals, or education. The original date was 2 August 2026.
6. 2 August 2028.Rules for high-risk AI in products covered by EU product safety law, such as toys or lifts.

What do you need to do if you only use AI?

For most office uses, such as drafting texts, summarising emails or searching documents, the AI Act sets no specific obligations. If your use falls within its scope, watch four points:

• AI literacy: deployers must take measures to support the AI literacy of their staff. Since the Omnibus, the law says explicitly that no particular level is required for each person, but a genuine effort is. Training and clear rules are the obvious route, for example through our team training.
• Transparency: if you use deepfakes, meaning realistic generated or altered images, video or audio, you must disclose it. The same goes for AI text published to inform the public on matters of public interest, unless a person has reviewed it editorially and takes responsibility for it. Making sure people know they're talking to a chatbot is the job of the system's provider.
• Bans: check that none of your uses falls under the banned practices, such as software that analyses your employees' emotions.
• High risk: if you use AI for staffing decisions, such as shortlisting applicants, deployer duties apply from 2 December 2027. You use the system according to its instructions, assign oversight to competent people, monitor how it runs, keep its logs for at least six months and inform the employees affected.

An example: a fiduciary firm in Basel also looks after clients in southern Germany and has AI draft letters, which a specialist checks and sends. The output is used in the EU, but the risk is minimal. The main thing left to do is train the team in using AI. If the same firm had AI pre-sort applications for a job in Lörrach, that would count as a high-risk use from December 2027.

What applies if you offer AI products yourself?

Then you carry far more obligations. Providers of high-risk systems need, among other things, risk management, technical documentation and a conformity assessment. Systems that interact directly with people must be built so that users notice they're dealing with AI, and generated content must be marked in a machine-readable way. Take care, too, if you sell an existing high-risk system under your own name or change it substantially: that can make you the provider yourself.

Breaches can be expensive. Depending on the breach, fines go up to EUR 15 million or 3% of worldwide annual turnover, and for banned practices up to EUR 35 million or 7%. For SMEs, whichever of the two figures is lower applies.

Does Switzerland have its own AI law?

No, not as of October 2026. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI convention, which Switzerland signed on 27 March 2025. Swiss law is to be adapted for this, sector by sector as far as possible. General, cross-sector rules are limited to central areas relevant to fundamental rights, such as data protection. The Federal Department of Justice and Police is preparing a consultation draft, due by the end of 2026, covering transparency, data protection, non-discrimination and supervision. You can follow the status on the Federal Office of Communications page on AI. Until then, AI in Switzerland is governed mainly by the Data Protection Act, which we explain in AI and data protection in Switzerland.

What you can do now

1. List your uses.Note which AI tools you use for what, and which results reach customers, employees or partners in the EU.
2. Clarify your role.Record for each use whether you are a deployer or a provider. If you only use ready-made tools, you're a deployer.
3. Sort by risk.Check whether anything could be banned, whether a high-risk area such as HR is involved, or whether transparency duties apply. A structured use-case scoring helps here.
4. Build skills.Train your team and put the rules in writing, for example in an AI usage policy for your staff.
5. Mark the dates.Put 2 December 2026 and 2 December 2027 in your planning, and review the position once a year, including the Swiss consultation.