AI Compliance in Switzerland vs EU GDPR: FADP, the AI Act Gap and the 2026 Swiss AI Bill

If you serve customers in Switzerland and the EU, the short answer is: GDPR-compliant operations cover roughly 85 % of revFADP requirements out of the box — but the remaining 15 % decide whether you face criminal penalties or administrative ones. The Swiss revFADP, fully effective since 1 September 2023, deliberately stays close to GDPR but adds two teeth that don't exist in EU law: criminal liability for individuals (not just companies) and a stricter consent regime for profiling. For AI specifically, Switzerland diverges harder still, because there is no Swiss equivalent of the EU AI Act — yet — which creates both a regulatory gap and a competitive opportunity for Swiss-hosted AI services.

This guide compares the revFADP and GDPR for AI use cases head to head, lays out the five concrete differences that change how you build (data subject rights, consent, fines, profiling, DPO obligations), and gives you a decision matrix for the three common SME setups: Swiss-only, Swiss + EU, and EU primary with Swiss exposure. Sources: PwC's revFADP/GDPR comparison, Adnovum's seven-differences breakdown and DLA Piper's Swiss data-protection summary.

If your AI tooling is GDPR-compliant and EU-hosted, you are roughly 85 % covered for Switzerland — but you still need to address five revFADP-specific items: (1) criminal liability disclosures in employment contracts of senior decision-makers, (2) explicit consent for high-risk profiling (stricter than GDPR), (3) a Swiss representative if you have no Swiss subsidiary, (4) FDPIC-specific breach notification within 72 hours, and (5) updated DPA templates referencing Swiss law alongside the GDPR.

What does not exist in Switzerland yet: an EU-AI-Act equivalent. The Federal Council's consultation on a Swiss AI law is ongoing as of April 2026 — most observers expect a 2027–2028 effective date. Until then, your AI risk classification, training-data documentation, and bias-audit obligations under EU AI Act Articles 9–15 simply do not have a Swiss counterpart. That's the regulatory gap. It also means: if you sell AI services into Switzerland from Switzerland, you face fewer formal AI obligations than your EU competitors right now — a 12- to 24-month competitive window.

The two regimes overlap on intent (protect personal data, give individuals control) and disagree on enforcement (criminal vs administrative penalties), profiling thresholds (Swiss is stricter), and AI specificity (EU has the AI Act layer, Switzerland doesn't yet). The table below covers the dimensions that actually shape your AI build.

Switzerland has no in-force AI-specific law as of April 2026, and the Federal Council's consultation suggests a principle-based approach rather than the EU's risk-classification model. For SMEs that operate AI products from Switzerland, this is a real competitive advantage — for the next 12 to 24 months. After that, expect Swiss law to land somewhere between EU AI Act and Council of Europe AI Convention principles, with sector-specific overlays (finance, health, employment).

Practical implication: don't build to the missing Swiss AI law. Build to EU AI Act high-risk requirements as your baseline, even for Swiss-only operations. When the Swiss law lands, it will be GDPR-style adequate to or stricter than the EU benchmark — never weaker. The cost of over-compliance is a lost competitive window. The cost of under-compliance is rebuilding under regulatory pressure with shrinking timelines. Pick the cheaper mistake.

If your stack is GDPR-mature, these are the five concrete changes the revFADP forces you to make. None of them is expensive in isolation — together they're a half-day of legal work plus contract updates.

Three setups cover ~95 % of SMEs we work with. The right play differs sharply between them — picking the wrong one means either over-spending on representatives and consents you don't legally need, or under-spending and carrying personal liability for senior people.

From audit work and onboarding conversations across Swiss + EU SMEs in 2025/2026, the same five mistakes recur. Three of them get caught only in an audit — at which point fixing them is 10× the cost of avoiding them upfront.

Short answer: Switzerland still has no AI Act, and it will not copy the EU one. On 12 February 2025 the Federal Council chose a sector-by-sector approach: ratify the Council of Europe AI Convention, amend existing laws where needed (data protection first), and add non-binding measures elsewhere (Federal Council release). Switzerland signed the Convention in Strasbourg on 27 March 2025 (Council of Europe); the Federal Department of Justice and Police is drafting the implementing bill, covering transparency, data protection, non-discrimination and supervision, for public consultation by the end of 2026 (Federal Chancellery). Until that bill passes, which realistically means 2028 or later, the only binding cross-sector AI rule for a company in Switzerland is the revised Data Protection Act (FADP, SR 235.1).

For an AI company that serves Swiss and EU customers this creates an asymmetric calendar. In the EU, the AI Act transparency duties under Article 50 apply from 2 August 2026 and the Annex III high-risk obligations, after the Digital Omnibus, from 2 December 2027. In Switzerland nothing AI-specific is dated yet; the Council of Europe Convention itself binds the state, not your company, until Swiss law transposes it. The practical consequence: build your AI governance to the EU standard once, and the Swiss bill will almost certainly ask for a subset of it.

The FDPIC has said the same thing three times, in November 2023, May 2025 and January 2026: the FADP is technology-neutral and applies to AI in full (FDPIC, AI and data protection). There is no AI carve-out and no AI-specific add-on. What that means in practice maps onto four articles, and every one of them has a GDPR twin that is stricter, looser or simply different.

If your AI service touches both Swiss and EU residents, which is the normal case for SaaS, recruiting platforms, HR tools and customer-support AI, four operational divergences decide the extra work.

1. Processing inventory. GDPR Art. 30 demands a record of processing activities from any controller offering AI services, regardless of size. The FADP exempts companies under 250 employees unless the processing is high-risk, and high-risk is where most AI lands. Keep the GDPR record; it satisfies both.

2. Cross-border transfers. Switzerland has held EU adequacy since 2000 (confirmed in the 2024 review), and the EU is on the Swiss adequacy list, so CH-EU flows need no extra instrument. Transfers to the US differ: the EU relies on the Data Privacy Framework, Switzerland on the Swiss-US DPF since 15 September 2024. A US model provider therefore needs to be certified under both frameworks, or you fall back to standard contractual clauses with the Swiss annex.

3. Representative. An EU company serving Swiss residents needs a representative in Switzerland only if it processes extensively, regularly and with high risk (Art. 14 FADP). A Swiss company serving EU residents needs an EU representative under GDPR Art. 27 far sooner. Many Swiss AI start-ups miss the second one.

4. Sanctions land on people, not companies. Under Art. 60 to 63 FADP the criminal fine of up to CHF 250,000 targets the individual who decided, typically the managing director or the person in charge of the AI product. Under GDPR and the AI Act the company pays. That single difference changes who signs off your DPIA in Switzerland: make it the person who would be fined.