On 28 October 2026, the Federal Council took note of the interim progress on AI regulation. This makes it clearer where things are heading. Here we summarise what has been decided, what already applies today and how the new federal toolkit can help you set up your own AI rules within a few weeks.
Key points at a glance
- An AI law is coming, but later than planned. According to the Federal Council, the consultation is planned for spring 2027; the original target was the end of 2026.
- The Data Protection Act already applies to AI. The Federal Data Protection and Information Commissioner (FDPIC) states that the FADP is directly applicable to AI as soon as personal data is involved.
- The federal government provides a template for your AI rules. The Guide on an AI Code of Conduct (in German) contains ready-made text modules on 10 topics – voluntary and freely combinable.
The roadmap: from the Council of Europe convention to a law
Switzerland is not writing its own AI law modelled on the EU. Instead, it is transposing the Council of Europe's AI Convention into Swiss law. The Federal Council decided this on 12 February 2025. Since then, the roadmap looks like this:
| When | What happens |
|---|---|
| 12 February 2025 | The Federal Council decides to ratify the Council of Europe's AI Convention and issues two mandates: a law and voluntary measures |
| 26 October 2026 | OFCOM publishes a report on AI measures across all federal offices and the Guide on an AI Code of Conduct |
| 28 October 2026 | The Federal Council takes note of the state of work |
| Spring 2027 | Consultation on the law – the public review before Parliament debates it |
Sources: Federal Council, OFCOM
Two tracks: binding law and voluntary rules
| Binding: federal law | Voluntary: guidelines and codes | |
|---|---|---|
| Content | Transparency, data protection, non-discrimination, oversight, risk assessment | Sector dialogues, guidelines, standards, voluntary commitments |
| Responsible | Federal Office of Justice, with OFCOM and the FDFA | OFCOM, with the FDJP, FDFA and EAER |
| Mainly concerns | The public sector; private actors only where fundamental rights are affected | Associations and companies that want to set their own rules |
| What this means for you | Municipalities, cantons and healthcare organisations should follow the law closely | You can set your own rules today, using the federal template |
Sources: OFCOM, Report on sectoral measures, p. 4 (in German)
Everything that does not affect fundamental rights is to be regulated within the individual sectors wherever possible, according to Swiss IT Magazine (in German) – for example in healthcare, transport or the media.
What already applies today: the Data Protection Act
No dedicated AI law does not mean no rules. The Federal Act on Data Protection (FADP) has been in force since 1 September 2023, and according to the FDPIC it also applies to any AI that processes personal data. In practice, this means:
| Obligation | What it means in practice |
|---|---|
| Transparency | Disclose the purpose, functioning and data sources of the AI |
| Make chatbots recognisable | Anyone writing or talking to an AI has the right to know – and must learn whether their input is used to improve the system |
| Label deepfakes | Altered images, videos or voices of real people must be clearly recognisable as such |
| Assess high risks | Where there is a high risk for the people concerned, a data protection impact assessment and safeguards are required |
| A human on request | People concerned can demand that a human reviews an automated decision |
| Prohibited | Large-scale real-time facial recognition and «social scoring», i.e. rating people based on their behaviour |
Source: FDPIC, Current data protection legislation is directly applicable to AI
These obligations apply today, regardless of what the future AI law brings.
The federal AI code: a toolkit for your own rules
The most practical part of the interim progress is the Guide on an AI Code of Conduct (in German; a French version is also available). On 22 pages, OFCOM provides ready-made text modules for an internal AI policy, written in the first person plural so they can be adopted directly. The modules cover 10 topics, from purpose and scope to roles and responsibilities and the handling of incidents.
Each topic comes in three levels of detail. You choose for each topic how strict you want it to be:
| Level of detail | What it defines | Suitable for |
|---|---|---|
| Low: principle | What should apply in principle | Small teams that need first rules |
| Medium: specified principle | Minimum requirements and safeguards | Most SMEs and administrations |
| High: tight guard rails | Documentation, approvals, who may stop an application | Sensitive areas such as healthcare or HR decisions |
Source: OFCOM, Guide on an AI Code of Conduct. The «Suitable for» column is our assessment.
Two points from the guide are worth including in any policy: personal data belongs only in AI systems approved for it. And for important decisions, a merely formal confirmation by a human is not enough – they must genuinely review the result. Also important: the guide is an aid, not proof that you comply with all laws.
Five steps to your own AI policy
The guide describes an eight-step process. For a small or medium-sized organisation, we have condensed it into five. This is our recommendation from practice, not legal advice:
- Get management on board, form a small team. One person from management, someone from IT, someone who works with AI every day. That is all you need to start.
- Take inventory. Which AI tools does your team use, officially and unofficially? With which data? Where is it processed, and is it used for AI training? For many free tools, the honest answer is: unclear.
- Write the rules with the toolkit. Choose the right level of detail for each topic. Define which tools are allowed for which data and which decisions are always made by a human.
- Explain and enable. One page everyone understands is better than a document nobody reads. Add a short training session and a contact person for questions.
- Apply and improve. After three months, review: what works, where are the gaps, which new tools have been added?
How others are already doing it
The report on sectoral measures (in German) shows how federal offices and cantons are already handling AI today. Three examples:
- Federal administration: The AI assistant KOBY of the Federal Office of Information Technology runs on infrastructure that the federal government configures and operates itself. This allows it to process internal and confidential data as well.
- Education: Almost all cantonal education departments already have AI guidelines.
- Healthcare: AI as a medical device is subject to therapeutic products law. For language models in everyday practice, the Federal Office of Public Health refers to recommendations from the Swiss Medical Association FMH.
The pattern is the same everywhere: confidential data and AI are not mutually exclusive. What matters is where the data is processed and who is in control of it.
Frequently asked questions about AI law in Switzerland
Is there an AI law in Switzerland?
Not yet. The consultation is planned for spring 2027, after which Parliament will debate it. Until then, the Data Protection Act and the rules of the individual sectors apply.
Do we have to adopt the federal AI code?
No, it is voluntary. But it is the quickest template if you want to set up your own AI rules.
May we use AI with customer data?
Yes, if you comply with the Data Protection Act: a clear purpose, the people concerned are informed, and the data ends up in a system you have approved for it. Check beforehand where the data is processed and whether it is used for training.
Will the new law affect municipalities more than companies?
Probably, yes. According to the report, the binding rules are aimed primarily at the public sector; private actors are only affected where fundamental rights are concerned.
Does the EU AI Act apply to Swiss companies?
It can, for example if you offer AI systems in the EU or their output is used there (Regulation (EU) 2024/1689, Art. 2). Whether this applies to you depends on the individual case.
What this means for choosing your AI platform
Transparency, data protection and oversight are exactly the topics the upcoming law aims to regulate. Anyone choosing an AI platform today should therefore ask three questions: Where is the data processed? Who can access it? And is what the AI does logged in a traceable way?
At Evoya AI, your data is processed in Switzerland or the EU and never used for AI training. You work with more than 30 language models, including the Swiss model Apertus. For particularly sensitive data, there is Private AI on Swiss infrastructure or on-premise directly at your site.
Where does your organisation stand? Book a free introductory call → or try Evoya for free
News on AI and regulation, straight to your inbox
When there is movement on the AI law, you will hear about it in the Evoya newsletter – along with practical tips for using AI at work.
Subscribe to the newsletterSources: Federal Council, press release of 28.10.2026 · Federal Council, press release of 12.2.2025 · OFCOM, Artificial Intelligence · OFCOM, Guide on an AI Code of Conduct (PDF, in German) · OFCOM, Report on sectoral measures (PDF, in German) · FDPIC · Swiss IT Magazine (in German)
Related reading: Private AI – AI with full control over your data, and php2shell – how AI makes attacks cheaper and defenders faster.