Contents
- Data protection law already applies to AI
- The FADP's duty of confidentiality covers more people than professional secrecy
- Four questions for every AI tool
- Seven points to get from the provider in writing
- Before the provider come your own engagement letters and your team
- One example: the public commitments of Grow Amplified
- The first step: one tool, seven points, one written answer
- Frequently asked questions
Key points
- The FADP is technology-neutral and, according to the FDPIC, applies directly to AI. There is no need to wait for a dedicated AI law.
- The duty of confidentiality in Article 62 FADP covers anyone who learns secret personal data through a profession that requires it, fiduciaries and their staff included. Wilful disclosure can be fined up to CHF 250'000.-.
- Four questions apply to every AI tool: where the data is processed, whether the provider trains on it, which sub-processors are involved and whether data goes to the United States.
- The Swiss-U.S. Data Privacy Framework settles transfers to the US companies on its list. Whether a provider trains on your inputs lies outside its scope.
- Seven points belong in the contract before the first file is uploaded: data location, a data processing agreement, no training, only the data needed, an access log, deletion and confidentiality for everyone involved.
Data protection law already applies to AI
Switzerland has no dedicated AI act yet; according to the Federal Council, the consultation on new rules is due to open in spring 2027. For client data, that changes little. The FDPIC states that the Federal Act on Data Protection, in force since 1 September 2023, is technology-neutral and applies directly to AI-supported data processing. It addresses manufacturers, providers and users. Your office becomes a user the moment someone on the team pastes a salary certificate into a chat window.
So the FADP principles apply to every prompt your team types. Personal data may only be processed proportionately and for a recognisable purpose, and it is destroyed or anonymised once that purpose no longer needs it (Art. 6 FADP). Uploading a whole salary certificate, AHV number included, to ask about gross pay discloses more than the question needs. Small input, small risk.
The FADP's duty of confidentiality covers more people than professional secrecy
Professional secrecy usually brings Article 321 of the Swiss Criminal Code to mind. It lists specific professions and their auxiliaries; fiduciaries are not named as such. Concluding that a fiduciary office has no confidentiality duty backed by criminal law would be a mistake.
Article 62 FADP punishes anyone who wilfully discloses secret personal data learned while practising a profession that requires knowledge of such data. The fine is up to CHF 250'000.-, prosecuted on complaint. According to the FDPIC, the circle of people covered is much wider than under Article 321 of the Criminal Code. As we understand it, anyone who handles clients' tax returns, payroll and asset lists practises exactly such a profession.
Art. 321 Criminal Code, professional secrecy
- Applies to the professions named in the law, such as lawyers, notaries, doctors and auditors bound to confidentiality under the Code of Obligations
- Also covers their auxiliaries
- Penalty: custodial sentence of up to three years or a monetary penalty, on complaint
Art. 62 FADP, duty of confidentiality
- Applies to anyone who learns secret personal data through a profession that requires such data
- Also covers anyone working for, or training with, a person bound by the duty
- Penalty: fine of up to CHF 250'000.-, on complaint, wilful acts only
- Continues after the person has left the profession
Two details matter in daily work. According to the FDPIC, the penalties primarily target the person who discloses, not the firm. And only wilful acts are criminal; under civil law, a firm can also be liable for negligence. Whether uploading data to a given AI tool counts as disclosure depends on who has access afterwards and what the provider may do with the data. Settle that for your case with your legal adviser. The facts it turns on sit in the provider's contract.
Four questions for every AI tool
As we understand it, an AI tool that reads client data is usually a processor under data protection law. Article 9 FADP allows this if the data is processed only in the way your office itself would be permitted to, and no statutory or contractual duty of confidentiality prohibits the assignment. Four points decide whether both conditions hold.
- Place of processing
- The country where the data is stored and processed, including backups and support access. Personal data may only leave Switzerland if the Federal Council has found that the destination provides adequate protection, or if suitable safeguards exist, such as standard data protection clauses recognised by the FDPIC (Art. 16 FADP).
- Training
- Whether the provider uses your inputs and files to train or improve models. Many tools have different terms for the free and the business version. What counts is the contract your office actually signed.
- Sub-processors
- Who else works on the data: data centre, model provider, support, error monitoring. Under Article 9(3) FADP, the processor may only pass processing to a third party with your prior approval. Ask for the list with countries, and for notice before any change.
- United States
- Since 15 September 2024, personal data may go without additional safeguards to US companies that hold a Swiss-U.S. Data Privacy Framework certification. Only to those. The public Data Privacy Framework List shows whether a provider is certified: the Swiss-U.S. DPF entry must read “Active”.
The fourth question invites a shortcut. The Data Privacy Framework only answers whether data may be transferred to the United States. It does not answer whether the provider trains on it, how long it keeps it or who reads along. Certification does not replace a contract.
Training is, as we understand it, the most delicate point. A provider that uses client data for its own models processes it for its own purpose, and your office could not hand that data over for someone else's models either. That sits badly with Article 9 FADP. Clarify it with your legal adviser before you sign.
Seven points to get from the provider in writing
Verbal assurances carry little weight in a dispute. These seven points belong in the contract or the data processing agreement before the first upload. Each can be checked on its own. It is there or it is missing.
| Point | What should be in writing | Why |
|---|---|---|
| Data location | Country of processing and storage, including backups and support | Transfers abroad only with adequate protection (Art. 16 FADP) |
| Data processing agreement | Signed before the first access, not after the trial | Legal basis for assigning processing under Art. 9 FADP |
| No training | Inputs, files and outputs are not used to train or improve models | Data processed only as your office itself may (Art. 9(1) FADP) |
| Only the data needed | Which documents and fields the tool sees for the engagement, and which it does not | Proportionality (Art. 6(2) FADP) |
| Access log | Who accessed which document and when, exportable on request | Shows a year later who read along, and who did not |
| Deletion | Deadline and confirmation of deletion when the engagement ends, sub-processors included | Data destroyed or anonymised once no longer needed (Art. 6(4) FADP) |
| Confidentiality for everyone | A confidentiality obligation for all of the provider's staff and sub-processors before they see anything | Your duty of confidentiality only holds as far as the chain behind it |
Point six has a limit. Whatever you must keep for ten years under Article 958f of the Code of Obligations stays in your office and your archive; what gets deleted is the copy held by the provider. Keeping records and logs verifiable is covered in the article on the replay log and record keeping.
A missing data processing agreement is more than a formality. Anyone who wilfully assigns data processing to a processor without meeting the conditions of Article 9 can also be fined up to CHF 250'000.- under Article 61 FADP.
Before the provider come your own engagement letters and your team
Article 9 FADP has a condition that sits in your own documents: no contractual duty of confidentiality may prohibit the assignment. The first document to read is the confidentiality clause in your standard engagement letter and terms of business. If it does not allow IT service providers, settle that before any tool sees client data. The Swiss fiduciary association TREUHAND|SUISSE (in German) recommends a tiered approach: ordinary supporting use of AI covered in engagement terms or internal guidelines, fuller client information where an application has significant effects.
The second gap sits in the team. A ZHAW bachelor thesis (in German) surveyed 72 people from small property management firms: a third use AI although their firm officially uses none. Fiduciary offices are unlikely to look different. The best provider contract protects nothing while a private free account runs alongside it. A short internal AI policy stating which tool is allowed for which data closes that gap more cheaply than any contract.
One example: the public commitments of Grow Amplified
Grow Amplified publishes its own list under Approach. It applies before an agent opens the first file:
- Client data is processed in Switzerland.
- A data processing agreement is signed before the first file is opened.
- The agent sees only the data the engagement needs.
- Every access is logged.
- Confidentiality obligations are passed on contractually to everyone involved before they see anything.
These are commitments, not a certification. Check them in the contract as strictly as with any other provider. Training and the deletion deadline are settled in each engagement contract; ask about them at Grow Amplified too. The second half of control is approval: an agent proposes, a named person decides. How to build an approval that proves something is covered in the article on the four-eyes principle with AI agents.
The first step: one tool, seven points, one written answer
Write down which AI tools run in your office today, including the ones nobody officially introduced. Send each provider the seven points and file the answers, dated, with the contract. Where a point is missing, decide: renegotiate, restrict the data or block the tool for client data. One page per tool is enough.
To see first where an agent would pay off, no tool is needed. You fill in the Flat-Fee Leak Check by hand for one engagement, and no file leaves your office. The basics of agents, approval and logs are in the article AI in the fiduciary office, explained simply.
Frequently asked questions
May I enter client data into a public AI chat such as ChatGPT?
As we understand it, not without further steps. What matters is your office's contract with the provider, the place of processing, the training terms and your engagement letters. With a private free account, your office has no contract of its own with the provider and therefore no data processing agreement either. Clarify the individual case with your legal adviser.
Does professional secrecy under Article 321 of the Criminal Code apply to fiduciaries?
Article 321 does not name fiduciaries as such; it covers, among others, auditors to the extent that the Code of Obligations binds them to confidentiality. Independently of that, the duty of confidentiality under Article 62 FADP applies, which according to the FDPIC covers a much wider circle of people. On top come the confidentiality obligations in your engagement letters. How these interact in your case is a question for your legal adviser.
Is it enough if a US provider is certified under the Swiss-U.S. Data Privacy Framework?
For the question of whether data may be transferred to the United States, certification has been a valid basis since 15 September 2024. It applies to certified companies only and settles neither training nor deletion nor your duty of confidentiality. You still need those points in the contract.
Do I need a data protection impact assessment for AI?
The FADP requires one where processing may pose a high risk to the personality or fundamental rights of the people concerned (Art. 22 FADP), for example when sensitive personal data is processed on a large scale. The FDPIC points out that this applies to AI as well. Whether your use falls under it depends on the individual case.
Do I have to tell my clients that I use AI?
The association TREUHAND|SUISSE recommends a tiered approach: ordinary supporting use covered in engagement terms or internal guidelines, and fuller information where an application has significant effects. Your privacy notice should match how you actually use AI. Agree the wording with your legal adviser.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.