Contents
- When the EU AI Act reaches a Swiss firm
- The timeline, as of 6 November 2026
- What the AI Omnibus changed
- The Swiss approach: data protection law today, an AI law in preparation
- Four steps an SME can take now
- Four typical cases, as we understand them
- The calm route: inventory first
- Frequently asked questions
Key points
- Swiss firms fall under the EU AI Act if they offer AI systems in the EU, are established there, or if their AI output is used in the EU.
- Prohibitions and the AI literacy obligation have applied since 2 February 2025, most of the Act since 2 August 2026. High-risk rules follow on 2 December 2027 and 2 August 2028.
- Since 27 July 2026, the AI Omnibus has been in force. It fixed the high-risk deadlines and softened the AI literacy obligation: firms must support it but need not guarantee a level for each person.
- In Switzerland, the data protection act applies directly to AI. According to the Federal Council, the consultation on a Swiss AI law is due to open in spring 2027.
- Four steps are enough to start: an inventory of AI tools, a risk classification, AI literacy in the team and a review of provider contracts.
When the EU AI Act reaches a Swiss firm
The EU AI Act is an EU regulation, but its scope does not stop at the border. Under Article 2(1), as the European Commission sets it out on the AI Act Service Desk, it applies among others to three groups that a Swiss firm can belong to:
- Providers placing AI systems on the market or putting them into service in the EU, wherever they are established.
- Deployers of AI systems that are established or located in the EU.
- Providers and deployers in a third country, which includes Switzerland, where the output produced by the AI system is used in the EU.
- Provider
- Whoever develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark, for payment or free of charge.
- Deployer
- Whoever uses an AI system under their own authority in a professional capacity. An SME that drafts quotes with an AI tool is a deployer.
- Output
- Predictions, content, recommendations or decisions generated by an AI system.
- AI literacy
- The skills, knowledge and understanding needed to use AI in an informed way and to be aware of its opportunities, risks and possible harm.
For a typical Swiss SME, as we understand it, this means: almost always a deployer, rarely a provider. The Act becomes relevant with an establishment in the EU, with software sold to EU clients that has AI features, or when output from your AI use is used in the EU, such as an analysis for a client based there. Where exactly the line falls is a question for your legal adviser, before you start a new use with an EU connection.
The timeline, as of 6 November 2026
The European Commission keeps the timeline on its AI Act page. The right-hand column is our reading for a Swiss SME without its own AI products.
| Date | What applies | What it means for a Swiss SME |
|---|---|---|
| 1 August 2024 | The AI Act enters into force. | No obligations yet. |
| 2 February 2025 | Eight prohibited practices and the AI literacy obligation apply. | With an EU connection: train the team and rule out prohibited practices, such as emotion recognition at work. |
| 2 August 2025 | Rules for general-purpose AI models and governance apply. | Obligations sit with the model providers. Read their documentation and contracts. |
| 27 July 2026 | The AI Omnibus enters into force. | New deadlines for high-risk AI and a softer AI literacy obligation. |
| 2 August 2026 | The AI Act applies generally, including most transparency obligations under Article 50. The AI Office and national authorities enforce it. | A chatbot talking to people in the EU must make clear that it is AI. That is the provider's duty first; check it anyway. |
| Spring 2027 (Switzerland) | Planned opening of the consultation on a Swiss AI law. | Worth following. The data protection act already applies. |
| 2 December 2027 | Rules for high-risk AI under Annex III apply, for example in employment, education, biometrics and credit scoring. | Relevant if, with an EU connection, you use AI to screen applicants or to score people's creditworthiness. Check first. |
| 2 August 2028 | Rules for high-risk AI in regulated products under Annex I apply, such as lifts or toys. | Affects manufacturers of such products, rarely service firms. |
For most SMEs, 2027 brings little that is new. What applies today is the AI literacy obligation and the transparency obligations. Both can be addressed with an inventory, a policy and one training session.
What the AI Omnibus changed
The AI Omnibus is Regulation (EU) 2026/1744. According to an analysis by the law firm White & Case, it was published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026. The Commission's own page confirms the entry into force and the new deadlines.
What changed
- Fixed deadlines for high-risk AI: 2 December 2027 under Annex III, 2 August 2028 under Annex I
- AI literacy: firms must support its development but need not guarantee a specific level for each person
- Relief for SMEs, such as simplified technical documentation, now also covers small mid-caps
- One additional prohibition and stronger powers for the AI Office
What stayed the same
- Scope under Article 2(1), including for firms in Switzerland
- Prohibitions in force since February 2025
- Transparency obligations from August 2026, for example for chatbots
- An expectation that your team knows how to work with AI
For Swiss SMEs, the change to AI literacy matters most. Article 4 now requires providers and deployers to take measures that support the development of AI literacy among their staff. The text states explicitly that no specific level has to be guaranteed for any one person (Article 4 on the AI Act Service Desk). White & Case recommends keeping a record of the measures taken. A training session with date, content and an attendance list is the simplest record.
The Swiss approach: data protection law today, an AI law in preparation
Switzerland is taking its own route. It signed the Council of Europe Convention on AI on 27 March 2025 and plans to ratify it. On 12 February 2025, the Federal Council instructed the Federal Department of Justice and Police to prepare a consultation draft.
On 28 October 2026, the Federal Council took note of an interim progress report. The rules are to cover transparency, data protection, non-discrimination, supervision and risk assessment, and the consultation is scheduled to open in spring 2027. Changes are to be sector-specific where possible.
What the FDPIC stated in 2023 and confirmed in 2025 already applies: the data protection act is directly applicable to AI. Transparency about purpose and data sources, the right to have automated individual decisions reviewed by a person, and a data protection impact assessment where risks are high therefore apply now, with or without an EU connection.
Four steps an SME can take now
- 01Inventory of AI toolsRecord who uses which tool for what, with which data, and whether any output leaves Switzerland. Five columns are enough. Personal accounts used for work belong in it.
- 02Risk classificationAssign each use to one of the four EU levels: unacceptable and prohibited, high risk, transparency obligation, minimal risk. A named person decides and records why. Borderline cases go to your legal adviser.
- 03AI literacy in the teamOne hour per person: what the tool can do, which data does not belong in it, how to check a result. Record the date, content and attendees.
- 04Review provider contractsWhere the data is stored, whether input is used for training, who counts as provider under the AI Act and whether a data processing agreement is in place. For US providers, also check certification under the Swiss-U.S. Data Privacy Framework.
These four steps largely match what an internal AI policy covers anyway. A one-page template and a 30-day rollout are in AI policy for SMEs. Financial institutions also face FINMA's expectations on governance, inventory and risk classification, described in our article on FINMA guidance 08/2024.
Four typical cases, as we understand them
“We draft quotes and emails with AI, and some clients are in the EU.”
You are a deployer, and the output is used in the EU. As we understand it, quotes and emails are minimal risk, for which the AI Act introduces no specific rules. The AI literacy obligation under Article 4 still applies. Review before sending remains your own duty of care.
“A chatbot on our website answers enquiries, including from the EU.”
Under Article 50, people must be told that they are interacting with AI unless it is obvious. That is first the provider's duty, but check it yourself. Swiss law has the same expectation: according to the FDPIC, anyone corresponding directly with a language model has a right to know.
“We pre-sort job applications with AI.”
AI for employment and recruitment is a high-risk area. With an EU connection, strict obligations apply from 2 December 2027, including for deployers, such as human oversight. Clear it with your legal adviser before you start, EU connection or not, because the data protection act applies either way.
“We sell software with an AI feature to clients in the EU.”
Then you are a provider, and the AI Act applies wherever you are based. The obligations depend on the risk level. For generated text, images, video or audio, Article 50 generally requires machine-readable marking. Here, legal advice with EU experience is worth it.
The calm route: inventory first
The AI Act asks little of most Swiss SMEs, and what it asks is sensible: know which AI runs in the firm, enable the team, read the contracts. Once you have the inventory, you also see where AI pays off. Recording receipts, sorting enquiries and preparing reconciliations are, as we understand it, minimal risk. That is also where much of the manual work sits.
Use the free Shoebox Calculator on one month of your own receipts to see what recording them costs your firm. How Grow Amplified measures a process first and only then builds it with approval and a log is described under Approach. Timon Wick, Founder and CEO, spent 15 years in banking and consulting, including work on compliance and regulatory topics for globally active Swiss banks. That does not replace legal advice, and Grow Amplified does not offer any.
Frequently asked questions
Does the EU AI Act apply to a company based in Switzerland?
It can. Under Article 2, it covers providers placing AI systems on the EU market, deployers in the EU, and providers and deployers in third countries whose AI output is used in the EU. Whether that applies to you is a question for your legal adviser in each case.
What did the AI Omnibus change for SMEs?
It fixed the high-risk deadlines at 2 December 2027 and 2 August 2028, softened the AI literacy obligation and extended SME relief to small mid-caps. Most transparency obligations still apply from August 2026.
Do I have to train my staff?
If the AI Act applies to you, Article 4 requires measures that support the development of AI literacy. You do not have to guarantee a specific level for each person. A short training session with date and attendance list is the simplest record, and it is worth doing even without an EU connection.
Does Switzerland have its own AI law?
Not yet. The Federal Council plans to open the consultation in spring 2027. The data protection act already applies and, according to the FDPIC, is directly applicable to AI.
Is ChatGPT a high-risk AI system?
Under the AI Act, the classification depends on the purpose, not the tool. As we understand it, drafting quotes and emails is minimal risk. Using the same tool to screen job applicants moves into a high-risk area and should be checked legally beforehand.
Do additional rules apply to financial institutions?
Yes. Institutions supervised by FINMA also face the expectations of FINMA guidance 08/2024, for example on governance, inventory and risk classification. More in our article on FINMA guidance 08/2024.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.