How Swiss Privacy Rules Affect AI Companies Under GDPR

AI companies operating in or around Switzerland face a compliance challenge that most legal teams underestimate: two overlapping privacy frameworks, one criminal liability model, and a third law the EU AI Act entering the picture from the side. This article breaks down exactly how Swiss privacy rules affect AI companies under GDPR, what obligations apply, and where the real risk sits for teams building AI products.

If you need a foundation first, read the full Swiss FADP vs EU GDPR comparison before continuing here.

The Dual Compliance Reality

Most AI companies assume they need to comply with either Swiss law or GDPR. The reality is that most need to comply with both simultaneously. The trigger conditions are different for each law, and they can both apply to the same organization at the same time.

Scenario	FADP Applies?	GDPR Applies?
AI company based in Switzerland, Swiss users only	Yes	No
AI company based in Switzerland, EU users	Yes	Yes
AI company based in EU, Swiss users	Likely yes (effects in Switzerland)	Yes
AI company based outside both, serving EU and Swiss users	Likely yes	Yes

The Swiss FADP, like GDPR, uses an effects-based territorial scope. If your AI system processes personal data of people in Switzerland regardless of where your servers or headquarters are the FADP can apply. AI companies that design their compliance purely around GDPR and ignore FADP are exposed.

What the Swiss FADP Requires from AI Companies

The revised FADP introduced several obligations that hit AI companies harder than traditional software businesses.

High-Risk Profiling Restrictions

The FADP creates a two-tier profiling framework. Standard profiling combining personal data to evaluate aspects of a person requires a lawful basis. High-risk profiling profiling that allows conclusions to be drawn about core personality traits is treated as sensitive data processing and requires explicit consent or another strong legal basis.

AI recommendation engines, behavioral scoring systems, credit AI, and hiring algorithms all fall into high-risk profiling territory under a straightforward reading of the FADP. This means many AI products that operate without explicit consent for profiling are already non-compliant in Switzerland.

Criminal Liability on Individuals

This is the most practically significant FADP provision for AI company leadership. Under GDPR, fines go to the organization. Under the Swiss FADP, fines of up to CHF 250,000 are imposed on the individual the CTO, CPO, data protection advisor, or executive who made the non-compliant decision.

For AI companies, this changes internal dynamics completely. A decision to train a model on customer data without proper legal basis is not just a company risk it is a personal criminal risk for the person who approved it. AI governance policies, model cards, and documented decision trails become essential self-protection tools for technical and product leadership.

Privacy by Design for AI Systems

The FADP requires privacy by design and data minimization as built-in system properties not bolt-on features. For AI companies, this means model architecture decisions, dataset selection, and inference pipeline design all need to account for data minimization from the start. Collecting more data than the model needs because “it might be useful later” is a direct violation of this principle under both FADP and GDPR.

GDPR’s Specific Impact on AI Systems

Article 22 and the Right Not to Be Profiled

GDPR Article 22 gives EU residents the right not to be subject to decisions based solely on automated processing when those decisions produce legal or similarly significant effects. This applies directly to AI systems used for:

• Loan or credit decisions
• Job application screening
• Insurance pricing
• Rental application assessments
• Content moderation resulting in account suspension

When Article 22 applies, organizations must offer a human review option, inform the individual that automated processing is occurring, and explain the logic involved. Many AI companies deploy these systems without any of these safeguards in place meaning they are already in violation across their entire EU user base.

The Training Data Problem

One of the sharpest tensions in AI compliance is the conflict between purpose limitation and AI’s appetite for large datasets. Both GDPR and the FADP require that personal data collected for one purpose cannot be repurposed for a different use without a new, compatible legal basis.

Data collected for customer service, product usage, or account management cannot simply be fed into an AI training pipeline because it happens to be available. This is not a theoretical risk multiple enforcement actions in Europe have targeted companies for exactly this practice. AI companies need a documented legal basis specifically for the training use, separate from the original collection basis.

A common misconception is that pseudonymization solves this problem. It does not. Pseudonymized data where names and direct identifiers are replaced with tokens is still personal data under both frameworks if re-identification is possible. Only true anonymization, where re-identification is genuinely not possible, removes data from the scope of both laws. Most AI training datasets do not meet the anonymization bar.

Legitimate Interests Under Pressure

Many AI companies rely on legitimate interests as the legal basis for training data collection and model inference. This basis allows processing without consent when the organization’s interests are balanced against the rights of individuals. Post-Meta ruling (where the CJEU struck down Meta’s use of legitimate interests for behavioral advertising), regulators have become significantly more skeptical of legitimate interests claims in the AI context.

AI companies using legitimate interests for training pipelines should conduct and document a formal Legitimate Interests Assessment (LIA) including a genuine balancing test that accounts for the scale of processing, the sensitivity of the data, and the reasonable expectations of the individuals involved. A generic LIA template is not sufficient.

The EU AI Act Layer

Swiss-based AI companies need to understand where they stand relative to the EU AI Act even though Switzerland is not an EU member state.

Situation	EU AI Act Applies?
AI system deployed to EU users from Switzerland	Likely yes — output effects in the EU trigger scope
AI system used only in Switzerland, no EU users	No — outside EU AI Act scope
AI company with EU subsidiary deploying the system	Yes — through the EU entity
Swiss company selling AI to an EU business for internal deployment	Potentially yes — the EU business is the deployer

For AI companies caught under both GDPR and the EU AI Act, the compliance stack becomes three layers deep: FADP + GDPR + EU AI Act. High-risk AI systems defined in the AI Act’s Annex III as AI used in employment, education, credit, essential services, and law enforcement require conformity assessments, technical documentation, human oversight mechanisms, and registration in the EU database before deployment.

The Switzerland Adequacy Advantage

One genuine compliance benefit for Swiss AI companies is Switzerland’s EU adequacy decision. Personal data from EU member states can flow to Switzerland without Standard Contractual Clauses or other transfer mechanisms. For AI companies with Swiss-based infrastructure processing EU user data, this eliminates a significant layer of transfer compliance overhead that US-based cloud providers still carry.

This advantage only holds as long as Switzerland maintains its adequacy status which depends on the FADP remaining substantially equivalent to GDPR. The September 2023 revision was partly motivated by protecting this status. Swiss AI companies have a direct stake in the FADP remaining strong, because a loss of adequacy would immediately require SCCs or Binding Corporate Rules for every EU-to-Switzerland data transfer in their pipelines.

Practical Steps for AI Companies

Here is what compliance actually looks like in practice for AI teams operating under both frameworks:

1. Map every data flow. Identify where personal data enters your AI pipeline, what legal basis covers each processing activity, and where the data goes after inference. A Records of Processing Activities (ROPA) document is mandatory under GDPR and strongly expected under FADP.
2. Audit your training datasets. Document the legal basis for each dataset used in training. Remove any datasets where the basis is unclear or where the original collection purpose is incompatible with model training.
3. Build Article 22 compliance into your product. If your AI system makes decisions with significant effects on individuals, implement a human review pathway, an explanation mechanism, and an opt-out option.
4. Conduct DPIAs for high-risk AI processing. Both GDPR and FADP require Data Protection Impact Assessments for high-risk processing. AI systems using high-risk profiling, biometrics, or large-scale behavioral analysis all qualify.
5. Document decisions at the individual level. Under FADP’s individual liability model, documented approval trails for data processing decisions protect the people who made them. Internal governance records are a professional protection tool, not just a compliance checkbox.

Swiss privacy rules and GDPR were not designed for AI they were designed for conventional data processing and are being applied to a technology that works very differently. That gap creates both compliance risk and, for organizations that navigate it well, a real competitive advantage over competitors who ignore it. Start with your data flows, document your legal bases, and build the human oversight mechanisms your AI systems are currently missing.