23.10.2026 — Summary. A Swiss SME falls under the AI Act if it places an AI system on the market or puts it into service in the EU, or if the output of its AI is used there (Art. 2). The Omnibus (Regulation (EU) 2026/1744) keeps the transparency rules that have applied since 02.08.2026, adds two prohibitions from 02.12.2026 and sets the high-risk dates at 02.12.2027 and 02.08.2028.
Status as of 23.10.2026
Updated on 23.10.2026
The AI Act concerns Swiss companies that:
provide an AI system in the European Union. Take an SME based in Vaud that develops a customer service chatbot and sells it under its own brand to online shops in Germany. Under the AI Act, it is a “provider”, even though its head office is in Switzerland. Among other things, it must make sure the shops’ customers know they are talking to an AI;
use an AI whose output is used in the Union. A Neuchâtel communications agency uses an AI tool to create the visuals for a campaign for a client in Lyon. It developed nothing; it uses the tool, which makes it a “deployer”. Its visuals are published in France, so in principle in the Union. If one of them shows a real person in an invented scene (a deepfake), the agency must disclose it. The same agency using AI to summarise its internal meeting notes would in principle not be concerned. Here is what applies as of 23.10.2026.
What did the Omnibus change?
Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026, amends the AI Act (Regulation (EU) 2024/1689). It adds deadlines and a few obligations:
- the rules on high-risk systems apply in two stages: 2 December 2027 for Annex III systems, 2 August 2028 for Annex I systems;
- providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark their content;
- two new prohibitions are added to Art. 5, applicable from 2 December 2026;
- the AI literacy obligation (Art. 4) is relaxed, but not removed.
In substance, the transparency obligations of Art. 50 remain those of 2024: only paragraph 7, on codes of practice, has been amended.
Is a Swiss company concerned?
Yes, in two cases defined in Art. 2(1), which the Omnibus left unchanged. The examples given earlier in this article illustrate specific cases.
In practice:
- an SME that sells software in the EU with an AI module it developed itself is a provider;
- an SME that uses a generative tool to produce texts or visuals distributed to clients in the EU is a deployer, and its output is in principle used in the Union;
- an SME that uses AI internally, for results that stay in Switzerland, in principle falls under neither case.
The distinction matters, because the obligations differ.
What must be done before 2 December 2026?
This deadline is aimed first at providers. The new Art. 111(4) gives extra time to providers of systems that generate synthetic content (audio, image, video or text) and that were on the market before 2 August 2026. They have until 2 December 2026 to comply with Art. 50(2): marking generated content in a machine-readable format, so that it can be detected as artificially generated or manipulated. Deployers get no transition period.
2 December 2026 is also when two new prohibitions in Art. 5 start to apply. They cover realistic intimate images of an identifiable person produced without their consent, and child sexual abuse material within the meaning of Directive 2011/93/EU. A company that makes a generative tool available would do well to check its safeguards now.
What about the transparency obligation for a deployer?
It has applied since 2 August 2026, with no extra time (Art. 50). For a Swiss SME, it applies in the cases described above. The deployer must:
- inform people exposed to an emotion recognition or biometric categorisation system;
- disclose deepfakes;
- disclose AI-generated texts published to inform the public on matters of public interest.
This last obligation has a useful exception. It does not apply when the text has undergone human review or editorial control and a person holds editorial responsibility for it. Such a public-interest text, reviewed and editorially owned, therefore does not need a label. Other texts (marketing, user guides, correspondence) are not covered by this obligation. Where information is required, it must be clear and distinguishable, and given at the latest at the time of the first interaction or exposure.
And AI literacy?
It remains an obligation, in force since 2 February 2025. Providers and deployers take measures to support AI literacy among their staff. The Omnibus now specifies that this obligation does not require a given level to be guaranteed. It is a best-efforts obligation, not an obligation of result. In practice, it is best to be able to show what has been put in place: training suited to the tools actually in use, written guidelines, designated contact people. That is the purpose of our in-house training.
What is the timeline?
| Who | What | When | Status |
|---|---|---|---|
| Providers and deployers | Prohibited practices (Art. 5) | 02.02.2025 | in force |
| Providers and deployers | AI literacy (Art. 4) | 02.02.2025 | in force (relaxed) |
| Providers of general-purpose AI models | Chapter V obligations | 02.08.2025 | in force (models already on the market before that date: until 02.08.2027) |
| Providers (Art. 50(1) and (2)) and deployers (Art. 50(3) and (4)) | Transparency (Art. 50) | 02.08.2026 | in force |
| Providers of generative systems on the market before 02.08.2026 | Content marking (Art. 50(2)) | 02.12.2026 | applicable from 02.12.2026 |
| Providers and deployers | New prohibitions (Art. 5) | 02.12.2026 | applicable from 02.12.2026 |
| High-risk systems | Annex III, then Annex I | 02.12.2027 and 02.08.2028 | applicable from 02.12.2027 (Annex III) and from 02.08.2028 (Annex I) |
Penalties, in figures
The penalty ceilings in Art. 99 are unchanged: up to €35 million or 7% of worldwide turnover for prohibited practices, €15 million or 3% for other obligations, €7.5 million or 1% for incorrect information, with SMEs subject to the lower of the two amounts; the Omnibus extends this regime to small mid-cap enterprises.
And in Switzerland?
Switzerland has no AI-specific law. On 12 February 2025, the Federal Council instructed the Federal Department of Justice and Police (FDJP) to prepare a preliminary draft for consultation by the end of 2026, and the Federal Department of the Environment, Transport, Energy and Communications (DETEC) to prepare non-legislative measures. The aim is to ratify the Council of Europe Convention on AI (source: Federal Office of Justice (FOJ), in French). As of 23.10.2026, no consultation has been opened. According to an FAQ published by the National Cyber Security Centre (NCSC) on 16.10.2026, it is “expected to take place in January 2027” (source: NCSC); that date remains indicative.
A Swiss SME active in the EU therefore has no reason to wait for Bern: in the cases described above, EU law already applies to it.
This article is not legal advice.
Frequently asked questions
Does the AI Act apply to all Swiss SMEs?
No. It covers those that provide an AI system in the EU, or whose AI output is used in the Union (Art. 2(1)(a) and (c)).
Does a text written with AI need a label?
Generally, no. The obligation only covers texts published to inform the public on matters of public interest, and it falls away if the text has been reviewed by a human or subject to editorial control, and a person holds editorial responsibility for it. Deepfakes follow a separate rule.
Does Switzerland have an AI law?
No. A preliminary draft is expected by the end of 2026. According to the NCSC, the consultation is expected in January 2027, an indicative date.
Knowing which AI tools your company uses, with which data and under which rules: that is the starting point of our support with AI governance.
By Sofia Mestre