27.10.2026 — Summary. The Federal Act on Data Protection (FADP) already applies to AI. Asked about the legal issues raised by generative AI, the National Cyber Security Centre (NCSC) points to excessive data sharing and recommends that companies anonymise data, choose Business or Enterprise versions, rule out training by contract, write guidelines and train their staff.
Updated on 27.10.2026
On 16 October 2026, the Federal Data Protection and Information Commissioner (FDPIC) and the NCSC launched a joint campaign (in French) on generative AI at work, as part of Cyber Security Month. The NCSC devotes eleven questions and answers to the subject, and they are worth reading.
Does the FADP already apply to AI?
Yes. For the FDPIC, Swiss data protection law applies directly to data processing that uses AI. The FADP covers all technologies. The NCSC confirms this: current data protection legislation is “directly applicable to AI”. In an article of 24 September 2025 (in French), the FDPIC sets out what follows from this: transparency about purpose, functioning and sources; informing people when they are dealing with a machine; the right to request human review of an automated decision; a data protection impact assessment (DPIA) where the risk is high; deepfakes of identifiable people always to be flagged.
The FADP applies whatever the technology, as a recent ruling shows. On 13 October 2026, the Federal Administrative Court ruled that PostFinance must obtain its customers’ express consent before creating their voiceprint, a biometric data item it has used since 2018 to identify them on the phone. Carrying on speaking after the recording has been announced does not amount to consent. Without consent by mid-February 2027, existing voiceprints will have to be deleted. An appeal to the Federal Supreme Court remains possible (Federal Administrative Court press release (in French)).
Which risk does the NCSC highlight?
Excessive data sharing. The NCSC lists it first among the legal issues: sensitive data about customers, patients or employees, or business secrets, entered into an AI tool. The NCSC’s example is copying an entire email into the prompt field. Meeting minutes raise the same problem.
On top of this comes what the NCSC calls the “greatest hidden risk”: data entered may be used to train models, unless a contract rules this out. And “once information has been fed into the system, it cannot, in practice, be retrieved”.
As our first article explained, on a free or Plus ChatGPT account, conversations may by default be used to train OpenAI’s models, and turning off memory changes nothing. To prevent it, switch off the “Improve the model for everyone” setting or use temporary chats (source: OpenAI).
What does the NCSC recommend?
Among its recommendations are seven measures within reach of an SME:
- anonymise data before entering it;
- use Business or Enterprise versions rather than personal accounts;
- choose solutions that guarantee by contract that data will not be used for training;
- use the opt-out from training where one exists;
- adopt internal guidelines;
- train staff;
- use data loss prevention (DLP) tools.
Where do Swiss SMEs stand?
The SME Cybersecurity 2026 study was carried out by Mobiliar with several partners, including HES-SO Valais-Wallis and digitalswitzerland, and published by the NCSC on 22 October 2026. Four SMEs in five expect more AI-related cyber threats. Nearly half do not yet use AI for their own projects. Only around a third train their staff regularly on cyber risks (in German), and only one in four checks that it can restore its data. Around 35,000 SMEs have suffered a cyberattack in the past three years.
What this changes for a Swiss company
There is no need to wait for AI-specific regulation. According to the NCSC, the relevant consultation is “expected to take place in January 2027”, a date that remains indicative.
For employers, what matters is the framework the company sets:
- which tools are authorised, and with which accounts;
- which data may go into them, and in what form;
- what the contracts say about model training;
- who trains the teams, and on which cases.
These decisions belong in internal guidelines. That is the work we do in AI governance and in-house training. For an SME active in the EU, see also our article AI Act after the Omnibus.
This article is not legal advice.
By Sofia Mestre