Status as of 6 October 2026. This page is for information; it is not legal advice.
Your teams already use AI. We write the rules that describe that use and hold it under Swiss, European and American law.
Your teams have already decided
Your teams use AI today. Part of that use went through IT. Most of it went through a browser tab, on a personal account, with a company document pasted into it. The gains behind it are real, department by department — which is why the practice settled in so quickly, and why it stays. The decision was taken department by department, without a meeting, and it holds. What is still open is the terms.
So the first operation is a reading, not a rule: which tools, on which data, for which decisions, in which teams. Named, and written down.
The internal email was the right instinct
The first move is almost always a message from management: be careful what you paste. The instinct is right, and it stops at the door of the real question. An email asks people to be careful. A guideline says what is allowed, with which tool, on which class of data, what has to be checked before anything leaves the company, and who decides when the case is new. The distance between the two is the work.
Blocking the sites belongs to the same family. The practice moves to the phone in the pocket, where it runs outside your view.
A rule people can apply is a rule you can audit.
Which text applies in Switzerland today
The revised FADP, in force since 1 September 2023: information and transparency, automated individual decisions, processors, transfers abroad, the register of processing activities, impact assessments — all of them touched by ordinary AI use. Switzerland has chosen the sectoral route, settled by the Federal Council on 12 February 2025, and and signed the Council of Europe Convention on AI in March 2025. Draft legislation for its ratification is due for consultation by the end of 2026.
Provider or deployer
The European regulation reaches a Swiss company through use rather than address: placing a system or a model on the EU market, or having the output of that system used there. Most Swiss companies are deployers rather than providers — they use systems built by others — and the obligations of the two differ. Establishing which one you are is the first line of the framework.
Applicable today
Regulation (EU) 2024/1689 was amended by Regulation (EU) 2026/1744, the “Digital Omnibus”, in force since 27 July 2026. Already applicable:
– prohibited practices, Art. 5, since February 2025;
– AI literacy, Art. 4, since February 2025. Since the Omnibus, the duty is to take measures that support it;
– general-purpose AI models, Art. 51–56, since August 2025;
– transparency, Art. 50, since 2 August 2026: tell people when they are dealing with a machine, and label generated content. Systems placed on the market before that date have until 2 December 2026 for technical marking.
High-risk obligations are deferred to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Prohibited practices carry fines of up to EUR 35 million or 7% of worldwide turnover.
Sorting by what is at stake
Three questions sort the uses: which data goes in, which decision comes out, who is affected by it. Summarising a published press release and shortlisting job applications can run on the same tool and have nothing else in common. The sorting leaves most everyday use open, and places under a named condition the few that touch personal data, client secrets, or decisions about people.
What we write
The documents your company carries in its own name.
Scope Entities, departments, external contractors, systems covered.
Roles Who decides, who arbitrates an exception, who answers a client’s question, who keeps the register.
Admitted tools A named list, each with its account type and contractual regime.
Rules by data type Personal data, client data under professional or banking secrecy, payroll and HR data, unpublished figures, source code, third-party material.
Human validation Which outputs leave as they are, which carry the visa of a named person before they leave the company.
Content marking Internally and externally, in line with art. 50.
Register of uses The living inventory that answers an audit, a client’s question or an impact assessment.
Exception procedure The route for a legitimate use the framework did not foresee, with a decision and a trace.
Review cycle The date, the owner, the triggering events.
Written for the people who apply them, in the language of your company, and handed over in an editable version: the pen stays with you. Every rule is written against a scene: someone in a hurry, a tool open, a document they would like to paste into it. A rule that answers that moment is a rule people follow. It is the test we apply to every line.
Why a policy carries a date
The ground is moving in several directions at once. The Omnibus pushed back the high-risk deadlines. In the United States there is no general federal law: each state sets its own pace. Colorado, for one, has refocused its law on automated decisions, applicable from 1 January 2027. A presidential executive order of December 2025 encourages challenges to some state laws, but no federal statute has overridden them so far. Two voluntary references give all of this a common language: the NIST AI Risk Management Framework and ISO/IEC 42001.
A policy therefore carries a date, a named owner and a review point, and the revision is part of the first version. Waiting for a settled text produces a document that arrives after the practice it was meant to frame.
Where this starts
Every nuclai engagement starts with a paid diagnostic. A first conversation, remote and free of charge, sets the perimeter and produces an offer – scope, duration and price fixed; the diagnostic begins at signature. Fixed fee, deducted in full from the mandate if you go ahead. The reading maps the practice in place, the regime that applies to it, and the distance between the two. It can also conclude that your current rules already cover the practice in place. When that is what the reading says, we write it, with the evidence.
Governance belongs to Foundations, alongside corporate training – which carries the AI literacy duty of the EU AI Act (art. 4) – and custom applications. Where a rule touches the numbers or the message, nuclai / finance and nuclai / comms carry it further.
Sources
Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, Official Journal of the EU; Swiss Federal Council decision of 12 February 2025; Council of Europe Framework Convention on Artificial Intelligence (CETS No. 225).
Book the first conversation.
Remote, free of charge, and it ends with a perimeter.
