Abstraktes neuronales Netz neben europäischen Sternen und Schweizer Geschäftsumfeld. — KI-generiert mit OpenAI

Artificial intelligence11 September 202617:30 UhrJournalPlus RedaktionReading time: 5 min0 comments

EU Enforces AI Rules: What Swiss Companies Must Consider Now

Further parts of the European AI Act became effective in August. Swiss companies are not automatically covered, but those offering systems or results in the EU market may be directly affected.

JournalPlus Redaktion

The European AI Act is no longer a distant Brussels project for many Swiss companies. Since August 2, 2026, further supervisory and sanction mechanisms have come into effect. Provisions on prohibited practices, transparency, and general-purpose models are becoming gradually enforceable. Concurrently, individual deadlines were adjusted with the so-called AI Omnibus.

The main message is: EU law does not apply across the board to every Swiss SME. However, anyone offering AI systems in the EU market, operating them there, or allowing results to be used in the EU may fall within its scope. For export-oriented companies, the business model, not just the company's headquarters, is the determining factor.

The AI Act Classifies by Risk

The EU does not regulate AI with a single obligation for all. The AI Act differentiates by risk and role. Certain applications are prohibited, such as particularly manipulative practices or inadmissible biometric categorization. High-risk systems are subject to strict requirements for data, documentation, human oversight, and monitoring.

In addition, there are transparency obligations. Users should be able to recognize in certain situations that they are communicating with a machine or viewing synthetic content. Providers of large general-purpose models must provide additional technical information and risk assessments.

Why Swiss Companies May Be Affected

A Zurich software company selling its AI application to customers in Germany operates in the EU market. A Swiss conglomerate whose model results are used in a French subsidiary may also be covered. Supply contracts with European partners increasingly include guarantees regarding documentation, data origin, and compliance.

Conversely, a bakery that internally uses standard software for simple marketing texts and does not offer results in the EU does not fall under the AI Act solely because of this use. Data protection, copyright, and employment law obligations remain relevant, however.

This differentiation protects against two errors: panic, where every use immediately triggers an EU procedure, and carelessness, where a Swiss address is believed to protect against European rules.

Which Deadlines Matter Now

Implementation is staggered. Since August 2026, further transparency and supervisory regulations have become relevant. For certain existing models, a transitional period runs until December 2, 2026, particularly for requirements concerning machine-readable labeling and the detection of synthetic content.

For high-risk systems, later deadlines apply depending on the category. Systems from Annex III will be covered from December 2027 according to the adjusted schedule, while AI as a safety component of regulated products will partially follow in August 2028. Companies should not read these dates in isolation: development, data preparation, and contract changes require months.

With the AI Omnibus, the EU has changed deadlines and procedures. This shows that compliance is not a one-time project. Responsible persons must follow official updates and should not rely on outdated presentations.

Five Steps for Companies

First, an inventory is needed. Which AI systems are purchased, developed, or integrated into products? Which data flows in, and where are which results used? Without an overview, risk classification is impossible.
Second, the role must be clarified. A user of a model has different obligations than a provider selling it under their own name. For group structures, it must be determined which company is responsible for which application.
Third, risk assessment follows. Recruitment, creditworthiness, education, critical infrastructure, and certain health applications deserve special attention. In doubtful cases, a case-by-case legal review is advisable.
Fourth, contracts and documentation should be adapted. Companies need information from suppliers about model versions, training and usage limits, security incidents, and support services. Their own customers require clear information on purpose and limitations.
Fifth, human responsibility is essential. A designated entity should track changes, record incidents, and coordinate training. Governance is not additional software, but a clear chain of command.

Switzerland is Developing Its Own Rules

Switzerland currently lacks comprehensive AI-specific legislation. The Federal Council pursues a sector-specific approach and aims to implement the Council of Europe's Convention on Artificial Intelligence. A consultation draft is announced by the end of 2026. Key focuses include transparency, data protection, non-discrimination, and supervision.

This could lead to a leaner system than in the EU. However, for companies with European business, Swiss law does not replace EU obligations. On the contrary, those who establish clean processes now can cover multiple regulatory frameworks with the same governance.

What This Means for Customers and Employees

For the public, regulations will primarily be noticeable where AI prepares decisions. Applicants should know when automated systems are used. Consumers need clarity regarding chatbots and synthetic content. Employees require training and a way to question erroneous results.

Good regulation should not hinder innovation but foster trust. For Swiss companies, this presents an opportunity: demonstrably secure and transparent systems can become a quality feature in the European market.

Nevertheless, waiting is risky. Companies that only discover a lack of documentation during a tender or complaint will find it difficult to reconstruct past actions. The pragmatic approach starts not with a hundred-page manual, but with a complete list of systems and a clearly responsible person.