The EU AI Act: what really applies to a Swiss company

Ask Swiss executives about the AI Act and two answers come back. The first: "we are not in the EU, so it does not concern us." The second: "it is a text of several hundred pages, we will look at it later." Neither holds. The regulation reaches beyond the Union's borders, as the GDPR did before it, but it does not target every use of AI. For an SME or mid-sized company, the real burden is usually moderate. It depends on three questions: what is your role, what is your link to the European market, and what is the risk level of each use.

What the text says about scope

Regulation (EU) 2024/1689 entered into force on 1 August 2024. A Swiss company can be caught in three main situations:

• it places an AI system, or a product containing one, on the European market under its own name (the provider role);
• it operates a system whose output is used in the EU, even if the system runs in Switzerland;
• it has a subsidiary, an establishment or a European customer for which it uses or distributes AI (the deployer, importer or distributor role).

Switzerland has no equivalent statute. In February 2025 the Federal Council indicated a preference for a sectoral approach, together with ratification of the Council of Europe convention on AI, rather than a copy of the European regulation. For exporters this changes little: the law of the destination market applies.

The timeline to keep in mind

• 2 February 2025: ban on certain practices (social scoring, emotion recognition at work or in education, untargeted scraping of facial images, among others) and the AI literacy obligation for providers and deployers.
• 2 August 2025: obligations for providers of general-purpose AI models. Using a commercial assistant does not make you a model provider.
• 2 August 2026: application of most of the regulation, including Annex III high-risk systems and transparency obligations.
• 2 August 2027: high-risk systems embedded in already regulated products, such as machinery or medical devices.

Fines can reach EUR 35 million or 7% of worldwide turnover for prohibited practices, and EUR 15 million or 3% for most other breaches. For SMEs, the lower of the two amounts applies. The risk is real, but scaled to size.

A guide in six steps

1. Inventory your uses

List every AI system: purchased tools, AI features built into your existing software (HR, CRM, customer support), models developed in-house, and assistants teams use without formal approval. The inventory is usually longer than expected, because AI tends to arrive through software you already own. It overlaps with the work described in No AI without clean data: the project SMEs keep postponing.

2. Establish your role and your EU link

For each system, note whether you build it, buy it, resell it or embed it in a product, and where its output is used. A non-EU provider of a high-risk system must appoint an authorised representative in the Union. Role drives obligations far more than company size does.

3. Classify by risk level

Four levels: prohibited practices, high risk, transparency, minimal risk. High-risk uses include candidate screening and staff evaluation, access to education, creditworthiness assessment and certain product safety components. A chatbot falls under transparency. An internal summarisation or translation tool is generally minimal risk. The useful result at this stage is to spot the two or three uses that fall outside that last category.

4. Deal with what already applies

Check that no use falls into the prohibited practices. Then document AI literacy: training proportionate to roles, a clear usage rule, a named contact person. The minimum AI governance charter covers most of this point.

5. Review supplier contracts

For any high-risk tool, you need to obtain from the supplier the instructions for use, information on how the system works and the ability to keep logs. Add these points to contracts and renewals. For your own products, define which obligation sits with the customer and which with you.

6. Link to data protection law and set a plan

The revised Swiss Federal Act on Data Protection has been in force since 1 September 2023. It already governs automated individual decisions and impact assessments. That work is a foundation: see what SMEs must have in place and the example of client data privacy compliance. Then set a plan through to August 2026, with an owner and a quarterly review.

A worked example, with its assumptions

Take a Swiss industrial company of 300 people, with about 40% of revenue in the EU and a subsidiary in Germany. Assumptions: it uses a candidate screening tool bought from a vendor, a chatbot on its website, office assistants, and its machines embed a predictive maintenance module.

• The screening tool is probably high risk (employment). The company is a deployer: human oversight, informing candidates, keeping logs, use in line with the instructions.
• The chatbot requires telling users that they are dealing with a machine.
• Office assistants fall under AI literacy, meaning training and usage rules.
• The predictive maintenance module is probably minimal risk, unless it performs a safety function for the machine. That point should be checked before 2027.

We estimate, as an order of magnitude, that inventory and classification take ten to fifteen working days spread over a few weeks for an organisation of this size. The figure depends on the quality of existing documentation.

What leaders can decide this quarter

Name an owner, start the inventory, and decide who approves any new AI use before deployment. The subject is also strategic: knowing where AI creates value and where it creates exposure belongs with strategy and value creation. Tracking the texts can itself be supported by tooling, as in automated regulatory monitoring. All of this sits within our Data, AI & compliance expertise.

If you want to know within a few weeks where your company stands, which uses deserve action before August 2026 and which can wait, our diagnostic is the place to start.