AI safety and data protection for Switzerland and the EU

Checked 26 October 2026 · by A.Frick

Data protection and safe habits for AI use in Switzerland and the EU, for private users and small firms.

Anything you type into a cloud AI leaves your device. Treat it like a message to a third party. This page gives the frame. It is not legal advice.

The rules in short

• Switzerland. The revised Federal Act on Data Protection (FADP) governs personal data. The data protection commissioner (FDPIC) gives guidance.
• EU. The GDPR applies to people in the EU. It can also reach a Swiss firm that serves them.
• AI rules. The EU's AI Act sets duties by risk level. Its rules phase in over several years.

Private users

• Do not paste what you would not post publicly. See what never to paste.
• Look for the setting that stops your chats from training the model. Defaults differ by provider.
• Keep every API key secret and set a spending cap.
• Check facts. A hallucination can look convincing.

Small firms (KMU)

• Know what data goes in. Client data, staff data and contracts need a clear rule.
• Check the contract. Ask where data is stored, who may read it, and whether it trains models. Business plans often differ from consumer plans.
• Write a short policy. Say which tools are allowed and what may not be pasted.
• Watch for prompt injection when an AI reads mail, web pages or files.
• Consider a local model for the most sensitive work.

When in doubt

Ask your data protection adviser or the FDPIC. Do not rely on this page for a legal decision.

All pages in this section

• What not to paste into AI chatbots

  Passwords, client data, IDs and secrets do not belong in a chatbot: a traffic-light checklist, provider data rules, Swiss and EU basics, and safer options.