Swiss FADP vs EU GDPR for AI services: key provisions compared (2026)

Switzerland's revised Federal Act on Data Protection (FADP) and the EU's General Data Protection Regulation (GDPR) both apply in full to AI services that handle personal data, and neither has an AI-specific carve-out. The key provisions line up closely: transparency, purpose limitation, impact assessments for high-risk processing and a right to human review of automated decisions. The real differences sit in the legal basis for processing, the size and target of fines, and who enforces the rules. I think that surprises people, because the Swiss act is often assumed to be a lighter copy of the GDPR.

If you build, sell or deploy chatbots, copilots or AI models to people in Switzerland, the EU or both, this affects you. This comparison of the Swiss FADP vs EU GDPR for AI services sets out the key provisions side by side, using the official FADP text on Fedlex, the GDPR on EUR-Lex and guidance from the Swiss and EU regulators, as of late October 2026.

Important: this article is general information, not legal advice. Data protection questions depend on the facts of each case, so for decisions about your own product, speak to a qualified lawyer in Switzerland or the relevant EU member state.

Quick verdict: which rules bite harder for AI services

Neither law is "better". They're after the same outcome by different routes, and the differences come down to four points.

The GDPR is stricter on paper. Every processing operation needs one of six legal bases under Article 6, and fines can reach EUR 20 million or 4% of worldwide annual turnover under Article 83.
The FADP is more permissive by default, but personal. Processing is allowed unless it unlawfully breaches personality rights, according to Articles 30 and 31 of the FADP. Fines are capped at CHF 250,000, but they mostly hit the responsible individuals, not the company.
For AI training data, the GDPR is the harder test. The EDPB says legitimate interest can work for AI models, but only if processing is "strictly necessary" and passes a balancing test, according to its December 2024 opinion.
For chatbot transparency, Switzerland is more explicit. The FDPIC says users have a legal right to know whether they're talking to a machine and whether their inputs are used to improve the model, according to its guidance on AI.

Our take: a company that already complies with the GDPR will probably meet most FADP duties for its AI service. The reverse isn't true. Swiss-only firms entering the EU market should expect more paperwork around legal bases and records, and honestly, I'd budget for that early.

Side-by-side comparison table

Here are the provisions that matter most for AI services. Article numbers refer to the official texts.

Provision	Swiss FADP	EU GDPR
In force	Revised act since 1 September 2023	Since 25 May 2018
Territorial reach	Any processing with an effect in Switzerland, even if initiated abroad (Art. 3)	EU establishments, plus non-EU firms offering goods or services to, or monitoring, people in the EU (Art. 3)
Who is protected	Natural persons only (Art. 5)	Natural persons only (Art. 4)
Legal basis	Processing allowed if it follows the principles; justification needed only for a breach of personality rights (Arts. 30–31)	One of six legal bases required for every processing (Art. 6)
Sensitive data	Includes biometric, genetic, health data, plus social assistance measures and administrative or criminal proceedings (Art. 5)	Special categories, with processing prohibited unless an exception applies (Art. 9)
Explicit consent	Needed for sensitive data and high-risk profiling, if consent is the basis (Art. 6(7))	One of several exceptions for special categories (Art. 9(2))
Automated decisions	Duty to inform; right to give a view and request human review (Art. 21)	Right not to be subject to solely automated decisions with legal or similarly significant effects (Art. 22)
Impact assessment	Required where processing is likely to pose a high risk (Art. 22)	Required where processing is likely to pose a high risk (Art. 35)
Breach notification	To the FDPIC "as quickly as possible" if high risk (Art. 24)	To the authority within 72 hours where feasible, unless unlikely to pose a risk (Art. 33)
Access requests	Generally within 30 days, free of charge (Art. 25)	Within one month, extendable by two months (Art. 12)
Local representative	Required for some foreign controllers (Art. 14)	Required for most non-EU controllers in scope (Art. 27)
Maximum penalty	Criminal fine up to CHF 250,000, usually against individuals (Arts. 60–63)	Administrative fine up to EUR 20m or 4% of global turnover (Art. 83)
Regulator	Federal Data Protection and Information Commissioner (FDPIC)	National authorities, coordinated by the European Data Protection Board (EDPB)

Key provisions compared for AI services

Scope: both laws follow the data, not the server

The FADP applies to "circumstances that have an effect in Switzerland, even if they were initiated abroad", according to Article 3. A US chatbot used by people in Zurich is therefore in scope.

The GDPR reaches non-EU firms that offer goods or services to people in the EU or monitor their behaviour, under Article 3(2). A global AI service will probably fall under both.

Legal basis: the biggest structural difference

Under the GDPR, an AI provider needs a legal basis for each step: collecting training data, training the model, and running it. The most common candidate is legitimate interest under Article 6(1)(f). It's also the one regulators argue about most.

The EDPB laid out the mechanics in Opinion 28/2024. Going by the EDPB announcement, it describes a three-step test and lists factors for whether people can reasonably expect their data to be used, including whether the data was publicly available and the context in which it was collected. The opinion also warns that a model built on unlawfully processed data can affect the lawfulness of its later use, unless the model has been properly anonymised.

The FADP works the other way round. Processing that respects the principles in Article 6 is lawful without a specific basis, and a justification, such as consent or an "overriding private or public interest", is only needed where processing breaches personality rights, under Article 31. That's a real head start for Swiss providers, though it probably doesn't help once EU users arrive.

Transparency and chatbot disclosure

Both laws make controllers tell people who's processing their data and why. The FADP sets out minimum information in Article 19, including the controller's identity, the purpose and any recipients.

For AI specifically, the FDPIC goes further. In its AI guidance, providers and users of AI systems "must make the purpose, functionality and data sources of AI-based processing transparent". It adds that users of language models have a legal right to know if they are talking to a machine and whether their inputs are used to improve self-learning programs.

In the EU, chatbot disclosure now also comes from the AI Act. Its transparency provisions have applied since August 2026, including a duty to tell people when they're talking to a chatbot, according to the Swiss federal SME portal.

Automated decisions and profiling

Automated decisions are where AI services meet the sharpest rules. The GDPR gives people "the right not to be subject to a decision based solely on automated processing" that has legal or similarly significant effects, under Article 22. Exceptions cover contracts, authorisation by law and explicit consent. Fair enough.

The FADP is lighter. Controllers must inform people about decisions based "exclusively on automated processing" with legal consequences or "considerable adverse effect", under Article 21. On request, the person can give their view and ask for review by a human. There's no general prohibition, which I think is the biggest practical gap between the two laws.

The FADP also has its own concept of "high-risk profiling", which requires explicit consent where consent is the basis, according to Article 6(7). The GDPR doesn't have a direct equivalent term.

Impact assessments and privacy by design

Both laws require a data protection impact assessment (DPIA) before high-risk processing. The FADP says a high risk depends on the nature, extent, circumstances and purpose of processing, "in particular when using new technologies", under Article 22. The GDPR rule is in Article 35.

The FDPIC says high-risk AI processing is "permitted in principle" if appropriate safeguards are taken. It names real-time facial recognition and "social scoring" as examples of AI uses that are prohibited under data protection law, according to its AI guidance.

Both laws also require data protection by design and by default: FADP Article 7 and GDPR Article 25. For AI products, that likely means minimal data collection, short retention and training opt-outs as the default.

Cross-border transfers

AI services often send prompts to model providers abroad, so this one bites. Under the FADP, data may go abroad if the Federal Council has found the destination adequate, or with safeguards such as standard clauses the FDPIC has approved or recognised, under Article 16. The GDPR uses a similar system in Chapter V.

Simple enough.

The rules in practice

Case 1: training an AI model on public social media posts

X's use of posts to train its Grok model drew regulators in both jurisdictions. The FDPIC closed a preliminary investigation after X's operator named a Swiss representative and offered an opt-out, available since 16 July 2024. The FDPIC "concluded that the company is complying with the requirements of the FADP by offering this opt-out option", according to its statement.

In the EU, Ireland's Data Protection Commission opened an inquiry in April 2025 into X's use of EU users' data to train Grok, focused on transparency and lawfulness, according to the Law Society Gazette of Ireland. The contrast shows the structural gap: an opt-out satisfied the Swiss regulator, while the EU question turns on whether a valid legal basis existed. To be fair, the two cases aren't finished in the same way, so I wouldn't read too much into the outcome yet.

Case 2: automated screening of job or loan applicants

Both laws engage here. Under the GDPR, a fully automated rejection triggers Article 22 and its safeguards. Under the FADP, the controller must inform the applicant and offer human review on request under Article 21. Both would usually require a DPIA, and both give people a right to information about the logic involved (FADP Article 25).

Penalties and enforcement compared

The penalty models differ more than anything else in this comparison.

	Swiss FADP	EU GDPR
Type of sanction	Criminal fine, prosecuted by the cantons	Administrative fine, imposed by the data protection authority
Who pays	Mainly responsible individuals; companies only in limited cases up to CHF 50,000 (Art. 64)	The controller or processor
Upper limit	CHF 250,000	EUR 10m or 2% of turnover (lower tier); EUR 20m or 4% (upper tier)
Trigger	Mostly wilful breaches of listed duties, often on complaint	A wide range of infringements, intent not required
Regulator powers	FDPIC can order processing changed, suspended or stopped and data deleted (Art. 51)	Corrective powers including bans on processing (Art. 58)

Under the FADP, wilful failure to inform people, false answers to access requests, unlawful transfers abroad and breaches of minimum data security rules can each lead to a fine of up to CHF 250,000, according to Articles 60 and 61. Prosecution is "a matter for the cantons", under Article 65. The FDPIC can't fine, but it can order processing stopped and data deleted under Article 51.

Regulator positions on AI

The Swiss regulator's message is that no new law is needed for data protection to apply. An FDPIC official said in January 2026 that generative AI "as such" isn't subject to the FADP but becomes so when it processes personal data, according to the FDPIC. The FDPIC says the FADP "is formulated in such a way as to apply to all types of technology and is therefore also directly applicable to the use of AI-supported data processing", according to its guidance.

Switzerland has no general AI law. The federal government plans a consultation draft in spring 2027 to implement the Council of Europe AI convention, covering transparency, data protection, non-discrimination and supervision, according to the federal SME portal on 23 September 2026.

The EDPB's position is that the GDPR already supports responsible AI. Its chair said the board wants innovation "in full respect of the General Data Protection Regulation", according to the EDPB. The board has since added Guidelines 02/2026 on anonymisation and 03/2026 on web scraping for generative AI, both dated 8 July 2026, according to its documents page.

The GDPR itself may change, and I'd guess the fight over it will run well into next year. The Commission's Digital Omnibus proposal of November 2025 would clarify that AI training can in principle rely on legitimate interest and narrow the definition of personal data, according to law firm Heuking. The EDPB and EDPS criticised the personal data change in a February 2026 joint opinion, the firm reports. EU ambassadors agreed the Council's position on 21 October 2026, and the Parliament hasn't adopted its own yet, according to the Austrian Economic Chamber. Trilogue talks can't begin until it does.

Separately, the AI part of the Omnibus was provisionally agreed on 7 May 2026, postponing several high-risk AI Act deadlines to December 2027 and August 2028, according to law firm Noerr. For background, see our guide to how AI regulation works.

Which rules should you follow?

For most AI services, the answer is probably both. Which one sets the pace depends on where your users are.

For users in the EU and Switzerland, build to the GDPR, then check Swiss extras. These include naming destination countries in notices, the FADP's broader sensitive data list, and a Swiss representative if Article 14 applies.
For Swiss users only, the FADP applies. Focus on transparency, chatbot disclosure, opt-outs from training and DPIAs for high-risk uses. Remember that managers can face personal fines.
When selling AI systems into the EU, the EU AI Act may also apply to Swiss providers, including where an AI system's output is used in the EU, according to the Swiss federal SME portal.
When training models on personal data, document your legal basis under the GDPR using the EDPB's three-step test, and assess anonymity claims case by case.

Governance tooling can help keep records and DPIAs in one place; see our list of AI data governance tools and our explainer on AI governance certification. For legal research support, see our roundup of lawyer AI tools, but treat their output as a starting point, not advice. I wouldn't rely on any of them for a final call.

Next up: the European Parliament's position on the data Omnibus, followed by trilogues, will decide whether GDPR rules on AI training change. In Switzerland, the spring 2027 consultation draft will show how the FADP sits alongside new AI-specific duties. My view: the GDPR is the safer baseline for anyone serving both markets, and the Swiss extras are a short checklist on top of it.

FAQ

Does the Swiss FADP apply to AI?

Yes. The FDPIC says the FADP is technology-neutral and directly applies to AI-supported data processing. Manufacturers, providers and users of AI systems must explain the purpose, functionality and data sources of processing. Users have a right to know when they are dealing with a machine and whether their inputs train the model.

Is the FADP the same as the GDPR?

No, although they're closely aligned. The GDPR requires a legal basis for every processing and the FADP doesn't. FADP fines also target individuals and are capped at CHF 250,000.

Can a company train AI on personal data under the GDPR?

Possibly, using legitimate interest, but only after a three-step test. According to the EDPB, the processing must be strictly necessary and pass a balancing test that weighs people's reasonable expectations. Mitigating measures such as opt-outs can help. Models trained on unlawfully processed data can face problems at deployment unless they are anonymised.

Do I need a Swiss representative for my AI service?

Possibly. Under Article 14 of the FADP, foreign private controllers must appoint a Swiss representative if their processing of people in Switzerland is linked to offering goods or services or monitoring behaviour, and is large-scale, regular and poses a high risk. All conditions must be met.

Which law has bigger fines?

The GDPR. It allows administrative fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The FADP caps criminal fines at CHF 250,000. However, those Swiss fines are usually imposed on the responsible individuals personally, which creates a different kind of risk for managers.

Is this legal advice?

No. This article's general information based on the official texts and regulator guidance as of late October 2026. Laws and guidance are changing, especially in the EU. For your own situation, consult a qualified data protection lawyer in Switzerland or the relevant EU country.