AI and data security in Switzerland: where does your data go, and how do you stay in control?

As soon as an SME takes an interest in AI, a legitimate concern resurfaces. If my teams use these tools, where does our data go, and who can access it? The question is all the more sensitive in Switzerland, where confidentiality is a strong value and where the law imposes precise obligations. The good news is that security is not a matter of luck, but of architectural choices. You just need to know the options. This article takes stock, without jargon, of what the law says, of the common pitfalls, and of the levels of control available.

Is your data really secure when you use AI?

It can be, provided you make the right choices. In Switzerland, the Federal Act on Data Protection (nFADP) applies fully to processing carried out by AI. Security therefore depends less on the tool than on how it is governed, namely which data, which provider, which hosting, and which internal rules.

The Federal Data Protection and Information Commissioner (FDPIC) is clear. The revised law, in force since 1 September 2023, is drafted in a technology-neutral way and therefore applies directly as soon as an AI processes personal data (FDPIC). In practice, an SME must be able to explain which data is processed, for what purpose, and by what means. When processing presents a high risk to individuals, an impact assessment is even required.

This framework has a consequence that many directors overlook. In the event of an intentional breach, the fine, which can reach CHF 250,000, targets the responsible natural person (the director, a business manager), and not the company, which moreover cannot assume it on their behalf (Graduate Institute Geneva). An exception exists for small fines (up to CHF 50,000). If identifying the responsible person would require disproportionate effort, the company can then be sentenced in their place (FDPIC, criminal provisions). These sanctions concern intentional violations and are generally prosecuted upon complaint, so it is not a matter of dramatizing, but of understanding that liability is real and often personal. That is one more reason to govern the use of AI rather than let it take hold at random.

Yet this governance is often missing. According to the AXA / Sotomo 2025 study, only one Swiss SME in three has defined clear rules on the data its employees may enter into an AI tool, and that proportion falls below a quarter in companies of fewer than ten people (AXA / Sotomo). The most common risk is not a sophisticated cyberattack, but an employee who pastes sensitive information into a consumer tool, with no bad intent.

Why aren’t all uses of ChatGPT or Claude equal?

Because the same tool comes in several versions with very different rules. On consumer versions, your exchanges can be used to train the model unless you change the setting. On professional access, governed by a contract, data is not used for training by default. Knowing which version you are using changes everything.

This is the most misunderstood point, and the one with the heaviest consequences. On their professional offerings (API, enterprise plans), the major providers commit contractually not to use your data to train their models. OpenAI states this clearly, since by default, data sent via the API or professional plans is not used for training (OpenAI). Anthropic applies the same rule to its commercial products (Anthropic). These offerings come with recognized certifications (SOC 2, ISO 27001) and encryption of data in transit and at rest.

On consumer versions, however (free accounts, and in some cases certain individual paid plans), the logic is reversed: since 2025, several providers use conversations by default to improve their models, unless the user disables this option themselves. The same brand, the same model, but two different worlds when it comes to confidentiality. An employee who uses a free personal account to process an internal document does not offer the same guarantees as governed professional access.

The practical consequence is simple. It is not “AI” in general that is safe or not, but the precise version and the contract that comes with it. This is also why ungoverned use (“Shadow AI”, where everyone installs their own tools) is a risk, because the company loses visibility over what is shared and through which channel.

Where does your data really go? The question of sovereignty

Where your data is physically stored (residency) and the law that governs it (sovereignty) are two different things. A US provider, even with servers in Europe, remains subject to US law. For highly sensitive data, this point can justify choosing a Swiss or European operator.

The CLOUD Act, a US federal law adopted in 2018, allows US authorities to require a US-law provider to hand over data in its possession, regardless of where it is stored, including on servers located in Europe. A 2026 analysis by the firm CMS confirms that this framework remains fully relevant and that the location of servers is not enough to escape its reach (the mechanism dates back to a dispute involving Microsoft, as a 2018 analysis from Columbia Law School noted as early as then). Hence an essential distinction. Hosting your data in Frankfurt or Dublin with a US provider ensures data residency in Europe, but not sovereignty. It is the operator, and its legal nationality, that determine which law applies, not merely the server’s location.

We need to be honest about the scope of this risk. In practice, actual access by US authorities to European corporate data remains rare. But for compliance, what matters is not the case-by-case probability, it is the structural legal risk. The “sovereign cloud” or “EU data boundary” offerings from the major US players limit certain access, but do not change their underlying legal obligation. For particularly sensitive data (health, finance, trade secrets), this nuance can justify turning to a Swiss or European operator. The debate remains lively: in 2025, the European Union adopted a declaration on digital sovereignty, a sign that the question of extraterritorial access to data is more topical than ever for European companies.

Which deployment levels help you stay in control?

There is a range of solutions, from the simplest to the most sovereign: a proprietary model governed by contract, an open-source model on a shared then dedicated Swiss cloud, and finally fully local (100%) deployment. Each level shifts the cursor between simplicity, cost, and control of the data. The right choice depends on the sensitivity of your data.

Rather than a single solution, you need to think in levels. Here are the four main options, from the most accessible to the most sovereign:

Levels 2 and 3 are credible in Switzerland thanks to local sovereign hosting providers. Players such as Infomaniak (which offers open-source models hosted and run exclusively in Switzerland) or Exoscale (data centers in Geneva and Zurich, ISO 27001 certified and outside the CLOUD Act) show that you can run high-performing AI without depending on the US giants. Moreover, the quality gap between open-source and proprietary models has narrowed sharply, which makes these options all the more relevant.

No level is “better” in absolute terms. Level 1 offers the best quality with the least effort, level 4 maximum control at the price of greater complexity and cost. The key is to match the level to the real sensitivity of the data processed, which first requires classifying it.

Beyond hosting, what are the best practices?

The choice of infrastructure is not everything. Encrypting data in transit, defining clear rules on what may or may not be entrusted to AI, and designing flows so that the most sensitive information is never sent to the model are measures that sharply reduce risk, whatever the level chosen.

A few principles apply to every deployment level:

These measures are not a matter of advanced technical skill, but of method. A well-governed AI can be safer than uncontrolled office-software use, whereas an AI deployed without rules can, on the contrary, become an exit door for your most valuable information.