The three sets of rules watching your AI — and the shortest answer there is.
Every time an AI tool touches client data, three regulatory frameworks ask the same question: where does this data go, who sees it, who is accountable? With cloud AI, the answer is a dossier; with a machine in the office, it is often one line: it does not leave this room. This page explains why — in practical terms, not lawyer-speak.
Swiss FADP (nLPD) — the Swiss data protection act
The revised FADP has been in force since 1 September 2023 and applies to anyone processing personal data in Switzerland: transparency about the processing, minimisation, adequate security, and precise rules whenever data is disclosed abroad — the destination country must offer adequate safeguards, or specific contractual clauses are required. This is exactly the point cloud AI makes complicated: uploading a file to a service with servers outside Switzerland is a disclosure abroad, to be recorded and justified. With AG Core the processing stays physically in your office: the "transfers abroad" entry in your register stays empty, and the register itself is written in an afternoon.
GDPR — when it reaches a Swiss firm too
The European regulation also applies to Swiss organisations when they process data of people in the Union — one Ticino client with a company in Milan is enough. Here too the practical knot is transfers and sub-processors: every cloud service in the chain must be mapped, put under contract and supervised. An on-premise machine shortens the chain to zero links: no sub-processor for AI inference, no transfer to document for that processing.
AI Act — the European newcomer
The European regulation on artificial intelligence entered into force in 2024 and applies in stages: the obligations for general-purpose models started in August 2025 and most provisions have applied since August 2026. For a Swiss SME it matters when its services reach the EU market — and in any case it sets the direction: transparency about when a machine decides, human oversight, traceability. Our systems are born that way: the AI prepares and proposes, the person decides — a rule written into the software, and the processing logs stay on your machine, open to inspection whenever needed.
Compliance is not something you buy: it is something you simplify. Less data in transit, fewer links in the chain, fewer questions to answer.
This page is informational and does not replace legal advice. For the assessment of your specific case, your adviser remains the voice that counts — we bring the machine that makes the answers easy for them.