On 16 October 2026, as part of Cyber Security Month, the FDPIC and NCSC published practical FAQs and recommendations on the use of generative AI in the workplace.
In Switzerland, even in the absence of a Swiss “AI Act”, the FADP fully applies to the processing of personal data through AI tools.
The authorities highlight several key points:
- Avoid entering personal data unless necessary;
- Avoid entering confidential information in prompts;
- Prioritise the use of authorised corporate tools;
- Review providers’ contractual terms and conditions;
- Ensure that staff receive adequate training.
For Swiss organisations, these recommendations provide practical guidance for strengthening internal AI governance, including policies, data classification, provider assessments, AI literacy, and FADP/DPIA assessments.
This is not a new law, but rather a set of authoritative, practical recommendations that deserve immediate attention.
