On 25 September 2026, the Federal Council instructed the DDPS to draft, by June 2027, a federal cybersecurity law to be submitted for consultation.
A decision that I consider significant in Switzerland’s path towards integrated digital security governance.
The future law will bring together three areas:
- cyber resilience of software and hardware products;
- protection of the most important digital data;
- cybersecurity obligations for cloud and hosting service providers.
The new framework will also incorporate the obligation to report cyberattacks on critical infrastructure, already in force since April 2025.
What is the relationship with European legislation?
NIS2 strengthens risk management and incident reporting for entities falling within its scope. The Cyber Resilience Act (CRA), on the other hand, concerns the security of products with digital elements.
Switzerland is pursuing its own legislative path. However, with regard to product security, the Federal Council expressly refers to the EU Cyber Resilience Act as a benchmark, with the aim of limiting the regulatory burden on businesses.
What should companies operating across Italy, the European Union and Switzerland do?
It is becoming increasingly useful to coordinate risk management, supplier security and incident response, while verifying the specific obligations applicable in each legal system.
We are still in the drafting phase: the new law has not been approved, and the mandate in itself does not introduce new obligations for businesses.
With regard to the processing of personal data, the cybersecurity framework will need to be coordinated with the Federal Act on Data Protection (FADP) and, for cantonal and municipal public bodies, with the respective cantonal data protection laws (LPDP).
The guidance issued by the FDPIC on data and information security will also need to be taken into account.
The new cybersecurity legislation will not replace these obligations, but will complement them in terms of risk management, technical and organisational measures, and incident response.
Organisations will therefore need to develop integrated governance across data protection, information security and cybersecurity.
