The European AI Act: what changes for businesses

The AI Act is the world’s first comprehensive regulatory framework on artificial intelligence. It is a European Union regulation, so it is not Swiss law — but it would be a mistake to conclude that it does not concern companies in Switzerland. As happened with the GDPR, its reach is extraterritorial, and for anyone who develops, integrates or sells AI solutions into the European market it becomes a concrete point of reference. Let’s look at what it introduces, who it affects and how best to prepare.

The underlying logic: risk, not technology

The AI Act does not regulate artificial intelligence in the abstract. It adopts a risk-based approach: the more an AI system can affect people’s rights and safety, the stricter the obligations. The same technology can therefore fall into different categories depending on how and where it is used.

There are four categories:

• Unacceptable risk: prohibited practices. These include uses such as generalised social scoring or harmful behavioural manipulation.
• High risk: systems that are allowed but subject to heavy obligations. They concern sensitive areas such as recruitment, credit, medical devices and critical infrastructure.
• Limited risk: obligations mainly relating to transparency. For example, informing users that they are interacting with an AI system or that a piece of content is artificially generated.
• Minimal risk: the vast majority of common applications, with no specific obligations.

For an SME the operational question is not “do I use AI?” but “which category does the use I make of it fall into?”.

Who is affected

The regulation distinguishes between roles, and this matters because the obligations change. The two main ones:

• Provider: anyone who develops an AI system or places it on the market under their own brand. They have the most extensive obligations.
• Professional user (deployer): anyone who uses an AI system in their own activity. They have more limited but real obligations, especially for high-risk systems.

The key point for those in Switzerland: the AI Act also applies to entities established outside the EU when the system’s output is used in the Union, or when a system is placed on the European market. A Swiss company that sells software with AI components to clients in the EU, or that integrates AI into a product intended for that market, falls within its scope.

General-purpose AI systems

The regulation sets out specific rules for general-purpose AI models (foundation models, the ones on which many applications are built). It provides for transparency and documentation obligations on those who develop them, with reinforced requirements for the most powerful models considered to pose a systemic risk. For the SME that uses these models through third-party services, the practical effect is indirect but useful: more information available about the system it is integrating.

Timelines: a staggered entry into force

The AI Act does not apply all at once. Its entry into force is staggered over time: the bans on unacceptable-risk practices come first, while the obligations for high-risk systems arrive later. This gradual approach gives businesses time to adapt, but it is not an invitation to postpone: mapping your own uses of AI takes time, and it is best to start early.

And Switzerland?

Switzerland does not (yet) have an equivalent of the AI Act. This does not mean a regulatory vacuum: the use of AI remains subject to existing law, in particular the new Data Protection Act (nFADP) when personal data is processed, as well as the general rules on liability and contracts. For Swiss companies operating towards the EU, the AI Act nonetheless becomes a de facto reference standard, exactly as happened with data protection.

How to prepare, in practice

There is no need to react with anxiety, what is needed is method. Some concrete steps:

1. Take an inventory: where you already use AI, in which processes, with which data.
2. Classify the risk: check whether any use falls into high-risk or sensitive categories (e.g. HR, client assessment).
3. Ensure transparency: where you interact with clients through AI or generate automatic content, provide clear information.
4. Safeguard the data: make sure that the use of AI complies with the nFADP and with the contracts with your providers.
5. Check the chain: if you buy solutions with AI embedded, ask your providers how they manage compliance.

SIH ONE is an AI-native fiduciary group: we know AI from the point of view of those who use it in their own processes and of those who have to frame it in a compliant way. We help you understand whether and how the AI Act affects your business and to set up your uses of AI in line with Swiss data protection law.

Want to understand what changes for your business? Let’s talk with our legal desk.