Regulation (EU) 2024/1689 ("AI Act") does not apply only to companies established in the EU. Swiss companies can be directly covered, for example if they place AI systems on the EU market or if the results (output) of a system are used in the EU.
Since 27 July 2026, the AI Act applies in the version amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744). This has postponed several deadlines and adjusted individual obligations. This page gives Swiss exporters and SMEs with EU ties an initial overview.
Territorial scope of application (Art. 2)
Under Art. 2(1), the Regulation applies, among others, to:
- providers (Anbieter) that place AI systems or general-purpose AI (GPAI) models on the market in the EU or put AI systems into service there, regardless of where they are established;
- operators (Betreiber) of AI systems that are established in the EU or located there;
- providers and operators from third countries such as Switzerland, where the output generated by the AI system (KI-System) is used in the EU;
- importers and distributors, product manufacturers, authorized representatives of providers without an EU establishment, and affected persons in the EU.
For Swiss companies, two connecting factors are particularly relevant:
- Market access: You offer an AI system or a GPAI model in the EU or put it into service there.
- Use of the output in the EU: The system runs in Switzerland, but its results, such as predictions, content, recommendations, or decisions, are used in the EU.
Those who use AI only in Switzerland and do not deliver any results into the EU generally do not fall under the AI Act. However, the boundary is not always clear, for example in the case of customers or subsidiaries in the EU, and should be examined on a case-by-case basis.
Risk-based approach
The AI Act distinguishes, among others, between:
- prohibited practices (Art. 5), such as social scoring or manipulative techniques. From 2 December 2026, AI systems that generate realistic intimate depictions of identifiable persons or depictions of child sexual abuse without consent will additionally be prohibited;
- high-risk AI systems with extensive obligations (including risk management, data quality, technical documentation, human oversight (menschliche Aufsicht));
- transparency obligations for certain systems (Art. 50), such as chatbots and AI-generated or manipulated content (deepfakes);
- rules for general-purpose AI (GPAI) models, with additional obligations in the case of systemic risk.
Which obligations apply depends on the classification of the system and on your role, not on where your company is established.
Timeline
The AI Act becomes applicable in stages. Following the Digital Omnibus on AI (published in the Official Journal of the EU on 24 July 2026, in force since 27 July 2026), the following timeline applies:
| From | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy (KI-Kompetenz) obligations (Art. 4) |
| 2 August 2025 | Rules for GPAI models, governance, and sanctions |
| 27 July 2026 | New version of Art. 4: providers and operators must take measures to promote the AI literacy of their staff, but need not guarantee a specific level of competence |
| 2 August 2026 | General applicability, including the transparency obligations under Art. 50 |
| 2 December 2026 | New prohibitions (see above); end of the transitional period for labelling AI-generated content for systems placed on the market before 2 August 2026 |
| 2 December 2027 | Obligations for standalone high-risk AI systems (Annex III) |
| 2 August 2028 | Obligations for high-risk AI systems embedded in products (Annex I) |
Only the point in time from which the high-risk obligations apply has been postponed, not the classification itself. Swiss providers with access to the EU market should therefore classify their systems now and plan implementation. For SMEs and small mid-cap companies, the Omnibus provides for relief, such as simplified technical documentation.
What Swiss exporters should check
- Is the system or its output offered or used in the EU?
- What role do you have: provider, operator, importer, or distributor?
- How is the system classified: prohibited, high-risk (Annex I or III), subject to transparency obligations, GPAI, or without specific obligations?
- Do you, as a provider without an EU establishment, need an authorized representative in the EU (e.g., for high-risk systems or GPAI models)?
- What deadlines apply to your product, and have documentation, quality management, and human oversight been planned for?
The AI Act and the Swiss Federal Act on Data Protection (Bundesgesetz über den Datenschutz, DSG) are separate sets of rules and can apply simultaneously (see nDSG and AI: Fundamentals). Before accessing the EU market, a case-by-case assessment is recommended: product, role, use of the output, and deadlines.