Since 2 August 2026 a further part of the EU Artificial Intelligence Act has applied, and a few days earlier the EU postponed part of its own timetable. For Swiss companies this has created a situation that looks contradictory at first glance: the major high-risk obligations arrive later than planned, while the transparency obligations are now binding. Anyone using AI tools in day-to-day operations, or selling services into the EU, should know where matters stand — even without a Swiss AI act of its own.
What has been binding since 2 August 2026
The transparency obligations under Article 50 of the AI Act have taken effect. They do not concern specialist developers but the everyday use of generative systems:
- Systems that interact directly with people must disclose that they are machines — the chatbot on your own website falls under this.
- AI-generated content — text, image, audio, video — must be marked in a machine-readable form.
- Deepfakes and AI-generated texts on matters of public interest require visible labelling.
- Anyone using emotion recognition or biometric categorisation must inform the people affected.
For systems already in use before 2 August 2026, the deadline for machine-readable labelling runs until 2 December 2026. Two new prohibitions in Article 5 also take effect on that date, covering AI systems used to generate non-consensual intimate material and depictions of child sexual abuse.
What the Digital Omnibus has postponed
Regulation (EU) 2026/1744, known as the Digital Omnibus, entered into force on 27 July 2026. It pushes the obligations for high-risk systems back substantially: stand-alone high-risk systems under Annex III move from the original August 2026 to 2 December 2027, and systems embedded in regulated products under Annex I to 2 August 2028. This affects, among others, AI in recruitment, in lending and in educational assessment — precisely the fields many organisations have been preparing for since 2024.
The penalty framework is unchanged: up to 15 million euros or 3 per cent of worldwide annual turnover as a rule, and up to 35 million euros or 7 per cent for the prohibited practices in Article 5. For small and medium-sized enterprises the lower of the two figures applies.
The postponement is not a free pass. It buys additional time for documentation and risk management — the transparency and competence obligations continue regardless.
Why the EU regulation concerns Swiss companies
The AI Act attaches not to where a company is based but to the market in which an AI system, or its output, is used. A Swiss business falls within scope if it offers AI-supported products or services in the EU, or if the output of a system is used there. In practice: anyone pre-screening job applications for a German client, supplying an AI-supported application to an EU group, or forming part of a supply chain with EU end customers should clarify their own role. Providers and deployers have different obligations, and many companies are both at once.
And in Switzerland?
There is no comprehensive Swiss AI act. On 12 February 2025 the Federal Council decided against adopting the EU model and in favour of a sectoral approach: the Council of Europe Framework Convention on AI — signed by Switzerland on 27 March 2025 — is to be transposed into Swiss law, with targeted adjustments in the areas of transparency, data protection, non-discrimination and supervision. A consultation draft is expected by the end of 2026; ratification is still outstanding.
Until then the situation is not unregulated, merely dispersed: the revised Data Protection Act applies to every processing of personal data by AI systems, alongside employment law, copyright, contract law and sector-specific requirements. Anyone pointing an AI assistant at customer data today is therefore already operating in a regulated field — just without the label «AI act».
The obligation that has been running for eighteen months
The least noticed and most easily met requirement is Article 4 of the AI Act: AI literacy. It has applied since 2 February 2025 and requires providers and deployers to take measures ensuring that their staff, and others involved in operating the systems, have sufficient skills, knowledge and an understanding of the opportunities and risks. According to the law firm Flick Gocke Schaumburg, the Digital Omnibus softened the wording from «ensure» to «promote»; a guaranteed level of competence for individual people was never required in any case.
What counts is being able to demonstrate it. Organisations that arrange training, document attendance and put internal rules in writing meet this point with manageable effort — and gain, as a by-product, what most of them are looking for anyway: less uncontrolled growth in the use of tools.
Steps for the coming months
- Draw up an inventory. Which AI tools are in use, in which department, with which data? Built-in features of existing software belong here too, not only stand-alone assistants.
- Determine your role. Provider or deployer — and is there an EU connection at all? Without this classification no obligation can sensibly be assigned.
- Implement transparency. Label chatbots, mark AI-generated content, and put the 2 December 2026 deadline for legacy systems in the calendar.
- Build and document competence. Training for users, in-depth training for managers and IT — with attendance lists and dates.
- Think data protection through. Check which personal data flows into which systems, and whether permissions and classification hold up.
- Write internal rules. A two-page usage policy naming permitted tools, prohibited data categories and approval duties achieves more than a framework nobody reads.
The time gained through the Digital Omnibus is real, but it applies only at the high-risk level. The tasks that are due now — inventory, transparency, competence, data protection — are the same ones a company needs in order to use AI in a controlled way, EU connection or not.
Relevant CT Academy courses
For the management perspective — fields of application, risks and regulation in a single day — KI für Führungskräfte: Einsatzfelder, Risiken, Regulierung is the right starting point. Organisations introducing Microsoft 365 Copilot that want permissions, data protection and governance set up properly will find the approach in Copilot einführen: Governance, Datenschutz und Berechtigungen. For the user side, that is building competence across the workforce, Prompting, das funktioniert is the practical entry point. And anyone responsible for the technical protection of information in Microsoft 365 — classification, sensitivity labels, data loss prevention and the protection of data in AI services — will find it in SC-401 Administering Information Security in Microsoft 365. The courses are held in German.
