Professional secrecy and AI: what may go to the cloud
'That does not work for us' is often the answer to AI in law firms and medical practices. The criminal-law article on professional secrecy (Art. 321 of the Swiss Criminal Code) is drawn more narrowly, and most of daily work falls outside it entirely.
Guide · Published 4 Aug 2026 · Updated 1 Oct 2026 · Joel Barmettler
May holders of professional secrecy use AI?
Yes. Holders of professional secrecy such as lawyers and doctors may use AI: Art. 321 of the Swiss Criminal Code, the criminal provision on professional secrecy, prohibits disclosing an entrusted secret and names no tools. Only for data that contains a secret do two further steps apply: a check on whether foreign authorities can gain access to the provider, and stricter contract clauses. The person entitled to the secret can also consent.
In brief
- Sort your organisation’s data before you decide on tools. The larger part of daily work contains no entrusted secrets, such as general legal questions, specialist knowledge or templates with no case connection. A blanket ban locks down that data as well.
- A data centre in Frankfurt does not exempt you from assessing authority access, that is, checking whether authorities of another country can access the data. This check applies to every foreign country; only the result differs by jurisdiction.
- Pass the duty of confidentiality on by contract to every service provider that processes your data, such as a cloud provider. Whether external service providers legally count as auxiliary persons, meaning staff whom the law treats like the professional, is not settled.
- Authorities are bound by official secrecy under Art. 320 of the Swiss Criminal Code. Violations are prosecuted ex officio by the public prosecutor, meaning even without a report from the affected person.
- The duty of confidentiality continues after the end of the mandate, the office or the professional activity, even years later.
Anyone managing client, patient or official data hears the same sentence whenever AI comes up: “That does not work here.” Art. 321 of the Swiss Criminal Code, the criminal-law article on professional secrecy, is drawn more narrowly than that sentence. Whoever discloses an entrusted secret commits an offence. Whether a language model was involved is not something the law addresses.
Art. 9 of the revised Federal Act on Data Protection (revFADP) permits handing personal data to a service provider only as long as no duty of secrecy stands in the way. That is exactly where our revFADP guide ends, and this is where we continue. Every statutory reference has been checked against the original text. Souverana is not a law firm; where secret data is involved, legal advice is part of the process.
This is the third part of our Law & Regulation series; it covers the sharpest boundary Swiss law draws around AI use.
Who is on the list
Art. 321 of the Swiss Criminal Code names the professions individually: clergy, lawyers, defence counsel, notaries, patent attorneys, auditors bound to confidentiality, doctors, dentists, chiropractors, pharmacists, midwives, psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths. The law also expressly names their auxiliary persons and students, and Art. 321bis covers research on human beings. Whoever falls under none of these does not come under Art. 321, but may be bound to confidentiality in other ways. Fiduciary mandates, for instance, are protected through contract and trade secrecy, and Art. 62 revFADP puts the intentional disclosure of secret personal data from someone’s professional activity under a fine of up to CHF 250,000.
The law covers the auxiliary person the same way it covers the doctor herself. Practice staff count as such, and with a cloud service, so do the provider’s employees, as long as they can see the data in plaintext. Official secrecy under Art. 320 applies to authorities, and banking secrecy under the Banking Act applies to banks.
Key figure
up to 3 yearsSource: Art. 320 and 321 of the Swiss Criminal Code
What counts as a secret at all
The question of what a secret is decides which data needs special treatment. It is rarely asked. The law protects what was entrusted to the professional because of their profession, or what they perceived in the course of practising it. The statute itself does not define the term secret. Legal doctrine tests two things: whether the information is generally known, and whether the person entitled to it, such as the client or the patient, wants it kept secret.
This gives a classification that every law firm and every practice can carry out itself:
| Protected | Not protected |
|---|---|
| The client’s identity, and already the fact that a mandate exists | The abstract legal question with no connection to a case |
| The facts of the matter, the diagnosis, the file note, the findings | Specialist knowledge, statutory texts, published case law |
| Correspondence bearing names, file references or recognisable details | Templates and boilerplate text with no case connection, website copy |
| Appointments and invoices, to the extent they identify a person | Internal processes with no personal connection |
In most organisations, the right-hand column is the larger part of daily work. The ordinary rules apply to it: the revFADP and the contract with the provider. Only the left-hand column needs additional steps, namely the assessment of authority access and extended contract clauses.
That is why a blanket ban is expensive. It locks down the right-hand column as well, even though no entrusted secrets sit there.
The path the law itself names
Under Art. 321(2), disclosing the secret with the consent of the person entitled to it, such as the client or the patient, is not an offence. Nor is it an offence for someone who, at their own request, has received written authorisation from the superior authority or the supervisory authority. For official secrecy, the superior authority’s written consent is enough. Consent removes only the liability to punishment under Art. 321, and only this one. The obligations under the revFADP and the assessment of foreign-authority access remain in place.
What the contract additionally needs
For the left-hand column, the two additional steps from our overview article on AI regulation in Switzerland apply. Both are worth going into in more depth.
First, the assessment of foreign-authority access, FLARA (Foreign Lawful Access Risk Assessment) for short. The methodology commonly used in Switzerland comes from David Rosenthal and is published free of charge as an open spreadsheet by the Zurich law firm VISCHER. It asks how likely access actually is, and leaves the merely theoretically conceivable aside. The result is a dated assessment you can present to a supervisory authority or in the event of a liability claim. The best known example is the US CLOUD Act. But disclosure obligations exist in every jurisdiction where a provider or its parent company is based.
Second, plaintext access. An ordinary Data Processing Agreement covers personal data; it does not regulate secrets. The most important addendum governs who at the provider may see plaintext at all: only those who strictly need the data for their task (need-to-know) and only with your prior approval. Even without approval, the provider may see plaintext in two cases: documented emergency operation and a valid order from an authority. The same obligations must apply to sub-processors.
How to get started
- 01
Clarify whether you are covered
Do you fall under Art. 320, under Art. 321, or under neither? The eighteen professions are named individually; their auxiliary persons and students are covered by force of law as well, and Art. 321bis covers research on human beings.
- 02
Make two piles
Sort your types of data using the table above into data with an entrusted secret (left-hand column) and without (right-hand column). The right-hand pile, usually the larger one, needs no special treatment.
- 03
Check for consent
For the left-hand column, check whether your engagement letter or patient information contains consent that is informed and tied to the specific processing.
- 04
Check the provider
Request one FLARA per provider with a foreign connection, plus the plaintext-access clause. Anyone who will not sign the clause is out of the running for the left-hand column.
The remaining parts of the series map out the surrounding terrain: the map of the rules, the revFADP, AI governance and the EU AI Act.
Frequently asked questions
- May lawyers and doctors use AI tools?
- Yes. Art. 321 of the Swiss Criminal Code prohibits disclosing an entrusted secret and says nothing about tools. For data that contains a secret, you need to check whether foreign authorities can gain access to the provider, and add further contract clauses. For all other data in day-to-day law firm or practice work, the ordinary rules apply.
- Who falls under professional secrecy under Art. 321?
- The law lists eighteen professions by name, among them clergy, lawyers, defence counsel, notaries, patent attorneys, auditors, doctors, dentists, pharmacists, midwives, psychologists, nurses and physiotherapists. Their auxiliary persons are expressly covered as well. Authorities and officials fall under official secrecy under Art. 320 of the Swiss Criminal Code.
- Does professional secrecy also apply to fiduciaries?
- Not under Art. 321, which names only auditors bound to confidentiality under the Code of Obligations. A criminally backed duty exists nonetheless: Art. 62 of the Federal Act on Data Protection (revFADP) fines intentional disclosure of secret personal data from professional activity up to CHF 250,000, on complaint, even after the activity ends. Contract and trade secrecy add protection.
- What counts as a secret within the meaning of Art. 321?
- Covered is whatever was entrusted to the professional because of their profession, or whatever they perceived in the course of practising it. This already includes the mere fact that someone is a client or a patient at all. Generally accessible knowledge and questions unconnected to a case are not covered.
- Has the US adequacy decision softened professional secrecy?
- No. The Federal Council's decision of 14 August 2024, in force since 15 September 2024, governs data transfers to the US under data protection law. Professional and official secrecy sit in the Swiss Criminal Code and remain untouched. The assessment of foreign-authority access is still needed, for every country where a provider or its parent company is based.
Share this article
Ready-formatted graphics and a suggested post for your LinkedIn feed: download, copy, post.
Suggested post
Do you run a law firm, a medical practice or a fiduciary office, and is the standard answer to AI there "that does not work for us"? Art. 321 of the Swiss Criminal Code, the criminal-law article on professional secrecy, is drawn more narrowly. It names eighteen professions and makes disclosing an entrusted secret an offence, with up to three years in prison. It says nothing about tools. What matters is therefore how you sort the data. The case itself is protected: the client's identity, the diagnosis, correspondence with a file reference. The abstract legal question, specialist knowledge, published case law and templates with no case connection are not secrets. In most organisations, that is the larger part of daily work. For protected data, the law itself names a path: the consent of the person entitled to it. On top come a check on whether foreign authorities can gain access to the provider, and contract clauses that govern its access to plaintext. Our conclusion: a blanket ban also locks down the data that contains no secret and pushes the work onto private accounts. Whoever sorts can clear the larger part for use right away. Assessment, not legal advice. The article carries the sorting table, two organisations worked through in full and four questions a provider must answer. Link in the comments. #ProfessionalSecrecy #AI #Switzerland #DataProtection