EU AI Act Switzerland: role first, then duties

Does the EU AI Act apply to Swiss companies?

The EU AI Act, the European AI regulation, applies only with a link to the EU market. Most Swiss companies merely use AI, are therefore deployers, and owe almost nothing. The provider role gets expensive: whoever ships an AI tool under its own name must meet the two transparency duties in Art. 50 directly.

In brief

• A provider is whoever develops an AI system, or has one developed, and places it on the market under its own name or trademark. Whoever embeds a third party’s chatbot under that party’s name remains a deployer.
• The provider has two duties under Art. 50: a chatbot discloses that it is AI, and AI-generated content carries a machine-readable marking.
• Deployers also have two duties that are rarely mentioned: disclosure when using emotion recognition, meaning AI that infers feelings from data such as voice or face, and the AI literacy of employees.
• Using AI to assess job applications or creditworthiness counts as a high-risk application. The AI Act?EU AI ActThe European Union's AI regulation, in force since August 2024 and applicable in stages. It is a product-safety law: it sorts AI applications by risk and is aimed above all at those who bring AI to the EU market. sets its strictest duties for these, and the effort rises sharply. Anyone who uses a general tool for this can become a provider themselves (Art. 25).
• It remains unresolved whether it is enough for the AI Act to apply that your offer can be accessed from the EU, or whether the output must be used there. Whoever sits close to that line should have the question reviewed legally.

This article deepens a section of our regulatory map, the overview of the rules for AI in Switzerland. Every article reference has been checked against the operative text in the EU’s Official Journal. Any analysis that goes beyond that is marked as such. Souverana is not a law firm. Where an assessment affects money or liability, legal advice belongs alongside it.

This is the last part of our series on law and regulation. After Swiss law comes the European one, and the question of whom it actually reaches in Switzerland.

When you are covered at all

The EU AI Act turns on two things: offering a system on the EU market, and the use of its output in the EU. The second criterion reaches Swiss companies, and it extends further than most expect. Art. 2(1)(c) of the operative text merely requires that the output of the AI system “is used in the Union”. That this use must be intentional appears only in Recital 22.

Where the line to mere accessibility falls is unresolved, and the operative text reaches further than the recital. In practice, companies fall back on the criteria from consumer and data-protection law that show whether an offer is directed at a country: prices in euros, customers in the EU, content in their language. These are a rule of thumb that carries no weight as a statutory element.

Conversely, where the compute runs↗Sovereign AI · Part 1What sovereign AI actually means for Swiss companiesIf you sell discretion, you have a problem the moment a client asks where your data goes when you use AI. Sovereign AI answers that question, and the degree of control can be set like a dial.Read article triggers nothing on its own. Whether a server is located in Switzerland or in the EU is irrelevant for the AI Act.

Provider or deployer: where the role tips

A deployer is whoever uses an AI system under its own responsibility. The four standard cases are already classified in the regulatory map. The interesting ones are the cases in between, where the role hangs on a single detail.

What you do	Provider	Deployer
Third party’s chatbot embedded, supplied under that party’s name	no	yes
Same chatbot, supplied under your brand	yes	yes
Only sent prompts?PromptThe input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. to a third-party service	no	yes
Own application built around a third-party model, under your own name	yes	yes
Model fine-tuned and supplied under your own name	yes	yes
General-purpose tool applied to a high-risk task	yes, high-risk	yes
Avatar videos from a US service, used only for training in Switzerland	no	yes

Two routes lead into the provider role. Under Art. 3(3), a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Under Art. 25(1), a provider is also whoever puts its name on an already available high-risk system, substantially modifies one, or changes the intended purpose of an ordinary system so that it becomes high-risk. For an ordinary chatbot that is not a high-risk system, a modification therefore does not make you a provider.

For high-risk systems, the parties involved can allocate the duties differently by contract. Art. 25(1)(a) applies expressly without prejudice to such agreements. Whoever supplies a high-risk system under its own brand can therefore leave the provider duties with the manufacturer. That belongs in the procurement contract.

The most expensive row is the one with the high-risk task. Whoever uses a general-purpose tool for a task on the high-risk list, for instance screening job applications, thereby becomes the provider of a high-risk system?High-risk AI systemA category of applications exhaustively listed in the EU AI Act, such as AI for candidate screening, creditworthiness checks or critical infrastructure. Whoever offers such a system carries extensive obligations; whoever merely uses one carries markedly fewer. itself. These duties apply from 2 December 2027.

What you owe as a provider

The bot discloses itself. Under Art. 50(1), the provider must design the system so that a person learns they are talking to a machine. Whoever embeds a third party’s chatbot under that party’s name is a mere deployer and does not owe the disclosure under the AI Act. The duty becomes relevant once you have the assistant built for you↗Sovereign AI · Part 4Sovereign AI platform: why it binds more than the modelThe model is easy to swap. The platform, the software your team uses for AI every day, holds your chats, files and knowledge, and that is what binds you longest. How to choose it sovereignly.Read article and put it into service under your own name.

The exception to this duty applies where the AI use is obvious anyway to a reasonably informed, observant and circumspect person, judged by the circumstances and context of use. An assistant that visibly presents itself as such needs no additional notice. It becomes critical once a bot has a human name. Taken as a whole, that weighs heavily against obviousness, even though the operative text does not mention it.

AI content gets marked. Text, audio, image and video that an AI has generated or altered must be marked machine-readably by the provider under Art. 50(2), for instance through a watermark or metadata. This marking does not need to be visible to people. A caption therefore does not satisfy the duty.

Two carve-outs reduce the effort in everyday practice:

• This duty, too, falls on the provider of the system. Whoever uses a bought-in tool does not need to watermark it themselves.
• The duty does not apply “to the extent” that the system either performs a supporting function for standard editing, or does not substantially alter the input data or its semantics. These are two alternative elements, and they exempt only to the extent that they apply. The operative text names no examples. For translation services, for instance, the classification is contested.

What you owe as a deployer

Whoever merely uses AI has little to do under Art. 50. Four duties remain, and the last one is not in Art. 50 at all:

• Deepfakes. Whoever generates or alters image, audio or video material that could pass as authentic must disclose under Art. 50(4) that the content was artificially generated or altered. For artistic, satirical or fictional works, a notice that does not disrupt enjoyment of the work suffices.
• Text on matters of public interest. Whoever publishes text to inform the public on matters of public interest must disclose the artificial generation. The exception applies only where two things coincide. First, a human has reviewed the text or exercised editorial control over it; either suffices. Second, a person bears editorial responsibility for the publication.
• Emotion recognition and biometric categorisation. Under Art. 50(3), you must inform the people affected that such a system is in use. This covers, for instance, sentiment analysis in a call centre or video analysis in a hiring process.
• AI literacy. Since 2 February 2025, Art. 4 has required providers and deployers alike to take measures to promote the AI literacy of their own employees. The AI Omnibus, the amending regulation to the AI Act, has softened the duty. No one owes a specific level of competence.

For an ordinary company blog, the disclosure duty for text usually does not apply, because product and technical posts rarely fall under it. If a post does move in that direction, disclosure is not required as soon as a human has reviewed it and someone bears editorial responsibility.

The deadline that runs out in December

The AI Omnibus postponed the heavy high-risk duties, but not the transparency duties. For older systems, it additionally inserted a transitional period that affects more companies in practice than the two new prohibitions taking effect on the same day.

The heavy high-risk duties take effect later: on 2 December 2027 for the applications in Annex III, on 2 August 2028 for AI in products already subject to EU law today, for instance machinery or medical devices.

The legal basis for the deadlines in this section is Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, in force since 27 July 2026.

How to get started

Four steps clarify whether and how the AI Act affects you.

1. 01

   Clarify the EU link

   Prices in euros, customers in the EU, content in their language? Then assume that the AI Act applies to you.

2. 02

   Go through customer touchpoints

   Chatbot, voice assistant, automated replies: does a person immediately recognise that a machine is answering?

3. 03

   Record the roles

   For each AI function, note whether you are a provider, a deployer, or both, and what that turns on: your own name or trademark, and for high-risk cases, also the modification and the intended purpose.

4. 04

   Enter three dates

   2 December 2026 for your own older systems with generated content, 2 December 2027 for high-risk under Annex III, 2 August 2028 for AI in products already regulated elsewhere.

Does your company fall under the EU AI Act, the European AI regulation? Two questions settle the answer.

Many Swiss companies expect duties that do not even apply to them. Covered is whoever offers an AI system on the EU market, or whose AI output is used in the EU. As a rule, whoever uses AI exclusively for Swiss purposes falls outside it, and where your servers are located triggers nothing on its own.

If the EU link exists, the second question decides. Do you supply the tool under your own name or trademark? If not, you merely use AI, are a deployer, and owe almost nothing under Art. 50. If yes, you are a provider, and both transparency duties fall on you directly: the bot discloses that it is a machine, and AI content carries a machine-readable marking.

Our conclusion: settle the role first, everything else follows from it. One date belongs on the calendar. Older systems that generate synthetic content must retrofit the labelling by 2 December 2026.

Analysis, not legal advice. The article carries the borderline cases as a table, ready-made wording for the transparency notice, and a one-page assessment sheet per AI function. Link in the comments.

#EUAIAct #AI #Switzerland #Compliance