EU AI Act Switzerland: role first, then duties

Does the EU AI Act apply to Swiss companies?

Most Swiss companies are covered only as deployers and therefore owe almost nothing. Covered at all is whoever offers an AI system in the EU or uses AI whose output is used there. One single point gets expensive: whoever supplies a tool under its own name becomes a provider under Art. 50 and owes the transparency duties directly.

In brief

• Settle your role first, everything else hangs on it. Whoever merely uses AI has little to do under Art. 50.
• Sell a tool under your own name, and you slip into the provider role, even where the underlying technology comes from someone else.
• Two duties fall on you as a deployer too, and both are almost never mentioned: disclosure for emotion recognition, and your people’s AI literacy.
• Use AI to assess job applications or creditworthiness, and it counts as high-risk, at which point the work becomes substantial.
• Whether being “accessible from the EU” already suffices, or “used there” is required, remains unresolved. Whoever sits close to that line should not decide it alone.

For a company without a high-risk application, everything hangs on the threshold question: provider, or merely deployer? What follows says what that turns on, which duties attach to which role, and which date in December you had better know.

This article deepens a section of the regulatory map. Every reference has been checked against the operative text in the EU’s Official Journal; analysis that goes beyond that is marked as such. Souverana is not a law firm; where an assessment moves money or liability, legal advice belongs alongside it.

This is the last part of our series on law and regulation: after Swiss law, the view turns to the European one, and to whom it actually reaches here.

When you are covered at all

The EU AI Act?EU AI ActThe European Union's AI regulation, in force since August 2024 and applicable in stages. It is a product-safety law: it sorts AI applications by risk and is aimed above all at those who bring AI to the EU market. attaches to two things: offering a system on the EU market, and the use of its output in the EU. The second criterion concerns Swiss companies, and it is broader than most expect. Art. 2(1)(c) of the operative text simply requires that the output “is used in the Union”; that this use must be intentional appears only in Recital 22.

Where the line to mere accessibility runs is unresolved, and the operative text is broader than the recital. In practice, companies fall back on the targeting criteria from consumer and data-protection law: prices in euros, customers in the EU, content in their language. These are a working yardstick, not an element of the offence.

Conversely, where the compute runs↗Sovereign AI · Part 1What sovereign AI actually means for Swiss companiesIf you sell discretion, you have a problem the moment a client asks where the data goes. Sovereignty is the answer, and it is not a product but a dial.Read article triggers nothing on its own. The AI Act attaches to offering on the market and to the use of the output, not to where a server stands.

Provider or deployer: where the role tips

The four standard cases are already sorted in the regulatory map. What is interesting are the cases in between, where the role hangs on a single detail.

What you do	Provider	Deployer
Third party’s chatbot embedded, supplied under that party’s name	no	yes
Same chatbot, supplied under your brand	yes	yes
Only sent prompts to a third-party service	no	yes
Own application built around a third-party model, under your own name	yes	yes
Model fine-tuned and supplied under your own name	yes	yes
General-purpose tool applied to a high-risk task	yes, high-risk	yes
Avatar videos from a US service, used only for training in Switzerland	no	yes

Two routes lead into the provider role. Under Art. 3(3), a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Under Art. 25(1), whoever puts its name on an already available high-risk system, substantially modifies one, or changes the intended purpose of an ordinary system so that it becomes a high-risk system, also slips into the role. For an ordinary chatbot, a modification on its own therefore triggers nothing.

For high-risk systems, the parties involved can allocate the duties differently by contract: Art. 25(1)(a) applies expressly without prejudice to such agreements. Whoever supplies a high-risk system under its own brand can therefore leave the provider duties with the manufacturer. That belongs in the procurement contract.

The most expensive row is the one with the high-risk task. Whoever applies a general-purpose tool to a task on the high-risk list, for instance screening job applications, thereby becomes a provider of a high-risk system?High-risk AI systemA category of applications exhaustively listed in the EU AI Act, such as AI for candidate screening, creditworthiness checks or critical infrastructure. Whoever offers such a system carries extensive obligations; whoever merely uses one carries markedly fewer. itself. These duties take effect from 2 December 2027.

What you owe as a provider

The bot discloses itself. Under Art. 50(1), the provider must design the system so that a person learns they are talking to a machine. Whoever embeds a third party’s chatbot under that party’s name is a mere deployer and does not owe the disclosure under the AI Act. The duty becomes relevant once you have the assistant built for you↗Sovereign AI · Part 4Sovereign AI platform: why it binds more than the modelThe model is easy to swap. The platform holds your chats, files and knowledge, and that is what binds you longest. How to choose platform, host and operations separately, and sovereignly.Read article and put it into service under your own name.

The exception applies where the AI use is obvious anyway to a reasonably informed, observant and circumspect person, judged by the circumstances and context of use. An assistant that visibly presents itself as such is covered by it. It gets critical once a bot carries a human name. In that overall assessment, that is a strong argument against obviousness, though it is not named in the operative text.

AI content gets marked. Text, audio, image and video that an AI has generated or altered must be marked machine-readably by the provider under Art. 50(2), for instance through a watermark or metadata. This marking does not need to be visible to people. A caption therefore does not satisfy it.

Two carve-outs ease this considerably in practice:

• This duty, too, falls on the provider of the system. Whoever uses a bought-in tool does not need to watermark it themselves.
• It does not apply “to the extent” that the system either performs a supporting function for standard editing, or does not substantially alter the input data or its semantics. These are two alternative elements, and they apply proportionately. The operative text names no examples; for translation services, for instance, the classification is contested.

What you owe as a deployer

Whoever merely uses AI has little to do under Art. 50. Four points remain, and the last one is not in Art. 50 at all:

• Deepfakes. Whoever generates or alters image, audio or video material that could pass as authentic must disclose under Art. 50(4) that the content was artificially generated or altered. For artistic, satirical or fictional works, a notice that does not disrupt enjoyment of the work suffices.
• Text on matters of public interest. Whoever publishes text to inform the public on matters of public interest must disclose the artificial generation. The exception applies only where two things coincide. First, a human has reviewed the text or exercised editorial control over it; either suffices. Second, a person bears editorial responsibility for the publication.
• Emotion recognition and biometric categorisation. Under Art. 50(3), you must inform the people affected that such a system is in use. This covers, for instance, sentiment analysis in a call centre or video analysis in a hiring process.
• AI literacy. Since 2 February 2025, Art. 4 has required providers and deployers alike to take measures that promote their people’s AI literacy. The AI Omnibus has softened the duty: no one owes a specific level of competence.

For an ordinary company blog, the disclosure duty for text usually does not apply at all; product and technical posts rarely fall under it. Where a post does move in that direction, the exception applies as soon as a human has reviewed it and someone bears editorial responsibility.

The deadline that runs out in December

The AI Omnibus postponed the heavy high-risk duties, but not the transparency duties. For older systems, it additionally inserted a transitional period that affects more companies in practice than the two new prohibitions taking effect on the same day.

The heavy high-risk duties take effect later: on 2 December 2027 for the applications in Annex III, on 2 August 2028 for AI in products already subject to EU law today, for instance machinery or medical devices.

The legal basis for the deadlines in this section is Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, in force since 27 July 2026.

How to get started

1. 01

   Clarify the EU link

   Prices in euros, customers in the EU, content in their language? Then assume you fall within scope.

2. 02

   Go through customer touchpoints

   Chatbot, voice assistant, automated replies: does a person immediately recognise that a machine is answering?

3. 03

   Record the roles

   For each AI function, note whether you are a provider, a deployer, or both, and what that turns on: your own name or trademark, and for high-risk cases, also the modification and the intended purpose.

4. 04

   Enter three dates

   2 December 2026 for your own older systems with generated content, 2 December 2027 for high-risk under Annex III, 2 August 2028 for AI in products already regulated elsewhere.

That completes the series: from the Swiss regulatory map, through the revFADP, professional secrecy and governance, to the EU AI Act.

Does your company fall under the EU AI Act? Two questions settle the answer.

Many Swiss companies expect duties that do not even apply to them. Covered is whoever offers an AI system on the EU market, or whose AI output is used in the EU. Whoever uses AI exclusively for Swiss purposes as a rule falls outside it, and where your servers stand triggers nothing on its own.

If the EU link exists, the second question decides: do you supply the tool under your own name or trademark? If not, you are a deployer and owe almost nothing under Art. 50. If yes, you are a provider, and both transparency duties fall on you directly: the bot discloses that it is a machine, and AI content carries a machine-readable marking.

Our conclusion: settle the role first, everything else hangs on it. One date belongs on the calendar: older systems that generate synthetic content must retrofit the labelling by 2 December 2026.

Analysis, not legal advice. The article carries the borderline cases as a table, ready-made wording for the transparency notice, and a one-page assessment sheet per AI function. Link in the comments.

#EUAIAct #AI #Switzerland #Compliance