> Source: https://souverana.ch/insights/berufsgeheimnis-cloud-en/
> Language: en

# Professional secrecy and AI: what may go to the cloud

'That does not work for us' is often the answer to AI in law firms and medical practices. The criminal-law article on professional secrecy (Art. 321 of the Swiss Criminal Code) is drawn more narrowly, and most of daily work falls outside it entirely.

Guide · Published 4 Aug 2026 · Updated 21 Oct 2026 · Joel Barmettler

## May holders of professional secrecy use AI?

**Yes. Holders of professional secrecy such as lawyers and doctors may use AI: Art. 321 of the Swiss Criminal Code prohibits disclosing an entrusted secret and names no tools. Secret data needs two further steps: a check on foreign authorities’ access to the provider, and stricter contract clauses. The person entitled to the secret can also consent.**

**In brief**

-   Sort your organisation’s data before you decide on tools. The larger part of daily work contains no entrusted secrets, such as general legal questions, specialist knowledge or templates with no case connection. A blanket ban locks down that data as well.
-   [A data centre in Frankfurt](https://souverana.ch/en/insights/souveraene-ki-infrastruktur/) does not exempt you from checking whether authorities of another country can access the data. This check applies to every foreign country; only the result differs by jurisdiction.
-   Pass the duty of confidentiality on by contract to every service provider that processes your data, such as a cloud provider. It is legally unsettled whether external service providers count as the professional’s own staff.
-   Authorities too are bound by official secrecy under Art. 320 of the Swiss Criminal Code. The public prosecutor pursues violations ex officio, meaning even without a report from the affected person.
-   The duty of confidentiality continues after the end of the mandate, the office or the professional activity, even years later.

Anyone managing client, patient or official data hears the same sentence whenever AI comes up: “That does not work here.” Art. 321 of the Swiss Criminal Code, the criminal-law article on professional secrecy, is drawn more narrowly than that sentence. Whoever discloses an entrusted secret commits an offence. Whether a language model was involved is not something the law addresses.[1]

Art. 9 of the revised Federal Act on Data Protection (revFADP) permits handing personal data to a service provider only as long as no duty of secrecy stands in the way.[2] That is exactly where our [revFADP guide](https://souverana.ch/en/insights/revdsg-ki/) ends, and this is where we continue. Every statutory reference has been checked against the original text. Souverana is not a law firm; where secret data is involved, legal advice is part of the process.

This is the third part of our Law & Regulation series; it covers the sharpest boundary Swiss law draws around AI use.

**Series · Law & Regulation**

1.  [AI regulation in Switzerland: what already applies](https://souverana.ch/en/insights/ki-regulierung-schweiz/)
2.  [revFADP and AI: what the law actually requires](https://souverana.ch/en/insights/revdsg-ki/)
3.  Professional secrecy and AI: what may go to the cloud (this part)
4.  [AI governance: one page is enough to start](https://souverana.ch/en/insights/ki-governance/)
5.  [EU AI Act Switzerland: role first, then duties](https://souverana.ch/en/insights/eu-ai-act-schweiz/)
6.  [Shadow AI in the workplace: what reduces it](https://souverana.ch/en/insights/schatten-ki/)

## Who is on the list

Art. 321 of the Swiss Criminal Code names the professions individually: clergy, lawyers, defence counsel, notaries, patent attorneys, auditors bound to confidentiality, doctors, dentists, chiropractors, pharmacists, midwives, psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths.[1] The law also expressly names their auxiliary persons and students, and Art. 321bis covers research on human beings. Whoever falls under none of these does not come under Art. 321, but may be bound to confidentiality in other ways. Fiduciary mandates, for instance, are protected through contract and trade secrecy. In addition, Art. 62 revFADP puts the intentional disclosure of secret personal data from someone’s professional activity under a fine of up to CHF 250,000.[2]

The law covers the auxiliary person in the same way as the doctor herself. Practice staff count as such, and with a cloud service, so do the provider’s employees, as long as they can see the data in plaintext. Official secrecy under Art. 320 applies to authorities, and banking secrecy under the Banking Act applies to banks.[1]

> **up to 3 years** Custodial sentence for violating professional or official secrecy, or alternatively a monetary penalty. For comparison: the revFADP only threatens fines.
> 
> Source: Art. 320 and 321 of the Swiss Criminal Code

## What counts as a secret at all

The question of what a secret is decides which data needs special treatment. This question is rarely asked. The law protects what was entrusted to the professional because of their profession, or what they perceived in the course of practising it.[1] The statute itself does not define the term secret. Legal doctrine tests two things: whether the information is generally known, and whether the person entitled to it, such as the client or the patient, wants it kept secret.

This yields a classification that every law firm and every practice can carry out itself:

| Protected | Not protected |
| --- | --- |
| The client’s identity, and already the fact that a mandate exists | The abstract legal question with no connection to a case |
| The facts of the matter, the diagnosis, the file note, the findings | Specialist knowledge, statutory texts, published case law |
| Correspondence bearing names, file references or recognisable details | Templates and boilerplate text with no case connection, website copy |
| Appointments and invoices, to the extent they identify a person | Internal processes with no personal connection |

In most organisations, the right-hand column is the larger part of daily work. The ordinary rules apply to it: the revFADP and the contract with the provider. Only the left-hand column needs additional steps, namely the assessment of authority access and extended contract clauses.

That is why a blanket ban is expensive. It locks down the right-hand column as well, even though no entrusted secrets sit there.

## The path the law itself names

Under Art. 321(2), disclosing the secret with the consent of the person entitled to it, such as the client or the patient, is not an offence. Nor is it an offence for someone who, at their own request, has received written authorisation from the superior authority or the supervisory authority. For official secrecy, the superior authority’s written consent is enough.[1] Consent removes only the liability to punishment under Art. 321, and only this one. The obligations under the revFADP and the assessment of foreign-authority access remain in place.

> **Risk**
> 
> The law prescribes no particular form for the consent of the person entitled to it. Legal doctrine nonetheless requires informed consent tied to the specific processing, and does not regard a blanket clause in the general terms and conditions as sufficient. Have the wording reviewed before it is included in the engagement letter or the patient information.

## What the contract additionally needs

For the left-hand column, the two additional steps from our overview article on [AI regulation in Switzerland](https://souverana.ch/en/insights/ki-regulierung-schweiz/) apply. Both deserve a closer look.

First, the assessment of foreign-authority access, known as FLARA (Foreign Lawful Access Risk Assessment). The methodology commonly used in Switzerland comes from David Rosenthal and is published free of charge as an open spreadsheet by the Zurich law firm VISCHER.[3] It asks how likely access actually is and sets aside what is merely theoretically conceivable. The result is a dated assessment you can present to a supervisory authority or in the event of a liability claim. The best-known example is the US CLOUD Act. Disclosure obligations, however, exist in every jurisdiction where a provider or its parent company is based.

Second, plaintext access. An ordinary Data Processing Agreement covers personal data; it does not regulate secrets. [The most important addendum](https://souverana.ch/en/insights/google-gemini-datenschutz/) governs who at the provider may see plaintext at all: only those who strictly need the data for their task (need-to-know) and only with your prior approval. Even without approval, the provider may see plaintext in two cases: documented emergency operation and a valid order from an authority. The same obligations must apply to sub-processors.

> **Evidence**
> 
> The effort is manageable. The law firm VISCHER itself falls under Art. 321 and states that it has met the additional requirements for itself and can use AI in daily work with all its data. It published this in Part 27 of its AI series in April 2025.[4]

## How to get started

1.  **Clarify whether you are covered**: Do you fall under Art. 320, under Art. 321, or under neither? The eighteen professions are named individually; their auxiliary persons and students are covered by law as well, and Art. 321bis covers research on human beings.
2.  **Make two piles**: Sort your types of data using the table above into data with an entrusted secret (left-hand column) and without (right-hand column). The right-hand pile, usually the larger one, needs no special treatment.
3.  **Check for consent**: For the left-hand column, check whether your engagement letter or patient information contains consent that is informed and tied to the specific processing.
4.  **Check the provider**: Request one FLARA per provider with a foreign connection, plus the plaintext-access clause. Anyone who will not sign the clause is out of the running for the left-hand column.

You carry a professional or official secrecy duty and want to know which architecture meets that duty?

[AI architecture & solution selection](https://souverana.ch/en/leistungen/ki-architektur/)

The remaining parts of the series cover the wider context: the map of the rules, the revFADP, AI governance and the EU AI Act.

## Sources

[1] Schweizerischer Bundesrat. «Bundesratsbeschluss zur Datenübermittlung in die USA (Angemessenheitsbeschluss)». Schweizerischer Bundesrat. 14 August 2024. Primärquelle, nur im FAQ-Frontmatter genannt.

[2] VISCHER. «KI-Serie, Teil 27». VISCHER. April 2025. Herstellerangabe, Kanzleipublikation.

The author

Joel Barmettler

AI Architect · Souverana, Zurich

Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations.

[Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7)

## Frequently asked questions

May lawyers and doctors use AI tools?

Yes. Art. 321 of the Swiss Criminal Code prohibits disclosing an entrusted secret and says nothing about tools. For data that contains a secret, you need to check whether foreign authorities can gain access to the provider, and add further contract clauses. For all other data in day-to-day law firm or practice work, the ordinary rules apply.

Who falls under professional secrecy under Art. 321?

The law lists eighteen professions by name, among them clergy, lawyers, defence counsel, notaries, patent attorneys, auditors, doctors, dentists, pharmacists, midwives, psychologists, nurses and physiotherapists. Their auxiliary persons are expressly covered as well. Authorities and officials fall under official secrecy under Art. 320 of the Swiss Criminal Code.

Does professional secrecy also apply to fiduciaries?

Not under Art. 321, which names only auditors bound to confidentiality under the Code of Obligations. A criminally backed duty exists nonetheless: Art. 62 of the Federal Act on Data Protection (revFADP) fines intentional disclosure of secret personal data from professional activity up to CHF 250,000, on complaint, even after the activity ends. Contract and trade secrecy add protection.

What counts as a secret within the meaning of Art. 321?

Covered is whatever was entrusted to the professional because of their profession, or whatever they perceived in the course of practising it. This already includes the mere fact that someone is a client or a patient at all. Generally accessible knowledge and questions unconnected to a case are not covered.

Has the US adequacy decision softened professional secrecy?

No. The Federal Council's decision of 14 August 2024, in force since 15 September 2024, governs data transfers to the US under data protection law. Professional and official secrecy sit in the Swiss Criminal Code and remain untouched. The assessment of foreign-authority access is still needed, for every country where a provider or its parent company is based.

## Glossary

-   **Professional and official secrecy**: The criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act.
-   **revFADP (revDSG)**: Switzerland's revised Federal Act on Data Protection, in force since 1 September 2023. It governs how companies may process personal data, and applies to AI use exactly as it does to any other processing.
-   **Personal data**: Any information relating to an identified or identifiable person, so customer records, HR files or even an email address. As soon as such data is involved, the revFADP applies.
-   **Auxiliary person**: Someone who supports a secrecy holder in their professional work, such as practice staff or an IT provider with access to case data. Art. 321 of the Swiss Criminal Code expressly covers auxiliary persons too.
-   **FLARA**: Foreign Lawful Access Risk Assessment: an assessment of how likely a foreign authority could access data held with a provider. No law prescribes a procedure for it, but it has become the standard step before professional and official secrecy holders move to a foreign cloud.
-   **US CLOUD Act**: A 2018 US law: American providers must hand over data under their control regardless of where in the world the servers stand. It also reaches the European data centres of US corporations.
-   **Data Processing Agreement (DPA)**: The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law.
-   **Processor**: A service provider that processes personal data on behalf of, and under the instructions of, the controller, such as a cloud or AI provider. Art. 9 of the revFADP ties the handover to conditions.
-   **EU AI Act**: The European Union's AI regulation, in force since August 2024 and applicable in stages. It is a product-safety law: it sorts AI applications by risk and is aimed above all at those who bring AI to the EU market.