> Source: https://souverana.ch/insights/eu-ai-act-schweiz-en/ > Language: en # EU AI Act Switzerland: role first, then duties Most Swiss companies owe the EU AI Act almost nothing. The provider role gets expensive, that is, whoever ships an AI tool under its own name. Whoever lands in it usually notices too late. Guide · Published 4 Aug 2026 · Updated 21 Oct 2026 · Joel Barmettler ## Does the EU AI Act apply to Swiss companies? **Most Swiss companies owe the EU AI Act, the European AI regulation, almost nothing. It gets expensive for providers, that is, for anyone who ships an AI tool under their own name: they must meet the two transparency duties in Art. 50 themselves. The regulation applies only where there is a link to the EU market.** **In brief** - Whoever ships an AI tool under its own name or trademark becomes a provider and carries the duties directly. Whoever embeds a third party’s chatbot under that party’s name remains a deployer and owes almost nothing. - As a provider, you must ensure two things under Art. 50: your chatbot discloses that it is AI, and AI-generated content carries a marking that machines can read. - Deployers also have two duties that are rarely mentioned: disclosure when using emotion recognition, meaning AI that infers feelings from data such as voice or face, and the AI literacy of employees. - Assessing job applications or creditworthiness with AI counts as a high-risk application. The AI Act sets its strictest duties for these, and the effort rises sharply. Whoever uses a general tool for this can become a provider themselves (Art. 25). - It remains unresolved whether the AI Act applies as soon as your offer can be accessed from the EU, or only where the output is used there. Whoever sits close to that line should have the question reviewed by a lawyer. This article examines one section of our [regulatory map](https://souverana.ch/en/insights/ki-regulierung-schweiz/), the overview of the rules for AI in Switzerland, in more depth. Every reference to an article of the Act has been checked against the operative text in the EU’s Official Journal.[1] Any analysis that goes beyond that is marked as such. Souverana is not a law firm. Where an assessment affects money or liability, legal advice belongs alongside it. This is the last part of our series on law and regulation. After Swiss law comes European law, and the question of whom it actually reaches in Switzerland. **Series · Law & Regulation** 1. [AI regulation in Switzerland: what already applies](https://souverana.ch/en/insights/ki-regulierung-schweiz/) 2. [revFADP and AI: what the law actually requires](https://souverana.ch/en/insights/revdsg-ki/) 3. [Professional secrecy and AI: what may go to the cloud](https://souverana.ch/en/insights/berufsgeheimnis-cloud/) 4. [AI governance: one page is enough to start](https://souverana.ch/en/insights/ki-governance/) 5. EU AI Act Switzerland: role first, then duties (this part) 6. [Shadow AI in the workplace: what reduces it](https://souverana.ch/en/insights/schatten-ki/) ## When you are covered at all The EU AI Act turns on two things: offering a system on the EU market, and the use of its output in the EU. The second criterion reaches Swiss companies, and it extends further than most expect. Art. 2(1)(c) of the operative text merely requires that the output of the AI system “is used in the Union”.[1] That this use must be intentional appears only in Recital 22. Where the line to mere accessibility falls is unresolved, and the operative text reaches further than the recital. In practice, companies rely on the criteria from consumer and data-protection law that show whether an offer is directed at a country: prices in euros, customers in the EU, content in their language. These serve as a rule of thumb and carry no weight as a statutory element. Conversely, [where the compute runs](https://souverana.ch/en/insights/was-ist-souveraene-ki/) triggers nothing on its own. Whether a server is located in Switzerland or in the EU is irrelevant for the AI Act. ## Provider or deployer: where the role tips A deployer is whoever uses an AI system under its own responsibility. The four standard cases are already classified in the regulatory map. The interesting ones are the cases in between, where the role hangs on a single detail. | What you do | Provider | Deployer | | --- | --- | --- | | Third-party chatbot embedded, supplied under that party’s name | no | yes | | Same chatbot, supplied under your brand | yes | yes | | Only prompts sent to a third-party service | no | yes | | Own application built around a third-party model, under your own name | yes | yes | | Model fine-tuned and supplied under your own name | yes | yes | | General-purpose tool applied to a high-risk task | yes, high-risk | yes | | Avatar videos from a US service, used only for training in Switzerland | no | yes | Two routes lead into the provider role. Under Art. 3(3), a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Under Art. 25(1), a provider is also whoever puts its name on an already available **high-risk** system, substantially modifies one, or changes the intended purpose of an ordinary system so that it becomes high-risk. For an ordinary chatbot that is not a high-risk system, a modification therefore does not make you a provider.[1] For high-risk systems, the parties involved can allocate the duties differently by contract. Art. 25(1)(a) applies expressly without prejudice to such agreements.[1] Whoever supplies a high-risk system under its own brand can therefore leave the provider duties with the manufacturer. That belongs in the procurement contract. The most expensive row is the one with the high-risk task. Whoever uses a general-purpose tool for a task on the high-risk list, for instance screening job applications, thereby becomes the provider of a high-risk system itself. These duties apply from 2 December 2027.[1, 2] ## What you owe as a provider **The bot discloses itself.** Under Art. 50(1), the **provider** must design the system so that a person learns they are talking to a machine. Whoever embeds a third party’s chatbot under that party’s name is a mere deployer and does not owe the disclosure under the AI Act.[1] The duty becomes relevant once you [have the assistant built for you](https://souverana.ch/en/insights/souveraene-ki-plattform/) and put it into service under your own name. The exception to this duty applies where the AI use is obvious anyway to a reasonably informed, observant and circumspect person, judged by the circumstances and context of use.[1] An assistant that visibly presents itself as such needs no additional notice. It becomes critical once a bot has a human name. On balance, a human name weighs heavily against obviousness, even though the operative text does not mention it. **AI content gets marked.** Text, audio, image and video that an AI has generated or altered must be marked machine-readably by the provider under Art. 50(2), for instance through a watermark or metadata.[1] This marking does not need to be visible to people. A caption therefore does not satisfy the duty. Two carve-outs reduce the effort in everyday practice: - This duty, too, falls on the **provider** of the system. Whoever uses a bought-in tool does not need to watermark it themselves. - The duty does not apply “to the extent” that the system either performs a **supporting function for standard editing**, **or** does not substantially alter the input data or its semantics. These are two alternative elements, and they exempt only to the extent that they apply. The operative text names no examples.[1] For translation services, for instance, the classification is contested. ## What you owe as a deployer Whoever merely uses AI has little to do under Art. 50. Four duties remain, and the last one is not in Art. 50 at all: - **Deepfakes.** Whoever generates or alters image, audio or video material that could pass as authentic must disclose under Art. 50(4) that the content was artificially generated or altered. For artistic, satirical or fictional works, a notice that does not disrupt enjoyment of the work suffices.[1] - **Text on matters of public interest.** Whoever publishes text to inform the public on matters of public interest must disclose the artificial generation. The exception applies only where two things coincide. First, a human has reviewed the text or exercised editorial control over it; either suffices. Second, a person bears editorial responsibility for the publication.[1] - **Emotion recognition and biometric categorisation.** Under Art. 50(3), you must inform the people affected that such a system is in use. This covers, for instance, sentiment analysis in a call centre or video analysis in a hiring process.[1] - **AI literacy.** Since 2 February 2025, Art. 4 has required providers and deployers alike to take measures to promote the AI literacy of their own employees. The AI Omnibus, the amending regulation to the AI Act, has softened the duty.[1, 2] No one owes a specific level of competence. For an ordinary company blog, the disclosure duty for text usually does not apply, because product and technical posts rarely fall under it. If a post does move in that direction, disclosure is not required as soon as a human has reviewed it and someone bears editorial responsibility. ## The deadline that runs out in December The AI Omnibus postponed the heavy high-risk duties, but not the transparency duties. For older systems, it additionally inserted a transitional period that affects more companies in practice than the two new prohibitions taking effect on the same day.[2] > **Risk** > > Under Art. 111(4), whoever offers a system that generates synthetic content and was placed on the market before 2 August 2026 must retrofit the labelling by 2 December 2026.[1, 2] The provision names only the placing on the market. A purely internally operated system that is merely put into service therefore falls outside its wording. The provision is new and has no commentary yet. If you might fall under it, clarify that before the deadline. The heavy high-risk duties take effect later: on 2 December 2027 for the applications in Annex III, on 2 August 2028 for AI in products already subject to EU law today, for instance machinery or medical devices.[1, 2] The legal basis for the deadlines in this section is Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, in force since 27 July 2026.[1, 2] ## How to get started Four steps clarify whether and how the AI Act affects you. 1. **Clarify the EU link**: Prices in euros, customers in the EU, content in their language? Then assume that the AI Act applies to you. 2. **Go through customer touchpoints**: Chatbot, voice assistant, automated replies: does a person immediately recognise that a machine is answering? 3. **Record the roles**: For each AI function, note whether you are a provider, a deployer, or both, and what the role depends on: your own name or trademark and, for high-risk cases, also any modification and the intended purpose. 4. **Enter three dates**: 2 December 2026 for your own older systems with generated content, 2 December 2027 for high-risk systems under Annex III, 2 August 2028 for AI in products already regulated elsewhere. Want to know which of your AI functions fall under the AI Act, and which role you carry there? [AI Governance](https://souverana.ch/en/leistungen/ki-governance/) ## Sources [1] Europäische Union. «Verordnung (EU) 2024/1689 (EU AI Act)». Amtsblatt der Europäischen Union. Primärquelle, Verordnungstext. The author Joel Barmettler AI Architect · Souverana, Zurich Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations. [Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7) ## Frequently asked questions Does the EU AI Act apply to Swiss companies? Only with a link to the EU market. Covered is whoever offers an AI system in the EU or puts one into service there, and whoever uses AI whose output is used in the EU. Whether the use must be intentional is stated only in Recital 22, the interpretive aid to the regulation, not in its text. Where the line to mere accessibility falls is unresolved. Must chatbots be labelled as AI? Yes, wherever the AI Act applies. Under Art. 50(1), the duty falls on the provider, meaning whoever ships the chatbot under its own name. Whoever embeds a third party's chatbot under that party's name is only a deployer and does not owe the disclosure. The disclosure can fall away where the AI use is obvious anyway to a reasonably well-informed person. What does machine-readable marking mean? The provider, meaning the company that places an AI system on the market under its own name, must mark AI-generated or AI-altered content so that machines can read the marking, for instance through a watermark or metadata. It does not need to be visible to people. When does a company become a provider under the AI Act? A provider is whoever develops an AI system, or has one developed, and places it on the market under its own name or trademark (Art. 3(3)). For high-risk systems, the strictly regulated applications such as assessing job applications, whoever ships a third party's system under its own name, substantially modifies it, or repurposes it for a high-risk use also becomes one (Art. 25). Merely embedding someone else's tool is not enough. What happens on 2 December 2026? A transitional period ends for providers on 2 December 2026. Systems that generate synthetic content and were placed on the market before 2 August 2026 must meet the labelling duty by that day. On the same day, two prohibitions take effect that the AI Omnibus, the latest amendment to the AI Act, inserted: AI systems for non-consensual intimate material and for depictions of child sexual abuse. Do I need to label AI-written blog posts? For an ordinary company blog, that is usually not necessary. The disclosure duty applies to AI-generated text that informs the public on matters of public interest. Where a post does move in that direction, disclosure is not required if a human has reviewed it and someone bears editorial responsibility for it. ## Glossary - **EU AI Act**: The European Union's AI regulation, in force since August 2024 and applicable in stages. It is a product-safety law: it sorts AI applications by risk and is aimed above all at those who bring AI to the EU market. - **Prompt**: The input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. - **High-risk AI system**: A category of applications exhaustively listed in the EU AI Act, such as AI for candidate screening, creditworthiness checks or critical infrastructure. Whoever offers such a system carries extensive obligations; whoever merely uses one carries markedly fewer.