Insights · Data protection

A one-page AI policy for a small Swiss firm

Eight short sections, the Swiss data protection points behind each, and how to roll it out in a week. Adapt it freely.

By Jason Pemberton · Published 19 October 2026

A small firm's AI policy fits on one page: which tools are approved, what data may go into them, who checks the output, how clients are told, and who owns the rule. Swiss data protection law already applies to AI, so the policy is mostly a matter of writing down how the firm meets it.

I wrote the version below for firms of 5 to 100 people in professional services. It is a practical starting point, not legal advice; a law firm in particular should check it against its professional secrecy duties.

Why a small firm needs one now

According to AXA Switzerland, only a third of Swiss SMEs set clear rules for using AI, so in most firms staff choose the tools and decide what data to enter. AXA names that as the biggest risk: people not knowing which data they may put into a given tool. [2] For comparison, OECD data reported by Statista found that 45.4% of German SMEs using generative AI had introduced guidelines for staff, the highest share among the countries studied. [6]

No Swiss law requires a document called an AI policy. But the Federal Data Protection and Information Commissioner (FDPIC) has confirmed that the data protection act in force since 1 September 2023 applies directly to AI-supported processing. [1] A written rule is the simplest way to show how you meet it, and to make sure everyone in the firm does the same thing.

The policy

Copy this into a Word document, replace the brackets, and keep it to one page.

Purpose and scope. This rule covers every use of AI tools for [firm name] work, on any device, by partners, staff and contractors.
Approved tools. Only these tools may be used for firm work, and only with a firm work account: [for example Microsoft Copilot Chat with your work account; ChatGPT Business under the firm's contract]. Personal AI accounts must not be used for firm work.
What may go in. Public information and internal material without client names may be used in approved tools. Client and personal data may be used only in [named tools] and only as much as the task needs.
What must not go in. Particularly sensitive data (for example health information), passwords and access details, and [matters marked confidential] must not be entered into any AI tool unless [owner] has approved a specific workflow for it. If in doubt, leave it out and ask.
A person checks every output. AI drafts; people decide and send. Nothing produced with AI goes to a client, court, authority or counterparty without review by the responsible person. AI is not used to make decisions about individuals.
Transparency. Our privacy notice and engagement terms say that we use AI tools to support our work and how. If a client asks whether AI was used on their matter, we answer honestly. Any chatbot or automated reply says that it is automated.
New tools and workflows. Anyone may propose a tool. [Owner] approves it only after checking the contract (processing terms, confidentiality, no training on our data, data location and sub-processors) and adds it to our list of processors.
Owner, training and review. [Name] owns this rule, answers questions and reports problems to the partners. Everyone reads it on joining and once a year. It is reviewed every [six] months or when a tool changes. Last reviewed: [date].

The Swiss law behind each section

Section	Why it is there
2, 7: approved tools, contract check	An AI provider handling client data for you is a processor. The Act allows that only by contract, only for processing you could do yourself, not where a confidentiality duty forbids it, and only once you are satisfied the provider can guarantee data security; it may use sub-processors only with your approval. [3]
2: no personal accounts	OpenAI says individual Free, Plus and Pro plans may be used to train its models unless the user opts out, while ChatGPT Business, Enterprise and API data is not used for training by default. [4] Microsoft says Copilot Chat with a work account runs under its data protection terms as a processor, does not train foundation models on prompts and responses, and logs them in your own tenant for audit. [5]
5: human check, no decisions about individuals	The FDPIC points to the right to have automated individual decisions reviewed by a person, and to the need for an impact assessment where AI processing is high risk. Keeping a person in charge keeps a small firm well clear of both. [1]
6: transparency	The FDPIC expects the purpose, functioning and data sources of AI-based processing to be made transparent, and says people have a right to know whether they are dealing with a machine. [1]
8: owner and training	AXA's advice to Swiss SMEs: a specific AI policy, regular training and a provider and contract check before release. [2]

A note on German templates

Many AI policy templates in German come from Germany and Austria and are built on the GDPR and the EU AI Act. A good recent example sets out an eight-part one-page policy for DACH firms of 5 to 50 people, cites GDPR Article 28 for processors, and notes only that the Swiss revDSG may also apply. [7] The structure travels well. For a Swiss firm, base the processor and transparency points on the Swiss Act and the FDPIC's guidance instead, as above.

Rolling it out in a week

Day 1: ask everyone, without blame, which AI tools they already use for work.
Day 2: pick the approved tool and check its contract terms.
Day 3: fill in the template and agree it with the partners.
Day 4: a 30-minute team session: what is allowed, what is not, and why.
Day 5: add a line on AI to your privacy notice and engagement terms, and add the tool to your record of processing activities and list of processors.

If you are just starting, read how to start with AI without an IT department next. If you want the policy and the first workflow set up together, that is part of my AI Opportunity Audit. Sector detail: law firms, fiduciaries and accountants, insurance brokers, consultancies.

FAQ

Questions about an AI policy

Does a small Swiss firm need an AI policy?

No law requires a document with that name, but the Swiss data protection act applies directly to AI use. A one-page rule on approved tools, permitted data, human review and transparency is the simplest way to meet it consistently.

Should our AI policy ban ChatGPT?

Ban personal accounts for firm work, not AI itself. Approve one business tool under contract, such as Copilot Chat with a work account or a ChatGPT business plan, and say what data may go into it. Banning everything usually drives use out of sight.

What should an AI policy say about client data?

That client and personal data may only go into named, approved business tools, only as much as the task needs, that particularly sensitive data stays out unless a specific workflow is approved, and that a person reviews every output.

Is an AI provider a processor under the Swiss FADP?

Usually yes, when it processes personal data on your behalf. The Act then requires a contract, that no confidentiality duty forbids the transfer, that you are satisfied the provider can guarantee data security, and your approval for sub-processors.

Braucht ein KMU in der Schweiz eine KI-Richtlinie?

Gesetzlich vorgeschrieben ist sie nicht, aber das Datenschutzgesetz gilt laut EDÖB direkt auch für KI. Eine einseitige Richtlinie mit erlaubten Werkzeugen, erlaubten Daten, menschlicher Kontrolle und Transparenz gegenüber Kundinnen und Kunden ist der einfachste Weg, das einheitlich umzusetzen.

Sources

Want to know where AI could save your firm time?

Book a short call. We will identify the first two or three workflows worth automating. No deck, no jargon, no hard sell.

Book an AI opportunity call