The enormous impact that AI is already having on various areas of our lives has prompted the European Union (EU) to implement a legal framework to regulate artificial intelligence more closely. There is a consensus in Brussels that it is essential to develop a clear and comprehensive strategy to harness the potential of AI while ensuring that any use of AI is in line with the EU’s ethical principles and fundamental values.

The AI Act was adopted in December 2023. There will now be a two-year implementation phase before the law is applied. During this transition phase, the EU Commission envisages voluntary compliance with the AI Act on the part of companies. The new rules will become final and legally binding in 2026 at the earliest.

The approved AI Act marks a significant milestone in the global regulation of artificial intelligence. It makes Europe the first continent to clearly regulate the use of AI. The proposed AI regulation aims to ensure that Europeans can trust what AI produces and guarantees that AI systems will not harm us humans. The existing fundamental rights and values of the Union should be safeguarded and the effective enforcement of applicable law strengthened.

But what does this mean for Switzerland and the FADP?
Overall, it is likely that the EU’s AI Act will also encourage the Swiss legislature to rethink and adapt its own regulations and strategies in the field of AI in order to facilitate cooperation with EU member states. However, the exact impact will depend on the specific agreements and implementation mechanisms negotiated between Switzerland and the EU.

One area that will be affected is trade and market regulation. The AI Act introduces new regulations and standards for AI applications. If Switzerland wants to maintain its intensive trade relations with the EU and sell AI services and products on the EU market, it will have to fulfil the requirements and provisions of the AI Act. Many Swiss companies that develop or offer AI technologies could therefore be affected in the future.

Data protection legislation will also be affected. The AI Act lays down rules for the exchange of data used for the operation of AI systems. If Switzerland wishes to exchange data with EU member states, the data protection and data security requirements of the AI Act may have to be met. This may have an impact on companies and organisations that work with data across borders.

The AI Act also creates uniform standards for the use of AI technologies. Switzerland could participate in these efforts and benefit from the joint development of standards and best practices. This would improve the interoperability of AI systems and promote the exchange of expertise and experience. In addition, the AI Act will probably have an international scope in general. It sets unique standards for dealing with AI and can serve as a model for other countries and regions. Switzerland, which is very advanced in terms of research and development of AI systems, can benefit from this global trend and strengthen its position as a centre of innovation.

In the middle of the year, the Social Democratic parliamentary group in Switzerland had already called on the Federal Council to lay the foundations for a law that is essentially similar to the AI Act or is as compatible as possible with it. In a statement, the Federal Council announced that it was closely monitoring the development of the AI Act and was basically pursuing a similar digitalisation policy to that of the EU. This also means that the aim is to create an AI Act that harmonises as well as possible with European legislation. Nevertheless, the final result in the EU must be awaited first. As this is now available, it can be assumed that the Swiss Federal Council will also soon take action.

In conclusion, it can be said that the EU’s AI Act will affect Switzerland in various areas, particularly with regard to trade, data exchange, cooperation and international standards. However, the exact impact will depend on the implementation and interpretation of the AI Act by Swiss policymakers, and it will be important to closely monitor developments in this area.

Source: German-Swiss Chamber of Commerce / Beat Singenberger

A company does not have much time to respond to data protection requests. If a former applicant wants to know whether their data has been stored, this must be answered “without delay”.

According to the DPA and GDPR, a request for information from an employer must be answered immediately, and in any case within one month. The Duisburg Labour Court ruled that this in no way means that the employer always has one month.

A service provider had advertised for a receivables management clerk. An applicant submitted his personal documents, but received a rejection. More than 6 years later, the applicant contacted the service provider again by email and requested information in accordance with the GDPR as to whether and what personal data was stored about him. He set the company a deadline of 30 days to respond.

The company did not respond until one day after the deadline set by the applicant had expired. The applicant therefore contacted the company again by email after the 30-day deadline had expired and reminded it of his concerns. The company then issued negative information to the former applicant, stating that it had not stored any of the applicant’s data.

The former applicant then asked the company to explain why it had not previously provided this information. The company replied that it had provided the information in due time with regard to Article 12 GDPR. The former applicant took a different view. In his opinion, the company had violated Article 12 GDPR by providing the information late. He demanded that the company pay monetary compensation in the amount of EUR 1,000. The company did not comply with this request, so the former applicant brought an action before the labour court and demanded payment of compensation in the amount of EUR 2,000 due to an alleged violation of the GDPR by the company.

The labour court awarded the former applicant compensation in the amount of EUR 750. According to Art. 12 para. 3 GDPR, the controller must provide the data subject with information without undue delay and in any case within one month of receipt of the request. The company had failed to fulfil this obligation by replying too late.

In Switzerland as well as in Germany and France, Microsoft 365 in particular is currently being criticised by data protection authorities. Last November, for example, the French Ministry of Education banned the use of the free Microsoft 365 offerings in schools on the grounds that they would violate the European General Data Protection Regulation (EU GDPR).

In Germany, however, the conference of the independent data protection supervisory authorities of the federal and state governments came to the conclusion that Microsoft 365 could not be considered compliant with data protection in principle. Microsoft, on the other hand, sees it differently: the data protection authorities would no longer pursue data protection in their criticism, but would elevate “data protection to a dogmatic end in itself”.

In Switzerland, meanwhile, the Zurich cantonal government caused a stir: In April 2022, the government council approved Microsoft 365 for the cantonal administration. Dominika Blonski, the data protection commissioner of the canton of Zurich, had signed off on the decision – but makes it clear: Despite this decision, the cantonal administration does not have a free pass to use Microsoft 365. Sensitive data must not be exposed to unlawful access by other authorities under any circumstances – and the Microsoft cloud cannot guarantee that, Blonski says in an interview. In general, the problem lies in the fact that Microsoft dominates the market for Office products, says the Zurich data protection commissioner, adding: “Switzerland also has to discuss how such dependencies can be broken as part of the discussions on digital sovereignty.”

However, SMEs should not only pay attention to the right settings, but also to the service contract with Microsoft. Furthermore, according to Korostylev, it is advisable for SMEs in particular to have a cloud exit strategy up their sleeve and to bear in mind that Microsoft intends to offer exclusively cloud-based delivery models from 2025.