The risks of AI in business, in Switzerland

AI-related risks in business are not monolithic. They fall into four distinct categories, each with its own causes, consequences, and mitigation levers. Understanding this map is the essential first step before any deployment.

Switzerland does not yet have specific AI legislation. The approach chosen is one of technological neutrality: existing laws apply. In practice, three legal frameworks directly govern AI use in business.

The new Federal Act on Data Protection (nLPD, in force since September 2023) applies directly to AI-based processing. It requires transparency about the purpose and sources of data, impact assessments where high risks are involved, and a right to human review of automated decisions (art. 21 nLPD). Penalties can reach 250,000 CHF and expose senior executives to personal liability.

The Code of Obligations (art. 41 CO) requires the user organization to compensate any damage caused by an AI system it operates. The company is liable, not the system. The Federal Product Liability Act may also apply if the AI is classified as a defective component.

The European AI Act, adopted in March 2024 and entering into force progressively until 2026, directly concerns Swiss companies that operate in the European market or whose AI systems are deployed in the EU. It classifies AI into four risk levels (unacceptable, high, limited, minimal) and imposes documentation, audit, and CE marking requirements for high-risk systems.

Generative AI produces statistically probable outputs, not necessarily accurate ones. The hallucination phenomenon, where the model generates false information presented with confidence, is documented across all major current models. In a professional context, this can lead to poorly drafted contracts, erroneous financial analyses, incorrect customer responses, or flawed medical decisions.

Operational dependency is a risk that is often underestimated. When a critical process relies entirely on an AI system from an external vendor, an outage, a change in terms of service, or a price increase can disrupt operations. Without a business continuity plan, the vulnerability is structural.

A model trained on historical data inherits the biases present in that data. In recruitment, credit granting, insurance pricing, or performance evaluation, a biased algorithm can lead to discriminatory decisions under Swiss and European law, even without any intent to harm.

The absence of human oversight over these decisions worsens the risk: the discrimination is not visible in the process, it only appears in the outcomes. In Switzerland, the nLPD requires that automated decisions with significant legal effects on an individual be subject to a right of human review.

Most consumer-grade AI tools (ChatGPT, Copilot, Gemini) process data on servers located in the United States. When an employee enters confidential information, customer data, trade secrets, or personal data into these tools, that data leaves the company's perimeter and potentially the Swiss and European jurisdiction.

Global computing power remains heavily concentrated in the United States, leaving Europe structurally dependent on American hyperscalers. This reality creates a sovereignty risk that Swiss companies, particularly in regulated sectors (finance, healthcare, insurance, public administration), can no longer ignore.

Where data is hosted is a security criterion, not merely a matter of preference. Alternatives exist, including open-source models hosted on European infrastructure, which allow sensitive data to be processed without transferring it outside the EU.

Many Swiss companies have adopted AI, but strategy often lags behind. Adoption without governance is itself a risk: use cases multiply in an uncoordinated way, responsibilities remain unclear, and no framework defines what data can be shared with which tools.

Vendor lock-in is a form of strategic dependency. When a company's processes rely on a proprietary AI tool, migrating to an alternative becomes costly, risky, and technically complex. Over time, the vendor gains market power that erodes the company's negotiating position.

The lack of internal expertise is one of the primary obstacles to structured adoption. SMEs generally cannot build an AI governance team on their own. External support, whether advisory, training, or technical services, is therefore a risk reduction factor, not a luxury.

Switzerland has opted for a technologically neutral approach: no single AI law, but application of existing sector-specific legislation. In practice, in 2025-2026, the following texts apply directly to AI use in business:

The FDPIC (Federal Data Protection and Information Commissioner) has confirmed that the nLPD applies directly to AI-based processing, without ambiguity. The authority is particularly monitoring cases of facial recognition, behavioral surveillance, and automated processing of sensitive data.

For companies exposed to the EU, the AI Act adds a regulatory layer. The first prohibitions (unacceptable risk level) came into force in February 2025. Obligations for high-risk systems are being phased in progressively until August 2026.

AI risk management does not require halting everything or starting from scratch. It calls for a structured approach, proportionate to the size and sector of the organization. Here are the priority steps identified by Swiss practitioners in the field.

For Swiss companies looking to deploy business AI tools, customer portals, internal software, or AI agents without transferring their data to American hyperscalers, Kleap offers an approach based on three principles.

First principle: European infrastructure. Deployments rely on Hetzner (Germany, ISO 27001 certified) and open-source models whose data does not leave the EU and is not reused to train third-party models.

Second principle: guided delivery. Kleap does not sell a tool; it delivers results through a team. Three paths are available: turnkey delivery via the Lionscreative partner agency, referral to a specialist provider, or Kleap Enterprise deployment in guided mode.

Third principle: traceability. The actions of deployed AI systems are auditable. Executives can document decisions to meet nLPD requirements and prepare for AI Act compliance.