nFADP & EU AI Act: AI Compliance Checklist

AI in Business: nFADP & EU AI Act Checklist

This checklist helps you review the use of AI in your Swiss business against the revised FADP (nFADP) and the EU AI Act in a structured way. Work through the points for each AI use case and document your decisions. It is an educational tool and does not replace legal advice – consult professionals when in doubt.

Progress: 0 / 30 done

1. Lawful basis & transparency

Document the purpose of each AI use case in writing

Clarify the lawful basis for processing (e.g. contract, consent, overriding interest)

Update the privacy notice to cover AI use (clear and current)

Inform data subjects about the purpose and scope of processing (Art. 19 nFADP)

Apply data minimisation: feed only the data that is truly necessary into AI tools

Add the AI use cases to your record of processing activities

2. Personal & sensitive data handling

Identify sensitive personal data (e.g. health, religion, biometrics)

Check whether prompts or uploads contain personal data of third parties

Put a data processing agreement (DPA) in place with AI providers

Clarify data location and any transfer abroad (adequate level of protection)

Define retention and deletion periods for AI inputs and outputs

Do not feed in sensitive personal data without an appropriate lawful basis

3. AI transparency & disclosure (EU AI Act Art. 50)

Disclose when users interact directly with an AI (e.g. a chatbot)

Mark AI-generated or AI-edited content as such (machine-readable where feasible)

Clearly disclose synthetic media and deepfakes

Check whether the EU AI Act applies to your offering (EU users, market access)

Roughly classify the risk category of the AI use case

Rule out prohibited practices (e.g. manipulative behaviour)

4. Security & breach process

Restrict access to AI tools on a role-based basis

Document appropriate technical and organisational measures

Establish a breach-reporting process (notify the FDPIC as soon as possible)

Name a responsible person and an internal reporting channel

Train staff on the safe use of AI

Define how to handle errors and hallucinations, and ensure human oversight

5. Documentation & responsibilities

Define responsibilities for AI governance

Check whether a data protection impact assessment (DPIA) is required (Art. 22 nFADP)

Store contracts, decisions and assessments in a central place

Schedule regular review and updates

Obtain and archive provider documentation (security, training data)

Plan a legal review by a professional before going into production

Frequently asked questions

Does the GDPR apply to my Swiss business?

Processing in Switzerland is governed by the revised FADP (nFADP). The EU GDPR may apply on top if you offer goods or services to people in the EU or monitor their behaviour. Clarify the scope with a professional.

Does the EU AI Act also apply to Swiss companies?

It can apply if your AI systems are used in the EU or their outputs are used there. Review your market access and user base; when in doubt, clarify the scope legally.

Does this checklist guarantee compliance?

No. It is an educational and orientation tool and does not replace legal advice. Your specific situation needs an individual assessment by qualified professionals.

Do I always have to label AI-generated content?

The EU AI Act (Art. 50) requires transparency for things like chatbots and synthetic media. Even without an EU nexus, labelling builds trust. Check which obligations actually apply to you.