Generative AI at Work: What the FADP Requires When Staff Use ChatGPT or Claude

By Thomas Contin, Managing Partner

In October 2026 the FDPIC and the Federal Office for Cybersecurity ran a joint campaign on the risks of generative AI in the workplace. The message is simple: entering personal data into a tool such as ChatGPT, Claude or Copilot is processing of personal data, and the Federal Act on Data Protection (FADP) applies to it in full.

The FDPIC had already stated that the FADP applies directly to processing carried out with AI. Switzerland has chosen not to adopt a separate AI law for now, so the existing rules on data protection are the framework that matters.

Where the risk lies

The problem is rarely the tool itself. It is the employee who pastes a client contract, a patient letter or an HR file into a chat window to get a summary. Depending on the plan and settings, the provider may store the content, process it abroad or use it to improve its models. The data leave the company without anyone having decided it.

What the FADP requires

Each processing must have a recognisable purpose and be proportionate (Art. 6 FADP). The provider of the tool is a processor and needs a contract that meets Art. 9 FADP. If the data go to a country without adequate protection, safeguards such as standard contractual clauses are needed (Art. 16 FADP). Clients and employees must be informed (Art. 19 FADP), and a processing likely to result in a high risk calls for a data protection impact assessment (Art. 22 FADP).

Professional secrecy adds a further layer: lawyers, doctors, fiduciaries and banks remain bound by it whatever tool they use.

A workable policy

Decide which tools are allowed, on which plan and with which settings: business plans that exclude training on your data are a minimum. Define which categories of data may never be entered, such as health data, client identities or secrets protected by law. Prefer anonymised or pseudonymised inputs.

Assess each provider as you would any other: where the data are processed, for how long they are kept, who can access them and what the contract says. Train staff with concrete examples and record the policy in writing.

Conclusion

Generative AI can save time in almost every office, but it needs the same discipline as any other outsourcing. Advisorn drafts AI usage policies, reviews providers' contracts and data processing terms, and carries out impact assessments where required.