EU AI Act after the Digital Omnibus: what Swiss companies must do, and by when

What changed, and what did not

The Omnibus is a targeted amendment of the AI Act, Regulation (EU) 2024/1689. Most of the regulation stays as it was. These are the dates that matter now:

The postponement buys time for the high-risk requirements, nothing else. Transparency duties already apply: if your system talks to people, generates synthetic content or recognises emotions, the disclosure rules of Article 50 are in force today.

Why Swiss companies are affected

Switzerland is not in the EU, but the AI Act reaches across the border. Under Article 2 it applies to:

• providers that place AI systems on the EU market or put them into service in the EU, wherever they are established;
• providers and deployers established outside the EU, where the output of the AI system is used in the EU.

A Swiss software company that sells to EU customers, or whose scoring results are used by an EU client, is therefore within scope.

Switzerland itself has no AI-specific law yet. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI convention and to regulate AI mainly through targeted changes in existing sectoral law. The Federal Department of Justice and Police is to present a consultation draft by the end of 2026. For companies selling into the EU, the AI Act will remain the stricter benchmark.

Is your system high-risk?

There are two routes into the high-risk category:

1. Annex I: the AI system is a safety component of a product, or is itself a product, covered by EU product legislation such as the rules on machinery, medical devices or toys.
2. Annex III: the system is used in one of the listed areas: biometrics; critical infrastructure; education and vocational training; employment and the management of workers; access to essential private and public services, such as credit scoring, risk pricing in life and health insurance, or eligibility for public benefits; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes.

Article 6(3) exempts Annex III systems that do not pose a significant risk, for example when they only perform a narrow procedural task or improve the result of a human activity already completed. The exemption never applies when the system profiles natural persons, and the provider has to document the assessment before placing the system on the market.

Your role matters as much as the system. Providers, who develop a system and place it on the market under their name, carry most of the obligations. Deployers, who use a system in their own activity, have their own duties under Article 26, and some public bodies and service providers must carry out a fundamental-rights impact assessment under Article 27.

What high-risk providers need in place

• a risk management system across the whole life cycle (Article 9);
• data governance for training, validation and test data (Article 10);
• technical documentation following Annex IV (Article 11);
• automatic logging of events (Article 12);
• instructions and transparency for deployers (Article 13);
• human oversight designed into the system (Article 14);
• accuracy, robustness and cybersecurity (Article 15);
• a quality management system (Article 17);
• conformity assessment, EU declaration of conformity, CE marking and registration (Articles 43, 47, 48 and 49);
• post-market monitoring (Article 72).

None of this is a document you write at the end. Logging, oversight and data governance are design decisions, which is why a late start costs more than the documentation itself.

A 14-month plan to December 2027

1. By the end of 2026: inventory and classification. List every AI system and general-purpose model you build or use, your role for each, and its risk class. Check the Article 50 transparency duties now, because they already apply.
2. First quarter of 2027: gap assessment. Compare each high-risk system with Articles 9 to 17, estimate the effort and appoint owners.
3. Second and third quarters of 2027: build. Risk management, data governance, logging, human oversight and the quality management system, followed by the Annex IV documentation.
4. Fourth quarter of 2027: prove it. Run a dry run of the conformity assessment, prepare the declaration of conformity and registration, and set up post-market monitoring.

Companies with AI in regulated products have until August 2028, but their conformity assessment usually runs through a notified body under sectoral law. That timetable tends to be longer than it looks.

What it costs to get it wrong

Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other obligations, including the high-risk requirements. For SMEs and, since the Omnibus, small mid-caps, the lower of the two amounts applies. In practice, the commercial risk comes sooner: EU customers are already asking about AI Act conformity in tenders.

If you are not sure whether the AI Act applies to you, an applicability and gap assessment answers that in three to four weeks.