Zurich Worked from Barcelona revFADP, not the GDPR Same hour as us

Zurich.
Swiss law, not GDPR.

Almost everything written about AI and European data protection assumes the GDPR, and in Switzerland that assumption is wrong. Switzerland is not in the EU and not in the EEA. The revised Federal Act on Data Protection governs, supervised by the FDPIC, and it differs from the GDPR in ways that change both the architecture and who is personally exposed if it goes wrong. This is the one page on this site where the legal regime, rather than the industry mix, is the reason it exists.

Last reviewed 5 September 2026 · Engineering guidance, not legal advice.

WHAT IS ACTUALLY DIFFERENT HERE

A different Act, with a familiar shape

The revised Federal Act on Data Protection has been in force since September 2023 and is supervised by the Federal Data Protection and Information Commissioner. It rhymes with the GDPR — privacy by design and by default, records of processing, impact assessments, transparency, a right of access — but it is not a copy. The revision narrowed the Act to the data of natural persons, breach notification runs on an as-soon-as-possible standard rather than a fixed seventy-two hour clock, and the duty to keep a register is scoped differently for smaller organisations. A design document written against GDPR article numbers is not wrong so much as addressed to the wrong reader.

Enforcement lands on people, not on the balance sheet

This is the difference that changes behaviour. Switzerland did not adopt the GDPR's corporate administrative fines. Instead the Act provides for criminal fines of up to CHF 250,000 against the responsible natural person for specified breaches, including failures of information and of due diligence in disclosing data abroad. The practical effect in a Zurich engagement is that the person signing off on the architecture has personal exposure, and reads the document accordingly. We find that produces better projects and much shorter meetings.

Two regimes at once, and two different adequacy lists

Most Zurich firms of any size are under both regimes: the revFADP because they are Swiss, and the GDPR for activity directed at the EU. The EU recognises Switzerland as providing adequate protection, so data moves from the EU without additional mechanisms. What people miss is that the reverse direction runs on Swiss rules — the Federal Council maintains its own list of states with adequate protection, and it is not automatically the EU's. A transfer that is unremarkable from Frankfurt can require a separate analysis from Zurich. Your counsel owns that assessment; our job is to design systems that do not create avoidable transfers in the first place.

FINMA and banking secrecy set the real constraint

For a bank, an insurer or an asset manager, data protection is the second constraint. The first is Article 47 of the Banking Act, which makes disclosure of client identifying data a criminal matter, and FINMA's expectations on outsourcing, which require the institution to retain oversight, audit rights and the ability to inspect what a provider does on its behalf. That combination is why so much Swiss work ends up inside the institution's own perimeter rather than on someone's endpoint. It is not conservatism. It is the sensible reading of a rule with a criminal sanction attached.

THE WORK THAT COMES OUT OF THIS CITY

The Swiss constraint has one enormous engineering consequence, and it is worth stating before the sector detail, because it decides most designs here.

In-country cloud capacity exists: at the time of writing there are hyperscale regions in Zurich from Google and Microsoft, while the largest provider by market share has no Swiss region at all, which quietly forces a platform decision on organisations that had assumed they had already made one. But regional capacity is not the same as model availability. The hosted frontier models are generally not offered from Swiss regions, so a project that must keep client identifying data inside Switzerland frequently cannot use them — not because of a policy objection, but because there is nowhere to send the request. The answer is usually a self-hosted open-weight model running on infrastructure the institution controls, which is a real trade: current open-weight models are behind the best hosted ones on the hardest reasoning tasks, and ahead on every question about where the data went. We would rather measure that gap on your documents than debate it in the abstract. The options are set out under on-premise AI and open-weight models.

Private banking and wealth management supply the majority of the document work: client files, onboarding and due diligence packs, suitability assessments, correspondence in three or four languages. The valuable system reads the file, assembles the evidence, cites where each fact came from and leaves the judgement with the relationship manager. It never leaves the bank.

Insurance and reinsurance bring claims and treaty documents at volume, with the same secrecy pressure in a milder form and a much greater tolerance for volume-driven automation.

Pharmaceutical and life sciences groups along the Zurich axis bring regulatory and research documentation, where traceability to source matters more than fluency; that work is described under life sciences research.

Commodities and trading firms, many of them a short train ride away in Zug, bring contract and shipping documentation with a strong preference for keeping everything in one jurisdiction, which usually resolves the same way as the banking work. The regulated decisioning patterns behind all of it are under financial services.

HOW A ZURICH PROJECT ACTUALLY RUNS

Discovery on your premises, on your equipment

Barcelona to Zurich is a short direct flight, and Swiss discovery differs from everywhere else in one respect: often we cannot be sent samples at all, so we do the document review inside your building on your machines, and take away notes rather than data. We plan the first workshop that way from the outset.

Then remote, on the same clock

Zurich and Barcelona share a timezone, so there is no offset to manage and no waiting for a window. Where the environment is closed, we work against a representative synthetic corpus and your engineers run the evaluations against the real one, which is slower than the usual arrangement and we say so up front.

And back for handover

Handover is in person and includes the artefacts your risk function and your auditor will ask for: architecture, data flows, model and version records, and a clear statement of what leaves the institution, which in most Swiss builds is nothing.

QUESTIONS

QUESTIONS — 5

No. We have one office and it is in Barcelona. We travel to Zurich for discovery, for on-site document review and for handover. We are an EU company working with Swiss clients, which we would rather state plainly, because for a Swiss institution the location of its supplier is a question with legal weight rather than a marketing detail.

Usually both, for different parts of what you do. The revised Federal Act on Data Protection applies because you are in Switzerland; the GDPR applies to activity directed at people in the EU, and many Zurich firms have plenty of it. They are similar enough that one well-built system can satisfy both and different enough that the documentation has to be written against each. The differences that matter to a build are the breach-notification standard, the register requirements, and the fact that Swiss transfer rules run off the Federal Council's own list of adequate states rather than the EU's. Your counsel owns the analysis; we build so that it has as little to analyse as possible.

Storage, retrieval and compute, yes — there are hyperscale regions in Zurich, and self-hosting inside your own infrastructure is always available. Hosted frontier models are the genuine exception: at the time of writing they are generally not served from Swiss regions, so keeping client identifying data in-country usually means running an open-weight model on hardware you control. That is a capability trade-off rather than a compliance one, and it should be measured on your own documents before anyone commits to it. Model and region availability changes, so confirm the current position with the provider rather than relying on this page.

Not directly, because Switzerland is not in the EU or the EEA. It reaches you in two ways nonetheless: if you place a system on the EU market, and if the output produced by your system is used in the EU. For a Zurich bank with EU clients or an EU branch, that is a live question rather than a theoretical one. Switzerland's own direction has been towards sector-specific regulation rather than a single horizontal AI act, alongside its signature of the Council of Europe framework convention on artificial intelligence, but this is still moving and is a question for your counsel, not for an engineering firm's location page.

Our ranges are on the pricing page, in euros and exclusive of VAT, and we do not price by postcode. We can invoice in Swiss francs. What genuinely raises the number here is not the city but the deployment model: a self-hosted build inside a closed environment carries infrastructure work and a slower evaluation loop that a hosted one does not, and we scope that separately rather than hiding it in a day rate.

Keep reading

30-minute technical call · no deck