AI DATA POLICY · FADP · SWISS SMES
Every company needs rules for what staff can paste into AI tools. The good news: one page is enough to start, and you can write it this afternoon.
A one-page AI data policy answers four questions: which tools are approved, what data may never go into them, who checks the output, and who owns the rules. Only 34% of Swiss SMEs have such rules today (23% among firms with under ten employees) - which is exactly why regulators keep pointing at the gap.
Why one page is enough to start
The FDPIC and NCSC's October 2026 joint campaign on generative AI at work warns that employees routinely disclose more than they realise when pasting into AI tools - often third-party personal data protected by the FADP. A short, enforced policy beats a long, unread one. You can always grow it later.
The four sections
Approved tools. Name them, with the tier: "ChatGPT Team (training off), Microsoft 365 Copilot, DeepL Pro". Everything else needs a yes from the policy owner first.
The never-paste list. Client and patient data, HR and salary data, unsigned contracts, unpublished financials, credentials and keys, anything under NDA. If it identifies a person and you would not email it to a stranger, it does not go in.
Human check. AI output that leaves the building - client emails, quotes, published text, code, numbers - gets read by a named human first. AI drafts, humans sign.
Ownership and review. One named owner, a twice-yearly review date, and a line on what happens when someone slips (no blame culture - report, fix, adjust the list).
Two Swiss-specific notes
The FADP applies directly to AI use. High-risk processing (sensitive data at scale, profiling) may need a data protection impact assessment - the policy owner should know when to trigger one.
People have a right to know when a machine, not a human, is communicating with them, and to ask for human review of automated decisions about them.
A template first line
"At [company], we use the AI tools listed below to work faster. We never enter personal data of customers, employees or partners into public AI tools, and a human always checks AI output before it counts."
The takeaway: a short, enforced policy beats a long, unread one - and 66% of Swiss SMEs have neither.
Sources
FDPIC & NCSC, "Generative AI in the workplace: Data Protection Challenges" (16 October 2026)
FDPIC, "AI and data protection" (24 September 2025)
SECO, "AI gains ground among Swiss SMEs" (5 November 2025)
AXA / Sotomo, SME labour-market study 2026
Last updated: 20 October 2026.
TL;DR: A one-page AI data policy covers four things: approved tools (with tiers), a never-paste list, a named human check on outgoing AI output, and a named owner with a review date. The FADP applies directly to AI use, and people have a right to know when they are dealing with a machine. Write the page, name the owner, review it twice a year.
Reading time: ~3 min
Want us to draft the policy with you? We write these for Swiss companies every week. Discuss a project: eli5a.com/contact
