EU AI Act 2026: high-risk duties from 2 August 2026 – what Swiss providers must do now

What is the EU AI Act?

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 on harmonised rules on artificial intelligence – short "AI Act" or "AIA" – was published in the EU Official Journal on 1 August 2024 and entered into force on 2 August 2024. Operative duties, however, do not all kick in at once, but phase in over three years.

The Act follows a risk-based approach with four tiers: prohibited practices (Art. 5), high-risk systems (Art. 6 in conjunction with Annex III), systems with transparency duties (Art. 50, e.g. chatbots, deepfakes), and minimal risk (everything else, no specific duties). There is a separate track for general-purpose AI models (GPAI, Chapter V) – that is, the large language models themselves, regardless of use case.

For Swiss providers this is what matters: the AIA applies extraterritorially (Art. 2). A Swiss fiduciary office that offers an AI service to EU clients "places the system on the market in the EU" and falls under the AIA – regardless of establishment. Purely domestic use with exclusively Swiss clients is not caught, but the combination "AI system + EU client" suffices.

Why this matters now

The phased timeline is the key information for May 2026. We are shortly before the third and heaviest entry-into-force date on 2 August 2026.

2 February 2025 – prohibitions in force. Art. 5 AIA: social scoring by authorities, subliminal manipulation, exploitation of vulnerable persons, real-time remote biometric identification in public space (with narrowly defined exceptions), prediction of crime by profiling alone, untargeted scraping for facial databases, emotion recognition in the workplace or in education, biometric categorisation of sensitive attributes. These eight prohibitions are absolute since February 2025.

2 August 2025 – GPAI duties in force. Providers of general-purpose AI models (OpenAI, Anthropic, Google, Mistral, Meta) must maintain technical documentation (Art. 53), provide information to deployers, document copyright policy, and publish a summary of training data. For "systemic risk" GPAI models (>10^25 FLOPs of training compute), model evaluation and red-team duties apply (Art. 55).

2 August 2026 – high-risk duties in force. This is the big step. Annex III lists 8 high-risk areas: biometric identification, critical infrastructure, education, employment (HR tools, CV screening), essential public services (social security, emergency calls), law enforcement, migration/asylum/border, justice/democratic processes. Whoever places a system on the market in one of these areas must implement risk management (Art. 9), data quality (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), quality management (Art. 17) and CE conformity assessment (Art. 43). These duties apply from 2 Aug 2026.

2 August 2027 – remaining duties + embedded high-risk. High-risk systems that are safety components of products covered by sectoral EU rules (Annex I, e.g. medical devices, machinery, lifts) get a 36-month transition. The full application of Art. 6(1) (high-risk definition via Annex I) also falls on this date.

Which role, which duties

The AIA distinguishes six actor roles, four of which dominate in practice.

Provider (Art. 3 No 3). Whoever develops an AI system or has it developed and places it on the EU market or puts it into service under their own name. Bears the main weight of duties. Example: a Swiss IT service provider that builds a client chatbot and markets it under their own name is a provider.

Deployer (Art. 3 No 4). Whoever uses an AI system under their own authority in a professional capacity. Example: a law firm productively using ChatGPT Enterprise is a deployer. Duties: use as intended (Art. 26), input data quality within their control, monitoring, informing employees (Art. 26 para. 7), data protection impact assessment (Art. 27 for high-risk).

Importer and distributor (Art. 23/24). Relevant only when an AI system from a third country (e.g. Switzerland) is distributed in the EU. The EU importer must verify that the provider has fulfilled its duties – for high-risk systems, with CE marking, EU declaration of conformity, and documentation.

Authorised representative (Art. 22). A provider established outside the EU (i.e. including Switzerland) must, before placing the system on the EU market, designate a written authorised representative in the EU – except for GPAI models, which need a separate representative (Art. 54).

For a typical Swiss SME advisory firm with EU clients this means in practice: check whether the use case falls under Annex III. If not, transparency duties under Art. 50 ("you are speaking with an AI") and good documentation. If yes, full programme from 2 Aug 2026 – and the question of whether there are any EU clients at all for which the system is used.

AIA compliance check in 8 steps

1. 01Scope check: is the system placed on the EU market or used to produce output in the EU? If not, AIA usually not directly applicable.
2. 02Identify the role: provider, deployer, importer, authorised representative – and possibly several roles per project.
3. 03Classify: does the use case fall under Art. 5 (prohibitions), Annex III (high-risk), Art. 50 (transparency) or minimal risk?
4. 04When using GPAI: check whether the provider (OpenAI, Anthropic, ...) meets its duties under Art. 53/55 – read the provider documentation.
5. 05For high-risk: set up the risk management system (Art. 9), technical documentation (Art. 11, Annex IV), logging (Art. 12), human oversight (Art. 14).
6. 06Choose the CE conformity assessment route: internal control (Annex VI) or notified body (Annex VII) – for Annex III No 1 (biometric identification) a notified body is mandatory.
7. 07Issue the EU declaration of conformity, affix the CE marking, register in the EU database for high-risk systems (Art. 71).
8. 08Post-market monitoring: report serious incidents within 15 days (Art. 73); substantial changes trigger reassessment.

When the AIA check is mandatory

Mandatory check in four constellations. First: the AI system is placed on the EU market – including provision as SaaS, including free of charge. Second: the system is put into service in the EU, including by a Swiss provider (cloud region irrelevant, what counts is the market). Third: the output produced by the system is used in the EU (Art. 2 para. 1 lit. c) – an extra hook that even captures systems hosted purely in Switzerland whose result is used by an EU office. Fourth: the system is a safety component of a product itself covered by EU harmonisation law (Annex I, e.g. Medical Devices Regulation, Machinery Regulation).

Concrete trigger points: onboarding a German client into AI-supported reporting; selling your own AI solution to EU business partners; integration into a product subject to EU CE marking; using AI output in EU court or EU administrative proceedings.

When the AIA does not apply

Four exceptions, to be read with care. First: military, defence or national security purposes (Art. 2 para. 3) – irrelevant for typical SME AI. Second: purely scientific research and development before placing on the market (Art. 2 para. 6). Third: free open-source components, provided not placed on the market as a high-risk system or as a GPAI model with systemic risk (Art. 2 para. 12). Fourth: purely personal, non-professional use by a natural person.

Important: Switzerland itself is NOT an EU member and the AIA has not been incorporated into bilateral law. Purely Swiss-internal AI use directed exclusively at Swiss clients for Swiss matters is not directly captured. Indirect capture can still arise via three paths: (a) output is used in the EU, (b) sub-supplier clauses of an EU customer demand AIA compliance contractually, (c) Swiss sectoral law increasingly adopts AIA standards (see SECO communications 2025/2026).

This is not legal advice. Classification as a high-risk system under Annex III has serious consequences – when in doubt, engagement of an EU-specialised law firm is mandatory, very early in the project. Notified bodies for conformity assessment are listed in the EU Commission's NANDO database.

Trade-offs

FAQ

Related topics

Sources

1. Verordnung (EU) 2024/1689 – EUR-Lex Volltext (de) · 2024-07
2. Regulation (EU) 2024/1689 – EUR-Lex full text (en) · 2024-07
3. EU AI Act – interaktiver Explorer (Future of Life Institute) · 2026-04
4. European Commission – AI Act page, implementation timeline · 2026-05
5. SECO – Staatssekretariat für Wirtschaft, Mitteilung zur Schweizer Position · 2026-03