On 28 October 2026 the Federal Council reviewed progress on AI regulation and OFCOM published its 'Guide on an AI Code of Conduct': suggested texts on 10 topics at three levels of detail. What it contains, what remains mandatory and how to turn it into simple rules for an SME.
On 28 October 2026 the Federal Council took note of the progress made on regulating artificial intelligence in Switzerland. Together with the press release from the Federal Office of Communications (OFCOM), two documents were published: a report on sector-specific measures within the Federal Administration and a "Guide on an AI Code of Conduct" (available in German, French and Italian), intended for associations and businesses that want to set themselves voluntary rules on the use of AI.
For an SME in Ticino that already uses writing assistants, machine translation, a chatbot on its website or AI features built into business software, the document is useful above all for one practical reason: it offers ready-made texts to adapt instead of starting from a blank page.
Where regulation stands in Switzerland
On 12 February 2025 the Federal Council decided to ratify the Council of Europe Convention on Artificial Intelligence. Implementation runs on two tracks, described on OFCOM's AI page:
- Legally binding measures: the Federal Office of Justice (FOJ) is drafting a bill that is to cover in particular transparency, data protection, non-discrimination, supervision and risk assessment. The consultation is scheduled to begin in spring 2027.
- Non-binding measures: OFCOM coordinates guidelines, industry standards and voluntary commitments. The guide on an AI code of conduct is the first concrete tool on this track.
In the meantime AI does not operate in a legal vacuum. The Federal Data Protection and Information Commissioner (FDPIC) points out that the current data protection legislation is directly applicable to AI-based data processing. Businesses working with customers in Italy or elsewhere in the EU should also consider the EU AI Act: according to the European Commission it has applied since 2 August 2026, with some exceptions, and its transparency rules require, for example, that people know when they are interacting with a chatbot and that certain AI-generated content is labelled as such.
What the guide contains
OFCOM's document is a toolkit. It proposes a structure of 10 articles, each with suggested texts at three levels of detail (low, medium, high) that can be combined as needed:
- Purpose of the AI code
- Scope
- Definition of AI systems
- Other definitions
- Principles
- Roles, responsibilities, powers
- Dealing with affected persons
- Implementation, enablement and monitoring
- Handling of incidents
- Maintenance and further development of the code
The proposed principles include human dignity and autonomy, transparency, accountability, non-delegable decisions, non-discrimination and fairness, data, privacy and confidentiality, reliability and security, and purpose and proportionality. The guide also suggests a multi-stage drafting process: take the initiative and build support, set up a team, clarify purpose and gaps, build on what already exists, draft the content, communicate it, enable the people who apply it, then review and update the code over time.
One point should be kept in mind: the document states that the guide does not serve as proof of compliance with legal or contractual requirements. Each organisation remains responsible for aligning its code with the rules that apply to it.
How to use it in an SME
The guide also addresses large organisations and industry associations. A small business does not need to adopt all 10 articles at the highest level of detail. A reasonable starting point, using the low or medium level, could be:
- Scope and definition: list which AI tools are in use or being evaluated, by whom and for which tasks, including those built into existing software.
- Data and confidentiality: define which information must never be entered into external AI tools. The FOCS and FDPIC recommendations are summarised in our article on AI at work.
- Roles and non-delegable decisions: state who approves a new tool and which decisions always remain with a person, for example quotes, hiring or replies to complaints.
- Transparency towards customers: decide how to disclose a chatbot on the website or texts and images produced with AI, taking EU rules into account if you operate in that market.
- Incident handling: define where to report an error, a data leak or an unexpected result, without consequences for anyone reporting in good faith.
- Updates: set a regular review, for example once a year, and whenever a new tool is introduced.
Many of these questions are not specific to AI: clear responsibilities, quality, security and data handling are the same organisational topics highlighted by the "SME Cybersecurity 2026" study. It therefore makes sense to integrate AI rules into existing internal documents rather than create a parallel structure, as the guide itself suggests. The AI skills sought on the labour market are covered in our article on almost 5000 AI job ads in Switzerland.
Our approach
ElaraTeq Sagl develops and runs websites and applications for SMEs and public bodies in Ticino, including tools with AI features. Through our consulting we help take stock of the tools in use, define internal rules on data and transparency and keep them up to date. For an initial discussion you can contact us.
Sources
- OFCOM, Federal Council takes note of interim progress on AI regulation, press release of 28 October 2026
- OFCOM, Handreichung für einen KI-Kodex (PDF, German) and Guide pour l'élaboration d'un code en matière d'IA (PDF, French), October 2026
- OFCOM, Artificial intelligence: status of work and documents
- FDPIC, Current data protection legislation is directly applicable to AI
- European Commission, AI Act: regulatory framework on AI
