How to introduce AI safely in a small business: a 10-step checklist

The legal framework at a glance

• Switzerland: there is no dedicated AI act yet. The Federal Act on Data Protection (FADP) applies directly to AI, as the Federal Data Protection and Information Commissioner (FDPIC) points out. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI Convention. A draft for consultation is due by the end of 2026.
• EU (for Germany, Austria and Swiss companies with an EU link): the GDPR and the AI Act apply. Article 4 (AI literacy) has applied since 2 February 2025, most other rules since 2 August 2026. The "Digital Omnibus" moved the obligations for high-risk systems to 2 December 2027 and 2 August 2028 respectively.

The 10 steps

1. Take stock: who uses which AI?

• Ask your teams openly which AI services they use and for what, including personal accounts. Do not look for culprits, or you will only hear half the story.
• Record service, account type and purpose in a simple list.

More on this: Shadow AI in small businesses.

2. Define use cases and data classes

• Pick two or three concrete use cases with a clear benefit, such as drafting texts, summarising minutes or explaining code.
• Sort data into simple classes, for example: public, internal, confidential, personal data, sensitive personal data and data under professional secrecy.
• Decide which class may go into which tool. What never belongs in one is covered in IBANs, ID numbers & co..

3. Choose tools and accounts

• Business plan, not personal accounts: choose a plan with a contract. Anyone passing personal data to a provider must make sure the provider can guarantee data security (Art. 9 FADP). In the EU, a data processing agreement is required (Art. 28 GDPR).
• Check data location and sub-processors: if data leaves the country, Art. 16 and 17 FADP or Art. 44 et seq. GDPR apply.
• Check training: find out whether the provider uses input for training and turn it off where you can. How to: Turning off AI training. For Microsoft environments: Microsoft Copilot data privacy.

4. Check whether you need a data protection impact assessment

• If processing may pose a high risk to the people concerned, a data protection impact assessment is required beforehand (Art. 22 FADP, Art. 35 GDPR). The FADP itself gives an example: extensive processing of sensitive personal data such as health data.
• Everyday text work without personal data is usually not high risk. Check and note it briefly anyway. The FDPIC publishes a factsheet on this.
• Take care with decisions about people, such as sorting job applications: AI for recruitment is high-risk under the AI Act (Annex III point 4).

5. Write an AI policy

• One or two pages are enough: approved tools, banned data, handling of results, who to report to.
• Also cover how results are handled: check texts, figures and sources from AI before passing them on.
• Have everyone confirm it. Free to adapt: AI policy template.

6. Train your staff

• Where the AI Act applies, Article 4 requires measures to support the AI literacy of staff. According to the European Commission, no certificate is needed.
• One hour with examples from your own work is a good start. Keep a record of who was trained and when.

Content and format: AI literacy under AI Act Art. 4.

7. Set technical guardrails

• Accounts: manage business accounts centrally and rule out personal accounts for company data.
• Access: before rolling out AI assistants that read emails and files, tidy up who can access what.
• Catch mistakes: most slips happen when pasting in a hurry, such as a password or a customer list. A DLP solution or a browser extension checks input before it is sent. Comparison: DLP for AI tools.

8. Be transparent where needed

• According to the FDPIC, people talking to an AI chat have a right to know that they are dealing with a machine. This applies, for example, to a chatbot on your website.
• If customers' personal data goes to an AI provider, your privacy notice should say so (recipients and countries, Art. 19 FADP, Art. 13 and 14 GDPR).
• In the EU, Article 50 of the AI Act requires, among other things, disclosure of deepfakes and of AI-generated texts on matters of public interest unless they have been editorially reviewed.

9. Report and handle incidents

• Name a contact point for incidents. Reporting quickly is never punished.
• After a slip: replace affected passwords and keys immediately, then delete the chat and any shared links and record the incident. Deleting alone is not enough, as the text has already reached the provider. See Pasted a password into ChatGPT – what now?.
• Check whether you must notify: in Switzerland, the FDPIC "as soon as possible" if a high risk to the people concerned is likely (Art. 24 FADP); in the EU, without undue delay and where feasible within 72 hours, unless a risk is unlikely (Art. 33 GDPR).

10. Review regularly

• Once a year and whenever a new tool is added: update the list, the policy and the training.
• Keep an eye on the law, such as the Swiss consultation on AI regulation and the AI Act deadlines.

Who does what?

Frequently asked questions