Choosing a model for your obligations

1. A prompt is a data transfer

The single most useful reframing: when you call a hosted model, you are disclosing the contents of the prompt to a third party, usually in another country. Data protection law does not have a carve-out for "it was just an API call". If the prompt contains personal data, the provider is your processor and you need a processing agreement. If the provider is abroad, it is also a cross-border transfer and needs a lawful transfer mechanism.

This applies to things people rarely think of as personal data: a support ticket pasted in for summarisation, a CV screened against a job description, a customer email drafted with context, a code snippet containing production credentials or a customer identifier. Retrieval augmented generation makes it worse, because the retrieved chunks travel with the prompt.

2. Swiss nFADP / revDSG

The revised Federal Act on Data Protection (nFADP, or revDSG in German) has applied since 1 September 2023. Compared with the old law it dropped protection for legal entities and focused on natural persons, while raising the duties considerably.

• Transparency and purpose. People must be informed about collection, and data used only for the stated purpose.
• Processor agreement. You may delegate processing only by contract, and only if the processor guarantees the same security you owe.
• Record of processing activities. Mandatory for most organisations; an AI provider belongs in it.
• Cross-border transfer. Permitted to countries on the Federal Council's adequacy list, otherwise only with safeguards such as standard contractual clauses plus a transfer impact assessment. The EU/EEA is adequate; the United States is only adequate for companies certified under the Swiss–US Data Privacy Framework.
• Sensitive personal data. Health, religious or political views, trade union membership, genetic and biometric data, racial or ethnic origin, administrative and criminal proceedings. Higher bar, and usually explicit consent.
• DPIA. Required where processing is likely to entail a high risk to personality or fundamental rights — profiling and large-scale sensitive data are the classic triggers.
• Breach notification. To the FDPIC as soon as possible where there is likely high risk.
• Criminal liability. Intentional breaches of information, disclosure or diligence duties are punishable by fine up to CHF 250,000 — levied on the responsible natural person, not the company. This is why individual managers care.

3. GDPR

The EU General Data Protection Regulation applies extraterritorially: if you offer goods or services to people in the EU/EEA, or monitor their behaviour, it applies regardless of where your company is established. Its structure mirrors nFADP but the enforcement is heavier and the transfer rules more developed.

• Article 28. A written data processing agreement with every processor, covering purpose, duration, security, sub-processors, deletion and audit.
• Article 35. A data protection impact assessment for high-risk processing.
• Chapter V. Transfers outside the EEA need adequacy, standard contractual clauses, or binding corporate rules — and after Schrems II, a transfer impact assessment that specifically considers foreign government access.
• Data subject rights. Access, rectification, erasure, portability, objection. If a provider retains your prompts, you must be able to honour an erasure request that reaches into them.
• Fines. Up to EUR 20 million or 4% of global annual turnover, whichever is higher.

The Schrems II point is the one that bites for AI. It is not enough that a US provider signed standard contractual clauses; you must assess whether US surveillance law undermines them in practice. That assessment is much easier when there is no US entity in the chain at all.

4. ISO 27001 and other certifications

Certifications are evidence about the operator's practices. They are necessary for a defensible supplier assessment and completely insufficient on their own, because none of them constrain jurisdiction.

5. Residency vs jurisdiction — the distinction that matters most

Data residency is the physical location where processing happens. Jurisdiction is which state can compel the operator to hand data over. Providers market the first and stay quiet about the second.

The US CLOUD Act of 2018 lets US authorities compel a US-incorporated provider to produce data in its possession, custody or control — explicitly including data stored on servers abroad. So a US hyperscaler's Zurich region gives you Swiss residency and US jurisdiction at the same time. For most corporate data that trade is acceptable. For banking secrecy, professional secrecy or patient data it usually is not, and it must be disclosed in an outsourcing risk assessment.

6. The five residency levels

Every model in the catalog carries a swiss_residency_level and a derived sovereignty_score from 1 to 5.

7. What your company type requires

FINMA-regulated banks, insurers and securities firms

FINMA Circular 2018/3 on outsourcing governs delegating a significant function to a service provider. You must inventory the outsourcing, assess and monitor the provider, retain the ability to instruct and audit it, plan an exit, and ensure FINMA's own audit and supervisory access is preserved. Add banking secrecy under Art. 47 of the Banking Act, where disclosing client identifying data is a criminal offence, and the practical bar becomes level 4 or 5 for anything touching client identity. Cross-border access by a foreign authority is precisely the scenario Art. 47 is written against.

Healthcare, hospitals, insurers handling patient data

Health data is sensitive personal data under both nFADP and GDPR Art. 9. Medical professionals are additionally bound by professional secrecy under Art. 321 of the Swiss Criminal Code, which is criminal law and is not discharged by a data processing agreement. Cantonal hospital legislation frequently adds a hard Swiss-hosting requirement. Level 5 for identifiable patient data; level 4 only where data is robustly pseudonymised and your legal function has signed off.

Lawyers, notaries, auditors, clergy

Also Art. 321 professional secrecy, with the added wrinkle that client privilege can be jeopardised by disclosure to a third party. Level 5 is the defensible default for client matter content. Note that the mere possibility of foreign compelled access is the problem, independent of whether it ever happens.

Listed companies (SIX or otherwise)

The binding constraint is ad hoc publicity and insider law rather than data protection: unpublished price-sensitive information must not leak, and a provider that retains prompts is a leak surface. Financial reporting inputs also fall under your internal control framework and its audit trail. Level 5 or 4 for pre-announcement material; level 3 is usually fine for ordinary corporate work.

Employee and HR data

Employee data is personal data, and in Switzerland Art. 328b of the Code of Obligations limits processing to what relates to suitability for the job or performance of the contract. Works council or staff representation consultation may be required. CVs, performance reviews, disciplinary records and health-related absence data should not go to level 1 providers. Level 4 is a comfortable default; level 3 with a DPA is often accepted.

SMEs and general corporate use

Without a sector regulator the driver is nFADP plus your own client contracts — which increasingly contain their own residency clauses, so check those before assuming you are free. Level 3 or 2 is normally proportionate for internal documents, with level 1 reserved for clearly public material.

Public sector

Cantonal and federal information protection rules commonly mandate domestic hosting outright, and procurement law adds its own constraints. Treat level 4 as the floor and confirm the specific cantonal rule.

8. What the data class requires

9. Retention, training and sub-processors

These are three separate promises and providers routinely conflate them.

• Retention — provider_request_logging. Values are none (zero data retention, discarded after the response), metadata (token counts and timestamps only), full (prompt and completion stored, typically 30 days for abuse monitoring), or unknown. Anything other than none is a storage location you must document and be able to reach for an erasure request.
• Training — training_on_customer_data. Whether your prompts improve the model. Even with a no-training promise, retention for abuse monitoring can persist independently.
• Sub-processors — who else touches the request. An aggregator or reseller that forwards to a third-party inference host inserts an extra party and often an extra jurisdiction. Article 28 GDPR requires you to know about and authorise them, so a model routed through a gateway needs the whole chain documented, not just the brand on the invoice.

10. Open vs closed weights

Open weights are downloadable. That gives you three compliance-relevant properties: you can self-host and reach level 5; you can pin an exact version so behaviour does not drift under a validated process; and you have a genuine exit if a provider changes terms or disappears. Model licences still vary — some restrict commercial scale or resale, so read them.

Closed weights generally lead on capability but concentrate risk: one vendor controls availability, pricing, deprecation and terms, and you cannot audit or reproduce the model independently. For a validated workflow in a regulated setting, model deprecation is a real operational risk, not a hypothetical one.

11. Filter reference

Each filter on the catalog page maps to a concept above.

Every model also answers five questions directly, visible under "Compliance and reasoning detail" on each card: where the data is processed, who can compel access, what the provider does with the request, whether the weights are open, and which data classes it is fit for.

12. Ready-made recipes