Sovereign AI in Switzerland: hosting, the FADP and vendor independence

Swiss data protection law takes outsourcing seriously. A private person who intentionally discloses data abroad in breach of Article 16, or hands processing to a processor outside the conditions of Article 9, faces a fine of up to CHF 250,000 (Art. 61 FADP). And an AI tool that processes personal data on your behalf is, most of the time, one more processor within the meaning of the FADP.

Sovereign AI in Switzerland is AI over which you keep control on four levels: where the data is processed, which law applies to the provider, which model runs, and who controls access and traces. A server in Switzerland is a starting point, not a guarantee.

Sovereignty works like a safe: knowing which city it sits in does not tell you who holds the key. This article breaks down those four levels, recaps what the FADP says, lists the questions to ask a provider and details what skilder can document.

The four levels of sovereignty

1. Data: where is it processed?

This is the most visible level: the physical location of the servers that store and process your data, including prompts, uploaded documents and logs. Watch out for secondary processing: backups, support, logging and above all model inference, which can happen somewhere other than storage.

2. Jurisdiction: which law applies to the provider?

A server in Geneva run by a company subject to foreign law remains exposed to that law. The US CLOUD Act (18 U.S.C. § 2713), for example, requires providers subject to it to preserve or disclose data in their possession, custody or control “regardless of whether such communication, record, or other information is located within or outside of the United States”. The useful question is not only “where?” but also “who, and under which law?“.

3. The model: who runs it, and what does it do with your data?

The model is often the forgotten link. You need to know where it runs, whether your content can be used to train it, and how long it is retained. The answers vary by provider, by contract and even by plan.

4. Control: can you change your mind?

Sovereignty includes reversibility. If your processes, prompts and working methods live only inside one vendor’s tool, switching models means rebuilding everything. Know-how captured in an open format and managed from a neutral registry stays yours, whatever the model. It is also one of the pillars of enterprise AI governance.

What the FADP says

The Federal Act on Data Protection (FADP), in force since 1 September 2023, has no chapter on AI. The Federal Data Protection and Information Commissioner (FDPIC) nonetheless points out that it applies directly to AI-based data processing, because it is worded in a technology-neutral way. Several articles bear directly on the choice of an AI tool:

• Data protection by design and by default (Art. 7): protective measures are planned from the outset, not after deployment.
• Processors (Art. 9): the controller must ensure the processor is able to guarantee data security.
• Disclosure abroad (Art. 16): allowed to a state the Federal Council recognizes as adequate, or with safeguards such as contractual clauses.
• Impact assessment (Art. 22): mandatory when processing is likely to create a high risk, in particular with new technologies.

In fairness: the FADP does not require AI to be hosted in Switzerland. Since 15 September 2024, the Federal Council recognizes US companies certified under the Swiss-U.S. Data Privacy Framework as adequate. Choosing sovereign AI is therefore a risk-management decision (jurisdiction, confidentiality, dependency), not a general obligation. That is precisely why it deserves to be made deliberately rather than by default.

The real risk: the AI nobody chose

While leadership compares offers, employees have often already decided with their personal accounts. Internal documents then pass through services whose hosting and terms nobody has checked. That is shadow AI, and it makes any sovereignty strategy theoretical.

The same logic applies to connectors. An agent that reaches a CRM or a drive through an MCP server installed without review adds a processor, and a data flow, that nobody has documented.

Questions to ask an AI provider

1. Where is the data processed, including inference, logs and backups?
2. Under which law is the company that runs the infrastructure?
3. What is the list of subprocessors, and is it public and kept up to date?
4. Is your content used to train models? Is that excluded by contract?
5. Can you switch models without rebuilding your processes?
6. Who sees what, and what is logged? Are the logs exportable and deletable?
7. Is there an on-premise option for the most sensitive data?

What skilder can document

skilder is a Swiss public limited company (SA) based in Prilly (VD). The points below are those published on the Trust & security page, in the legal notice, the list of subprocessors and the privacy policy:

• Hosting in Switzerland: the platform’s services and data are hosted in Switzerland by Infomaniak Network SA.
• Swiss models by default: inference managed by skilder runs exclusively through Infomaniak AI Tools, open-weight models processed in Switzerland, with training on content disabled by contract.
• LLM independence: a customer can connect their own key with another provider (Anthropic, OpenAI, Mistral, Google). That provider then becomes the customer’s processor, and no other provider is used unless the customer configures one.
• Residency and deployment: data residency in Switzerland or the EU, or on-premise deployment on request.
• Control: SSO and role-based access control, scoped and revocable connectors, no privilege escalation at run time.
• Traceability: every task is logged and attributed to the person who launched it; skilder keeps this execution trace, which the customer can export and delete.

And what does not exist yet: the privacy policy states that a technical lock by region (for example “Switzerland only”) is on the roadmap and not yet available. Today, the workspace configuration determines which providers are connected.

On the usage side, your AI capabilities are grouped into roles: the work a position actually does, with its skills, tools and permissions. Each role starts from a blueprint and is configured on your processes, then served in Claude, ChatGPT or Copilot. Switching models does not change the role.

Key takeaway

AI sovereignty plays out on four levels: data, jurisdiction, model and control. Swiss hosting settles the first. The other three are checked in the contracts, the list of subprocessors and the architecture.

To check these points with a founder, book a free 30-minute call, or start with the AI check-up.

Frequently asked questions

What is sovereign AI? +

It is a use of AI over which the organization keeps control on four levels: where the data is processed, which law applies to the provider, the choice of model, and operational control (access, traces, reversibility). Local hosting is a useful condition, but not sufficient on its own.

Does the FADP forbid using a US AI provider? +

No. Article 16 of the FADP allows data to be disclosed abroad to a state whose level of protection the Federal Council has recognized as adequate, or with safeguards such as contractual clauses. Since 15 September 2024, US companies certified under the Swiss-U.S. Data Privacy Framework are recognized as offering an adequate level. Sovereignty is therefore a risk-management choice, not a blanket prohibition.

Is hosting in Switzerland enough to make AI sovereign? +

Not always. The law that applies to the provider matters as much as where the servers sit. For example, the US CLOUD Act requires providers subject to it to disclose, on lawful request, the data they control, whether it is stored in the United States or elsewhere. You need to check both the hosting location and the chain of subprocessors.

Where does skilder host data? +

The skilder platform is hosted in Switzerland by Infomaniak Network SA, as stated in the legal notice and the public list of subprocessors. By default, inference runs exclusively through Infomaniak AI Tools, open-weight models processed in Switzerland, with training on content disabled by contract. An on-premise option is available on request.

Can I use Claude or GPT with skilder? +

Yes. skilder is LLM-agnostic: a customer can connect their own API key with another provider. That provider then becomes the customer's processor, and the data is processed wherever that provider processes it. No other provider is used unless the customer configures one.

Does sovereign AI have to use a Swiss model? +

Not necessarily. What matters is knowing where the model runs, under which contract and with which guarantees on data use, and being able to switch. A model-agnostic architecture lets you use a Swiss-hosted model for sensitive data and another one for less exposed tasks.