A Swiss company uses an assistant for internal notes and also develops a recruitment service for European customers. Both applications may call the same model without creating the same responsibilities.
The EU AI Act examines the organisation’s role and territorial connection, together with intended use. Four questions provide an initial framework. They collect facts for legal assessment and engineering decisions rather than replacing qualification of a particular case.
1. Does the company provide or use the system?
The regulation’s definition includes the capacity to infer from inputs how to produce outputs such as predictions or recommendations. This requires examining the system, not accepting a commercial label. A fixed formula or any other automation is not automatically an AI system.
The model is a component. The system includes instructions and data as well as the tools, interface and controls defining its use. An agent’s ability to call software adds decisions about permissions and actions.
The following roles distinguish operating a system from making it available.
- A provider develops a system or has it developed, then places it on the market or puts it into service under its name under the regulation’s conditions.
- A deployer uses the system under its authority in the relevant context. Buying an assistant for staff often starts from this role.
A branded service may make the company a provider even if a contractor wrote its software. Staff using an approved tool under the organisation’s instructions are not necessarily separate deployers. Other supply-chain roles require examination where relevant.
The inventory records the name under which the service is offered and its purpose, including who can change and control it. A major modification or new purpose may require another assessment. The contract alone does not settle a role that differs from actual operation.
In the example, the recruitment-service company examines responsibility for the complete system. For a purchased internal assistant, it begins with its own use and configuration.
2. Which connection brings the use within the EU?
A Swiss registered office does not automatically exclude the Act. Its scope includes placing systems on the EU market or putting them into service there, deployers established or located in the EU, and certain situations where output from a third-country system is used in the EU.
The company therefore maps entities and deployments. An EU subsidiary may use a system; a Swiss provider may offer one on the EU market; an output generated in Switzerland may be used by another entity in the Union. Those facts raise distinct questions.
An assistant restricted to a Geneva team with no other identified connection differs from a candidate score used by a French office. Online availability does not remove the need to examine the market and recipients.
The scope record identifies countries and users, including where outputs go. Expanding to another market or population can change the conclusion. This assessment also leaves applicable Swiss and sector rules in place.
3. Which purpose and effects need examination?
The Act distinguishes prohibited practices and high-risk uses, alongside specific duties such as transparency. These are not all mutually exclusive categories. Disclosure duties may accompany a system subject to other requirements.
An added technical control cannot make a prohibited purpose permissible. Purpose must be checked before architecture investment. Social scoring and some emotion-recognition uses illustrate areas with precise prohibitions and conditions.
High-risk qualification depends on the intended use and relevant exceptions. Recruitment and some education or essential-service decisions are among the areas concerned. Drafting a job advertisement does not necessarily have the same purpose as ranking candidates.
Transparency duties address interactions with people and certain generated content. Provider and deployer roles affect responsibility. A public assistant needs examination of its real interface and Article 50 conditions, rather than an assumption that a generic notice is enough.
| Illustrative use | Assessment question | Technical consequence to examine |
|---|---|---|
| Internal drafting assistant | Which information and decisions does it influence? | Permitted inputs, settings and review |
| Customer-facing assistant | Which information duties and personal access apply? | AI identification, separated records and human contact |
| Candidate ranking | Does the purpose fall within high-risk rules? | Criteria, data and independent review |
| Preparing accounting entries | Which permissions prepare or execute an action? | Separation of proposal, approval and payment |
These examples guide analysis without being conclusions for every context. Moving from drafting to sending, or recommendation to decision, can alter obligations without changing the underlying model.
The European Commission’s timetable distinguishes provisions. Prohibitions and AI-literacy provisions began applying in February 2025, with transparency rules in August 2026. The timetable separates Annex III high-risk uses, with a 2 December 2027 date, from Annex I product-related systems, with 2 August 2028. Conditions and transitional arrangements require checking in the applicable texts.
A later deadline does not suspend existing employment or data-protection duties. Nor does it shorten the work needed to evaluate a system and organise meaningful human review.
4. Which decisions must design and testing demonstrate?
The technical record starts from the qualified use. It identifies authorised people and sources, with the task and permitted actions. That boundary makes it possible to detect an expansion requiring another review.
The data-flow map follows collection through output and logs. It identifies providers and processing locations, including retention. A no-training commitment and a retention period answer different questions; both must match the actual product and settings.
Tests distinguish useful answers from errors and refusals on representative cases. When a system affects evaluation of people, the review also examines differences in error between groups. A favourable overall score can conceal a substantial problem for part of the population.
Human oversight requires the means to exercise judgement. The reviewer receives original evidence and can challenge or reject the result. Workload and automatic acceptance of machine output also need observation. A signature added after the event does not demonstrate independent review.
Permissions translate the limits into tools. Authority to prepare an accounting entry does not automatically include payment authority. The application enforces these boundaries when tools are called, beyond instructions given to the model.
Logs should support reconstruction without collecting personal data without a purpose. The team also prepares shutdown and access withdrawal, including recovery conditions. An exercise checks those operations before a real incident.
This record is a project-preparation method. The Act does not impose this identical file on every system; specific requirements follow the relevant role and qualification.
Connect the review with Swiss duties
A use outside the EU rules does not fall outside all law. The FDPIC explains that the FADP already governs AI processing of personal data. Purpose and information duties remain relevant alongside protection of the data used.
An automated individual decision under Article 21 FADP has specific characteristics, including legal or similarly significant effects without human involvement in the decision. Information and review duties apply with statutory exceptions. A drafting aid should not be confused with a decision meeting that definition.
A data protection impact assessment may be required for processing creating the high risk specified by the FADP. It is a distinct legal instrument. Technical tests can supply evidence without replacing that assessment.
The four questions produce an identified role and examined territorial scope, followed by a qualified purpose and testable design choices. Those facts give the people responsible a common basis for reviewing changes.
Sources and reference date
- European Commission | AI Act framework and timetable
- European Commission | AI Omnibus changes
- FDPIC | AI and data protection
- FDPIC | duty to inform
- FDPIC | impact assessment
The timetable reflects official information consulted on 7 October 2026. This article provides an initial assessment method; the applicable law and project facts determine the final legal qualification.