Are we even allowed to? AI, personal data and official secrecy

Administrations now ask a different question from the one they asked two years ago. It is no longer 'are we allowed to use AI', but 'can we run this ourselves, so the data stays in the building'. The first half of that expectation holds. The second half is incomplete, and in practice the difference costs months.

Parameter counts, memory requirements and tokens are covered at length in our primer 4B, 70B, 397B-A17B. For this part, the four sentences above will do.

What the federal factsheet says

In 2024 the Competence Network for Artificial Intelligence of the Swiss Federal Administration published a factsheet on the use of generative AI tools. The central rule reads:

'Never enter personal data or sensitive information into these tools.'

Factsheet on the use of generative AI tools in the Federal Administration, V1.2, 18 January 2024, our translation from the German

Named explicitly: no entry of information classified as internal, confidential or secret. No entry of text covered by official secrecy under Art. 320 of the Swiss Criminal Code or by professional secrecy. And no entry of personal data of any kind, together with a warning that pseudonymisation does not reliably prevent re-identification.

That rules out a large part of the work an administration actually does. A social services department wanting to summarise case files is working with data about social assistance measures. The Federal Act on Data Protection counts these among sensitive personal data in Art. 5 lit. c no. 6, and cantonal legislation has equivalent lists. Note which law applies: a municipal social services department is subject to cantonal law, not to the federal act. The lists largely coincide, but not everywhere word for word. A residents' registration office, a debt collection office, a tax administration: the same picture throughout, plus specific duties of secrecy of their own, such as tax secrecy.

Which tools this applies to, and which it does not

The factsheet addresses publicly accessible tools. It is not a ban on contractually secured services. This distinction is regularly lost in the debate, and it produces two errors at once: some take everything to be forbidden, others take everything to be permitted. Three examples to draw the line:

A factsheet is neither a law nor a directive; it is a recommendation with no binding effect outside the administration. It does not apply to cantons and municipalities. The actual reason personal data does not belong in a freely accessible tool is therefore not the factsheet, but the lack of a legal basis, disclosure abroad and official secrecy. What is authoritative for your office is the material published by your cantonal data protection authority. We quote the federal factsheet because it sums up federal practice well and because the underlying rules apply everywhere. The version dates from January 2024; before relying on it, check whether a newer one exists.

Why open AI models are an opportunity here

1. You may process data that would otherwise have to stay outside

2. You choose the location, and you really do

With a hosted service you pick a region from a list. Running it yourself, you pick the room. That sounds like a difference of degree, and in law it is a difference of principle: Art. 16 of the Federal Act on Data Protection requires an adequate level of protection or suitable safeguards for disclosure abroad. If no disclosure takes place, the whole assessment falls away.

The Swiss federal government itself takes a less strict view of cloud use than many assume. A report by the Federal Chancellery from March 2025 concludes that a cloud provider is not an unauthorised third party but an auxiliary person within the meaning of Art. 320 of the Criminal Code, and that outsourcing does not constitute a breach of official secrecy, provided the requirements of the federal Digitalisation Ordinance are met. The Data Protection Commissioner of the Canton of Zurich takes a considerably more critical view of the risk posed by US providers, because the American CLOUD Act can give US authorities access to data held in European data centres.

3. No model gets pulled out from under you

Whoever has downloaded the model files keeps them. With a hosted model, the provider decides when a version is switched off. For a specialised application tuned and tested against particular behaviour, that means acceptance testing all over again, and you do not choose the date.

4. You can read up on what the model learned from

With most models you cannot. With Apertus, developed at ETH Zurich, at EPFL and at the Swiss National Supercomputing Centre CSCS in Lugano, you can.

That there is anything to compare at all is down to the EU AI Act. It obliges providers of general-purpose models to publish a summary of what they trained on. In Switzerland that duty does not apply. For providers doing business in the EU it does. That is why these documents exist, and you can read them.

The AI Accountability Lab at Trinity College Dublin, in Ireland, assessed 39 such summaries in a paper presented at the FAccT 2026 conference. Apertus 70B received an A for transparency and an A+ for usefulness, the best of all the summaries assessed. OpenAI, Google, Anthropic, Meta and Mistral sit in the C and D range. For a further 20 models examined, no summary existed at all; they are not among the 39.

Worth keeping straight: what was assessed is the quality of the published summary, not the quality of the model. How well Apertus actually performs is the subject of Part 2, and the answer there is less comfortable.

5. You are allowed to change the model

An open model can be adapted to your language and your cases. The technical term is fine-tuning: you show the model a few hundred to a few thousand examples from your own organisation, and it picks up tone, vocabulary and structure. This is a project for specialists, not something you do at the press of a button.

The Canton of Ticino has done exactly that. The Centro sistemi informativi in the Department of Finance and Economy runs a translation tool on a fine-tuned Apertus 8B, in its own data centre, for Italian, German, French, Spanish, Romanian and Ukrainian. The figures from Artificialy, the Ticino company involved: the unmodified Apertus 8B reached 90 per cent, the larger Apertus 70B 92 per cent, the fine-tuned small model 94 per cent.

What those percentages measure exactly has not been disclosed. They are vendor figures from an in-house translation comparison, as at March 2026 with roughly 100 test participants. Whether this became a production system we could not verify. The case shows that the approach works. As proof of performance it only goes so far.

What else applies in regulated sectors

Hospitals, medical practices, law firms, banks and insurers face the same question under different rules. Three differences matter.

Data protection law applies to them in full. Under Art. 2 para. 1 it covers private persons and federal bodies. A privately run hospital therefore falls under federal law, a cantonal hospital under cantonal law. Two institutions doing the same job, two legal regimes.

Alongside official secrecy come specific duties of confidentiality, and they differ from sector to sector. For health and legal professions, Art. 321 of the Criminal Code applies. It names a closed list: clergy, lawyers, notaries, auditors, doctors, dentists, pharmacists, midwives, psychologists, nursing professionals and others, expressly including their auxiliary staff. The penalty is the same as for official secrecy, namely a custodial sentence of up to three years or a monetary penalty; prosecution follows only on complaint by the injured party, whereas official secrecy is prosecuted ex officio.

Banks and insurers are not on that list. For them, bank client confidentiality under Art. 47 of the Banking Act applies, with a logic of its own, alongside the supervisory rules of the Swiss Financial Market Supervisory Authority on outsourcing functions. We have not examined that part; it has to be settled before any decision in this field.

What you take on by running it yourself

The drawbacks are less visible than the benefits, because they only appear in operation. 'Running it' does not mean setting it up once and letting it go. It means:

There is no support. When the model in your building answers wrongly, there is no hotline. There is you.

And the licence is not automatically free. 'Open weights' means the model files can be downloaded. It does not mean you may do anything you like with them.

Why open weights are not free use The Chinese group Tencent excludes the EU, the United Kingdom and South Korea from the licensed territory of its video model. Switzerland is not on that list, so the model may be used here. That is precisely the lesson: the territorial scope sits in the licence and follows no logic you could guess. With the next model the list may read differently. Read the article →

The four questions before any procurement

The debate inside administrations usually turns on the wrong axis. It runs between 'cloud' and 'run it ourselves', as though that were a matter of principle. A more useful way to sort it is by data: what arises, and what follows from that.

Once the legal question is settled, the second one follows: which model can actually do your job? The answer has been measured, though it comes from Germany, and one Swiss model performs worse than many expect.