16 September 20269 min read

Swiss Employers: One Page AI Policy for Employees, FINMA Aligned

A single typed page pinned with one orange pushpin to an otherwise empty cork board, above a 1980s punch clock with time cards.

Adopt a short, risk-based AI policy now, one that names your approved tools, classifies data into a few clear tiers, and requires human review before any AI-assisted decision goes out the door. Anchor it to the FADP/nDSG, Art. 26 ArGV 3, and FINMA Communication 08/2024 if you’re regulated. Your first move this week: inventory every AI tool employees are already using, because you almost certainly have shadow AI running through personal accounts right now.

TL;DR:

An effective AI policy should identify approved tools based on data classification, with strict controls on confidential and sensitive information to prevent unauthorized disclosures.

Swiss laws mandate transparency, including notifying employees about AI data processing, and restrict behavior monitoring unless justified for safety or performance.

Appoint a dedicated AI owner or committee responsible for managing AI tools, maintaining a live inventory, and overseeing incident response and updates.

Rolling out the policy requires prior inventory, controlled pilots, clear procurement review, mandatory training, and establishing escalation procedures for new tools or incidents.

Regularly review and update the policy, at least annually, to adapt to new tools, incidents, or regulatory changes, ensuring ongoing risk management and compliance.

What Should an AI Policy for Employees Actually Include?

A working AI policy for employees fits on one page and gets read. Anything longer becomes shelfware. Start with a copyable structure and adjust the specifics to your organization’s risk profile.

Scope and definitions. Define “AI,” “generative AI,” and “automated decision” in plain language so nobody argues about whether a chatbot summary counts. Cover every tool touching company data, not just the obvious ones like ChatGPT or Copilot.

Roles. Name an AI owner (the person accountable for the policy), a model owner per use case, your data protection officer, and the business owner who signs off on new tools. Vague ownership is why most policies stall at the draft stage.

Approved tools. Build a whitelist and separate enterprise accounts from personal free accounts. This distinction matters more than almost anything else in the document.

Data rules. Map data classes to what’s allowed:

Public data: any approved tool, minimal restrictions.
Internal, non-sensitive: enterprise-tier tools only.
Confidential (client, financial, HR): enterprise tools with contractual data protections, no free-tier accounts.
Secret or professionally privileged: no cloud AI without legal sign-off, often on-premises only.

Three rules employees should memorize: be transparent about AI use in outputs, never paste restricted data into any tool, and always verify AI output before it becomes a decision or a deliverable.

What Swiss Laws Govern Workplace AI Use?

Swiss employers face specific, checkable obligations, not just general best practice. Under the FADP and its revised version (nDSG), employers must tell employees when their data is processed by AI, name the controller, state the purpose, and disclose any transfer abroad. Employees also retain the right to access and correct that information.

Workplace monitoring has its own limit. Article 26 of the Ordinance on Health and Safety restricts systems that track behavior, performance, or emotion, and such monitoring is unlawful unless it’s necessary and proportionate for safety or clearly defined performance measurement. An AI tool that scores tone of voice on support calls, for instance, needs a real justification, not just a vendor demo that looked impressive.

Financial institutions carry an extra layer. FINMA’s guidance sets out eight control areas: governance, inventory, data quality, testing, monitoring, documentation, explainability, and independent verification.

FADP/nDSG: transparency and data subject rights, applies broadly.
Art. 26 ArGV 3: monitoring limits, applies to any employer.
FINMA Communication 08/2024: governance depth, applies to supervised financial firms.
EU AI Act/GDPR: triggers when you process EU residents’ data or serve EU markets, often requiring a data protection impact assessment.

Who Owns AI Governance Inside Your Organization?

Someone has to own this, and “everyone” is the same as “no one.” A workable structure looks like this:

Appoint a central AI owner or small committee that includes IT, risk, legal, and HR. This group approves new tools and resolves disputes.
Assign a use-case owner for every AI deployment. That person documents the purpose, risk tier, and data sources before the tool goes live.
Run a shadow AI discovery pass. Check browser extensions, expense reports for AI subscriptions, and IT logs for unsanctioned SaaS traffic.
Build and maintain a live AI inventory listing every tool, its owner, its risk class, and its last review date.
Set an escalation path so a manager who wants to try a new tool knows exactly who signs off and how long approval takes.

A stepwise, cross-functional approach like this is what prevents shadow AI from becoming the default instead of the exception.

Pro Tip: Put the AI inventory in the same system you already use for vendor risk or software asset management. A second spreadsheet nobody checks is worse than no inventory at all.

How Do You Control Which AI Tools Employees Can Use?

The whitelist is where most policies either work or quietly fail. Tie it to data classification rather than trying to approve or ban tools in isolation.

Public/marketing data: most mainstream AI tools, enterprise or free tier.
Internal operational data: enterprise accounts only, with admin-level visibility.
Confidential data (HR files, client records, financials): enterprise contracts with explicit data protection terms; personal free accounts are banned outright.
Professionally privileged or trade-secret data: no cloud AI without legal sign-off; on-premises or dedicated tenancy only.

That last tier isn’t optional caution. Swiss legal analysis holds that pasting confidential or professional-secret data into a cloud AI service can count as unauthorized disclosure to a third party, regardless of what the vendor’s terms of service promise about training data. A contract clause doesn’t erase the disclosure.

Shadow AI makes this urgent: surveys put generative AI use through personal, unmanaged accounts among knowledge workers between a majority in 2025. Prompt rules should require pseudonymizing personal data before it goes into any prompt, banning source code containing secrets, and logging tenant-level activity through data loss prevention tools and sensitivity labels wherever your IT stack supports it.

How Should You Roll Out an AI Policy Step by Step?

Rolling out policy on paper and getting employees to actually follow it are two different projects. Sequence it like this:

Inventory and classify. Find out who’s using what before you write a single rule.
Pilot in a controlled group. Run new tools through a limited team first, with a data protection impact assessment if the use case touches personal data.
Check procurement terms. Confirm the vendor’s data processing agreement, data residency, audit rights, and, if data crosses borders, a transfer impact assessment.
Update staff regulations. Fold the AI policy into existing HR documents rather than issuing a standalone PDF nobody opens twice.
Train before go-live. Make training mandatory, not optional, and set monitoring metrics before the tool ships to the full team.

Each gate needs an owner who can say yes or no, or the rollout drifts.

How Do You Train Employees on AI Policy Effectively?

Training works when it’s short, role-specific, and repeated. A one-hour annual refresher beats a single onboarding session everyone forgets by month three.

Build role-based modules: what a customer service rep needs differs from what a finance analyst needs.
Hand out a one-page decision tree and an approved-tool card employees can keep at their desk.
Create a low-threshold reporting channel for mistakes, and actually fix problems people report, visibly.
Frame leadership messaging around enabling safe experimentation, not just restriction. Employees who feel policed reach for personal accounts instead.

Pro Tip: Ask one question in every training session: “What would you do if a client’s contract landed in your prompt by accident?” The answer tells you instantly whether the policy has actually sunk in.

What Happens When an Employee Misuses an AI Tool?

Incident response needs to move faster than the damage compounds.

Contain immediately. Lock the account, and if the vendor allows it, request deletion of the exposed data.
Classify the incident. Determine the data class involved and whether it triggers a data protection impact assessment or a regulatory notification window under FADP or GDPR.
Log everything. Keep records of the incident, the data involved, and the remediation taken, since Swiss guidance recommends retaining these logs for audit and explainability purposes.
Review and revise. Run a lessons-learned session and update the policy or the whitelist if the incident reveals a gap.

What Does a One-Page AI Policy Actually Look Like?

Here’s the shape of a policy compact enough to paste directly into staff regulations.

Element	What it contains
Scope	Definitions of AI, generative AI, and automated decisions covered
Roles	AI owner, use-case owners, DPO, business sign-off
Whitelist	Approved tools by data class, enterprise vs. personal accounts
Data rules	Four-tier classification with per-tier prompt restrictions
Human review	Mandatory check before any AI output becomes a decision
Incident reporting	Contact point, response window, escalation path
Footer	Version number, policy owner, contact, next review date

Three rules go at the top in bold for employees who only read the first paragraph: disclose AI use, never input restricted data, always verify output. Advisors who work through this design consistently land on a small set of principles paired with a vetted whitelist rather than a long technical standard nobody finishes reading.

Who’s Behind This Guidance

This playbook is based on experience building and integrating AI systems for teams that need governance, not just enthusiasm, around their tools. We handle the technical side of policy work directly: AI automation builds, tenant setup, and hands-on masterclasses for teams rolling out their first AI usage rules. The pattern above reflects what actually survives contact with a real IT stack and a real legal team, not what looks good in a slide deck, highlighting how AI & Automation tools fit into practical workflows.

How Ampersand Labs Helps You Put This Into Practice

Writing the policy is the easy half. The harder part is configuring enterprise tenants correctly, setting up data loss prevention rules, and training a team that’s already using AI tools you don’t know about yet. That’s the gap Ampersand Labs closes: a policy audit paired with the actual technical implementation, whether that’s tenant configuration, AI automation work for your specific workflows, or a hands-on masterclass that gets your staff comfortable with the rules instead of resentful of them.

A first engagement usually starts with a short scoping call: what tools are already in use, what data classes matter most, and where the compliance gaps sit. From there, the audit, technical setup, and training are scoped as one connected package rather than three separate vendors handing off badly. If you’re ready to move past the draft-policy stage, get in touch through Ampersand Labs’s services page and start with that scoping conversation.

Sources

FAQ

Do Small Businesses Need a Formal AI Policy?

Yes. Even a two-page policy with a tool whitelist and data rules reduces the risk of shadow AI, which affects the majority of knowledge workers using unmanaged personal accounts.

Does Swiss Law Require Employers to Disclose AI Use to Staff?

Yes. Under the FADP/nDSG, employers must inform employees when their data is processed by AI, including the controller’s identity, the purpose, and any transfer abroad.

Can Employers Use AI to Monitor Employee Performance?

Only when the monitoring is necessary and proportionate under Article 26 of the Ordinance on Health and Safety; tools that track emotion or behavior without a clear safety or performance justification can be unlawful.

How Often Should an AI Policy Be Updated?

Review it at least annually, and sooner whenever a new tool category, incident, or regulatory change (such as a FINMA update) affects your risk classification.

Who Should Own the AI Policy Inside a Company?

A named AI owner or small cross-functional committee spanning IT, legal, risk, and HR, since a policy without a clear owner rarely survives its first real incident.

Have a project this touches on?

A free 10-minute call is the fastest way to find out whether we are the right studio for it.

Book a free 10-min call

Keep reading