Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| Revised Federal Act on Data Protection (FADP) | Binding law, in force 1 September 2023. The FDPIC has confirmed the FADP applies to AI-supported data processing, including automated individual decisions (FDPIC communication, 8 May 2025). | Personal data processing by AI systems; information and safeguard duties around automated individual decisions, subject to the FADP's own exceptions. Using AAES does not discharge the controller's duties; other parties' obligations depend on their roles. |
| Guidance 08/2024 on governance and risk management when using AI · FINMA (18 December 2024) | Supervisory guidance. Not legislation, but it states what FINMA expects in supervisory dialog with supervised institutions; related instruments (for example Circular 2023/1 on operational risks and resilience for banks and securities firms, and the outsourcing rules) apply by institution category. | Central AI governance, a maintained AI inventory with risk classification, data quality, testing and monitoring, documentation, and responsibility that remains with the institution and cannot be delegated to a vendor. |
| Circular 2016/7 “Video and online identification”, partial revision · FINMA (8 October 2026) | Supervisory practice, adopted. Changes enter into force on 1 November 2026. | Client onboarding via digital channels under the AMLA. Adds liveness detection to online identification to address growing risks from new technologies, particularly artificial intelligence. It concerns identifying people, not agent actions. |
| Council of Europe Framework Convention on AI (CETS 225) · Swiss implementation | Signed, not yet ratified or implemented. The Federal Council decided on 12 February 2025 to seek ratification, and Switzerland signed on 27 March 2025 (Council of Europe treaty status); parliamentary approval, ratification and domestic implementation remain ahead. The Federal Office of Justice implementation project targets a consultation draft for end-2026. Treat any "in force" claim for Switzerland as unverified. | Future duties on AI systems' conformity with human rights, democracy and rule of law; the Federal Council's stated approach is implementation through existing law where possible, with targeted amendments. |
| EU AI Act: extraterritorial exposure | Foreign law that can still apply. Swiss organizations placing AI systems on the EU market, or whose AI outputs are used in the EU, can fall in scope. See the European Union note. | Cross-border reach for Swiss-headquartered groups serving EU clients. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Responsibility remains with the institution (FINMA Guidance 08/2024) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human oversight of consequential actions (FADP automated-decision safeguards; FINMA expectations) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Documentation a supervisor or internal audit can review (FINMA documentation expectations) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers whether the FADP, FINMA guidance, or future convention-derived duties apply to you.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026.
- Status changes. The convention's Swiss ratification and implementation were still pending when this note was reviewed. Re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.