FDPIC and NCSC · campaign ·
Generative AI at work: the campaign of the FDPIC and the Federal Office for Cybersecurity
By Advisorn · guidance, not advice
In brief
The FDPIC and the Federal Office for Cybersecurity (NCSC) point out that entering personal data into a generative AI tool is processing subject to the FADP. At work these are often data of customers, patients or staff, which can leave the business more easily than one thinks.
What happened
For cybersecurity month (October 2026) the FDPIC and the NCSC launched a joint campaign on the risks of generative AI in the workplace. The frequently asked questions on the use of AI are published on the NCSC's website.
The FDPIC had already made clear in 2025 that the FADP applies directly to processing carried out with AI.
What it means for an SME
Decide which tools may be used, with which data and with which settings, and write it down in a policy your staff know.
Assess the tool's provider like any other: where it processes the data, whether it uses them to train its models, what contract it offers.
Source: FDPIC communication of 16 October 2026. General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.