EU AI Act: what applies to SMEs in Switzerland and Liechtenstein?

The AI Act also applies to companies based outside the EU as soon as their AI has an effect in the EU. Article 2 of the regulation covers providers that place AI systems on the EU market. It also covers providers and deployers in third countries where the output of their AI system is used in the EU. The same principle applies under the Cyber Resilience Act to software and connected devices offered in the EU. Read more in our guide "Cyber Resilience Act: what applies to software from SMEs in Switzerland and Liechtenstein?".

For a Swiss SME, this means: a chatbot on your website used by customers from Germany or Austria is covered. So are AI-generated images in a campaign for the EU market, or AI-assisted pre-screening of applications for a branch in the EU. If you only use AI internally and for Swiss customers, the AI Act generally does not affect you directly.

Not directly, yet. As an EEA member, Liechtenstein will only apply the AI Act once it has been incorporated into the EEA Agreement. According to EFTA, Iceland, Liechtenstein and Norway are still reviewing the regulation for incorporation. As of November 2026, there is no decision of the EEA Joint Committee.

Liechtenstein will then need an implementing act that designates the competent authorities and sets out penalties. The Office for Digital Innovation of the national administration is drafting it. It has not given a date for entry into force.

In practice, this changes little. Liechtenstein SMEs whose AI output is used in the EU already fall under the AI Act through the market location principle, just like Swiss companies. The Office for Digital Innovation recommends preparing now. Once incorporation is complete, the AI Act will also apply in Liechtenstein to purely domestic cases.

The Digital Omnibus postpones the high-risk obligations, not the transparency obligations. The Council and Parliament reached a political agreement on 7 May 2026. Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

The deadlines for the prohibitions, AI literacy, providers of general-purpose AI models and the transparency obligations under Article 50 remain unchanged. The timeline shows all deadlines and the main changes for SMEs.

For an SME that uses AI as a deployer without a high-risk application, there are five points: AI literacy under Article 4, recognisable chatbots, disclosed AI content, an inventory of AI use, and data protection under the Swiss Data Protection Act in Switzerland and the GDPR in Liechtenstein and the EU. None of them requires certification or notifying an authority. The checklist for the next 90 days further down turns these five points into concrete steps.

People chatting with an AI system must be told so, unless it is obvious. The obligation lies with the provider. As a deployer, check whether your tool shows the notice and add it yourself if not.

Our guide "AI automation in SMEs" explains in detail how to build AI workflows with human approval, an audit trail and a data protection concept.

High risk concerns a small number of clearly defined areas of use. From 2 December 2027, deployers of such systems must, among other things, ensure human oversight by trained staff, keep logs and inform employees and affected persons.

Typical high-risk cases in an SME:

Most AI automation in everyday SME work is not subject to high-risk obligations. Invoice recognition, email sorting and drafting quotes are not on the list of high-risk areas in Annex III. They do not assess people; they read documents and make suggestions. A person checks and approves.

The labelling of AI text does not apply here either. A quote or a reply to a customer is not a publication on matters of public interest. Machine-readable marking of AI-generated content is the model provider's job, not yours.

Still, review each workflow individually. As soon as it assesses employees or job applicants, the classification changes.

These steps cover the obligations that apply today and show early on whether a high-risk case is involved. For an SME, this is a manageable effort, not a major project.