Data management in Switzerland is no longer merely a technical matter of storage and backup; it has become a strategic priority at the intersection of law, geopolitics, and economic competitiveness. With the entry into force of the new Federal Act on Data Protection (nFADP), increasingly stringent sector regulations such as those issued by FINMA for financial institutions, and discussions around a potential adoption of the AI Act in Switzerland, Swiss companies are facing a fundamental question: where is the data located, who controls it, and is it being used to train AI models? 

Residency vs sovereignty: understanding the difference

The first step in understanding the challenge of data governance is to distinguish between two concepts that are often used interchangeably but are fundamentally different: data residency and data sovereignty. 

Data residency concerns the physical location of data. If the servers hosting corporate information are located in a data center in Zurich, that data “resides” in Switzerland. This is a geographical, tangible aspect that can be verified through infrastructure certifications. 

For years, many organizations have considered data residency sufficient: if data is physically located in Switzerland, it is protected by Swiss law. However, this assumption clashes with a legal reality that is often far more complex. 

Data sovereignty, on the other hand, concerns legal jurisdiction. Which laws apply to the data? Who has the legal right to access it? And here a fundamental issue emerges: residency does not guarantee sovereignty. 

For example, a Swiss company may entrust its data to a global cloud provider with data centers in Switzerland, thus complying with physical residency requirements. However, if that provider is a U.S. company, the data may still be subject to U.S. federal law, which allows American authorities to request access to data controlled by U.S. companies, regardless of where that data is physically stored. 

In other words, a data center in Zurich operated by an American company does not provide legal protection against requests from Washington. Data sovereignty can be compromised by the nationality of the service provider, not by the geographic location of the servers. 

Companies can no longer simply state that “the data is in Switzerland.” They must be able to prove that the data is under exclusive Swiss jurisdiction, immune from extraterritorial requests by foreign governments. 

The risks of overseas Big Tech 

The expansion of major data analytics and artificial intelligence players into Switzerland is a highly relevant example of the potential risks associated with technological dependence on foreign providers. 

Although these players often claim to operate as “mere subcontractors,” stating that they do not train their AI models on customer data and that environments remain isolated, several risks remain. These include extraterritorial interference and general legal uncertainty in the event of conflicts between contractual obligations toward Swiss customers and legal obligations toward foreign governments. This can lead to negative reputational consequences, potential regulatory violations, and a degree of ethical ambiguity for Swiss companies. 

The Swiss response: towards sovereign AI 

In response to these challenges, an alternative model of Swiss Private AI is emerging, one in which Artificialy plays an active role, based on a value proposition that no global player can offer: legal certainty through data sovereignty. 

A notable national example of this approach is the Apertus project, Switzerland’s first open, transparent, and multilingual artificial intelligence model, developed by EPFL, ETH Zurich, and CSCS. 

Artificialy also works with open-source models, enabling companies to choose private, local AI models instead of relying on GPT or Claude. This approach allows for full customization, a privacy-by-design methodology, and the preservation of intellectual property for models trained on corporate data. 

The most radical solution to data sovereignty is on-premises deployment. Artificialy’s Private AI Suite, for example, allows AI models to be installed directly on the customer’s physical servers, within the company’s security perimeter. Another concrete example is the recent step taken by the Canton of Ticino toward digital sovereignty and the protection of sensitive citizen data. The Cantonal Information Systems Center (CSI) implemented a new machine translation system based on Apertus, the Swiss open-source language model developed within the “Swiss AI Initiative” by ETH Zurich, EPFL, and the Swiss National Supercomputing Centre (CSCS). This represents the first operational use of Apertus by a Swiss public authority. The solution, developed by Artificialy, is hosted on CSI’s infrastructure and guarantees full control over all data. 

This approach offers clear advantages, including total physical control, since data never leaves the customer’s infrastructure, and guaranteed compliance, making it ideal for public administrations and highly regulated sectors such as healthcare and finance. 

On-premises deployment eliminates risk at its root: if data never crosses physical or legal borders, there can be no regulatory grey areas, and data cannot be used for re-training purposes. 

Not all organizations, however, can or wish to manage local infrastructure. In such cases, the solution lies in certified Swiss Hosting: data centers that are 100% Swiss, operated by Swiss-owned entities, ensuring that the entire chain, from hardware to corporate governance, remains under Swiss jurisdiction. 

Artificialy relies on specialized partners that offer this guaranteed model, combining the flexibility of the cloud with the legal certainty of national data sovereignty.