EU laws for Swiss companies · ISO/IEC 27001:2022
Which EU laws apply to my Swiss company?
A short scoping and readiness check for companies established in Switzerland (or elsewhere outside the EU) that sell, provide services or process data in the EU. 41 requirements test the extraterritorial triggers of the GDPR, the AI Act, NIS2, DORA and the Cyber Resilience Act and the first obligations each one brings (EU representatives, reporting, contractual flow-downs, CE marking). Each requirement is mapped to ISO/IEC 27001:2022. Regulatory snapshot: 02/11/2026.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- Report: free summary PDF; with Pro the full report with action plan, guidance, control map, roadmap and Excel export.
41 requirements · 7 assessment areas · mapped to ISO 27001 · 15-30 minutes
Assessment areas
- SCO – Scoping and EU-exposure inventory
Start from facts, not from laws: list where your customers, users, establishments, data flows and products are, then test each EU law's territorial trigger against that inventory. Record a yes/no/borderline conclusion per law with its reasoning, signed off by management, and re-run it whenever you enter a new market, launch a product or sign a major EU customer. - GDPR – GDPR for non-EU controllers and processors
A Swiss company without an EU establishment is caught by the GDPR when it offers goods or services to people in the EU or monitors their behaviour there (Art. 3(2)). It then needs an EU representative, a record of processing, breach handling under Art. 33-34 and GDPR-grade notices, alongside the Swiss nFADP. Data flowing from the EU to Switzerland is covered by the EU adequacy decision for Switzerland, confirmed in the 2024 review. - AIA – AI Act extraterritorial scope
The AI Act applies to providers placing AI systems or general-purpose AI models on the EU market wherever they are established, and to non-EU providers and deployers whose AI output is used in the EU (Art. 2(1)). Classify every AI system you sell or use, check for prohibited practices, and appoint an authorised representative where the Regulation requires one. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27/07/2026) moved the high-risk dates to 02/12/2027 (Annex III) and 02/08/2028 (Annex I). - NIS – NIS2 – jurisdiction and supply chain
NIS2 reaches Swiss companies in two ways: directly, if you provide certain digital services (DNS, TLD, cloud, data centre, CDN, managed and managed security services, online marketplaces, search engines, social networks) in the EU without an EU establishment, which requires an EU representative (Art. 26(3)); and indirectly, because EU essential and important entities must manage supply-chain security (Art. 21(2)(d)) and will flow requirements down to you by contract. - DORA – DORA – ICT services to EU financial entities
DORA does not regulate Swiss ICT providers directly, but every EU bank, insurer, investment firm or payment institution you serve must include the Art. 30 contractual provisions, record you in its register of information and be able to audit and exit you. If you could be designated a critical ICT third-party provider, Art. 31(12) requires an EU subsidiary within 12 months of designation. - CRA – Cyber Resilience Act – products with digital elements
Any hardware or software product with digital elements made available on the EU market falls under the CRA, regardless of where the manufacturer is based. Vulnerability and incident reporting through the ENISA single reporting platform applies from 11/09/2026, also to products already on the market; essential requirements, conformity assessment and CE marking apply from 11/12/2027. Switzerland is not covered by an EU agreement for the CRA, so Swiss manufacturers face it as third-country manufacturers. - GOV – Governance, coordination and monitoring
Overlapping EU regimes and Swiss law (nFADP, Information Security Act, FINMA rules) need one owner, one register of obligations and one incident playbook. Keep a regulatory watch on pending EU changes (Digital Omnibus on data and incident reporting, CRA implementing acts) and review the scoping conclusions at least yearly in the management review.
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 25/05/2018 | GDPR | GDPR applicable, including Art. 3(2) for non-EU controllers and processors and the Art. 27 representative duty | In force |
| 01/09/2023 | GDPR | Swiss revised Federal Act on Data Protection (nFADP) in force – to be coordinated with the GDPR | In force |
| 15/01/2024 | GDPR | Commission report on the first review of adequacy decisions: Switzerland (Decision 2000/518/EC) continues to provide an adequate level of protection | In force |
| 17/10/2024 | NIS2 | NIS2 transposition deadline; national measures apply from 18/10/2024, including the EU representative duty for non-EU digital providers | In force (national laws; some Member States late) |
| 17/01/2025 | DORA | DORA applicable: Art. 30 contractual provisions and register of information for ICT third-party services to EU financial entities | In force |
| 02/02/2025 | AI Act | Prohibited practices (Art. 5) and AI literacy (Art. 4) apply | In force |
| 02/08/2025 | AI Act | General-purpose AI model obligations and Art. 54 authorised representative; governance and penalties | In force |
| 18/11/2025 | DORA | First designation of critical ICT third-party providers; third-country CTPPs must establish an EU subsidiary within 12 months (by 18/11/2026) | In force – imminent for designated CTPPs |
| 11/06/2026 | CRA | CRA rules on notification of conformity assessment bodies (Chapter IV) apply | In force |
| 02/08/2026 | AI Act | Art. 50 transparency obligations apply (marking for systems placed on the market before this date: 02/12/2026) | In force |
| 11/09/2026 | CRA | Reporting of actively exploited vulnerabilities and severe incidents (Art. 14) applies, also to products already on the market | In force – priority |
| 02/12/2026 | AI Act | Digital Omnibus on AI (Reg. (EU) 2026/1744): new prohibitions (non-consensual intimate content, CSAM) and end of grace period for Art. 50(2) marking | Imminent – priority |
| 02/12/2027 | AI Act | High-risk obligations for Annex III systems, including Art. 22 authorised representative (postponed by Reg. (EU) 2026/1744) | Future |
| 11/12/2027 | CRA | CRA fully applicable: essential requirements, conformity assessment, technical documentation, CE marking, support period | Future – prepare now |
| 02/08/2028 | AI Act | High-risk obligations for Annex I systems (AI in regulated products, postponed by Reg. (EU) 2026/1744) | Future |
Frequently asked questions
Is the EU laws for Swiss companies self-assessment free?
Yes. The questionnaire, the scoring, the dashboard and a summary PDF are free and need no account; your answers stay in your browser and are never sent to our servers. An optional Pro pass (18 EUR for 45 days, all assessments) adds the full PDF report with prioritised action plan and guidance, the evidence tracker, comparisons with previous assessments, the cross-framework view and the Excel export.
Which standard is the EU laws for Swiss companies assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-11-02 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
- Swiss nFADP (nLPD) – Federal Act on Data Protection (FADP/nLPD/revDSG, SR 235.1) and Data Protection Ordinance (DPO/OPDa/DSV, SR 235.11) – mapped to ISO/IEC 27701:2025
- NIST CSF 2.0 – NIST Cybersecurity Framework 2.0 (CSWP 29, 26/02/2024) - maturity by Function and Category, Current vs Target Profile - mapped to ISO/IEC 27001:2022
- SOC 2 Type II readiness – Gap analysis against the AICPA 2017 Trust Services Criteria (revised points of focus 2022) and DC 200 description criteria - mapped to ISO/IEC 27001:2022
Self-assessment tool for information purposes only; it does not constitute legal advice. It helps Swiss and other non-EU companies identify which EU laws may apply to them; conclusions on applicability, particularly in borderline cases, should be confirmed by qualified legal counsel. References and dates must be verified against the official texts (EUR-Lex, Fedlex); regulatory snapshot 02/11/2026. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.