Published on 16 October 2026

AI in our everyday working lives: Making the most of the opportunities, protecting our data

Whether you’re writing emails, translating texts or analysing spreadsheets, artificial intelligence is now an integral part of everyday working life for many people in Switzerland. As with any new tool, it is worth understanding its capabilities and limitations, and knowing what happens to the data you enter. After all, anyone who thoughtlessly enters personal, confidential or business information can easily end up oversharing with an AI tool.

Anyone who enters their own or other people’s personal data into an AI tool for the sake of efficiency often reveals more than they realise. This is known as ‘oversharing’: the careless disclosure of information without being fully aware of the implications for data protection. In a professional context, this applies not only to one’s own data, but often also to personal data requiring special protection – such as that of customers, patients or staff – as well as trade secrets, know-how that should never actually leave the company.

In collaboration with the Federal Data Protection and Information Commissioner (FDPIC), the NCSC has therefore addressed key issues surrounding the use of AI in everyday working life and set out specific recommendations on how to avoid oversharing with AI tools in the workplace.

Here’s how to use AI tools more responsibly

• Examine AI-generated content with a critical eye.
• Before entering any information, check whether it contains any sensitive or personal data, such as personal details, customer data or trade secrets. Make sure you anonymise these.
• Where possible, use the business or enterprise version of your organisation’s AI tools rather than personal accounts.
• Be aware of when your data might be used for training purposes and when it is not. Make use of any opt-out options where available.

General and legal questions about AI

• What is generative AI?

  Generative AI is artificial intelligence that independently generates new content (e.g. text, images, audio or code) based on training data. Well-known examples include ChatGPT, Claude and Midjourney. It recognises patterns in the data it has been trained on and uses these to generate new, similar content, rather than simply reproducing existing information.

• What are the capabilities and limitations of generative AI in 2026?

  Today, generative AI can generate text, images, music and program code, translate in near real time, and act as an autonomous agent to carry out tasks such as internet research or data analysis. Language models generate text based on statistical correlations but do not possess knowledge or understanding in the human sense. As such, information output may not be factually correct, a phenomenon referred to as ‘hallucination’. At present, AI-generated content is still recognisable as such. However, distinguishing it from human-generated content will become increasingly difficult in the future. Among other things, certain biases could emerge in the answers provided by AI. In other words, there is a risk of algorithmic discrimination, based on characteristics such as gender, origin or lifestyle. This is currently the subject of research and studies and is an issue being addressed by the Federal Commission against Racism (FCR) and the Federal Commission for Women’s Issues (FCWI).

• How can one recognise AI-generated content (images and text)?

  The difficulty lies in the fact that AI models are constantly evolving. This means that a valid identifying feature today may not be valid tomorrow. While many of the warning signs described below are becoming less reliable as AI models improve, they can still provide useful clues when assessing whether an image may have been generated by AI (e.g. objects of the wrong size, incomprehensible text, body parts in the wrong place). In a four-part summer series, the NCSC demonstrated just how effective current AI models are and where fraudsters are already using artificial intelligence today.

  Weiterführende Informationen
  Test your AI knowledge

  Images
  Modern AI models (e.g. Midjourney V7, GPT Image 1) hardly ever make classic mistakes such as getting the number of fingers wrong. The simple ‘finger check’ can therefore no longer be relied upon. Nevertheless, there are still some useful indicators. The most typical AI errors fall into one of six groups: physical and geometrical inconsistencies, problems with depicting human anatomy and text, unexplained image distortions, and scene compositions that are semantically implausible. Visual indicators may include the following:

  • Body parts, in particular, still appear oddly in some cases, but this is becoming increasingly rare.
  • Where text or logos appear in the image, the lettering is often ‘almost correct’. Letters look appropriate but do not form a real word; brand logos in the background are another classic example.
  • Compared to real photographs, vanishing lines in AI images often intersect at several different points, which makes the perspective and geometry appear slightly unnatural..
  • People often do not look directly into the camera. In many cases, backgrounds are also blurred.
  • An AI-generated scene can appear exaggerated or implausible.

  The strongest conclusion is usually drawn from a combination of several consistent signals. When in doubt, check the source, use common sense and don’t share information too hastily.

  Further information:
  Detecting AI-generated images today and in the future
  CYD Campus: Detailed guide to detecting AI-generated images (CYD Campus)

  Text
  AI-generated website content is often well-structured, grammatically correct and neutral in tone. However, they often lack depth and individuality and have a very uniform style. You usually need to look at several clues together to tell whether a text or a website may have been generated by AI. Some large language models (LLMs) have a very distinctive writing style that can be recognised. However, simply specifying a different writing style in the input is enough to disguise the text’s origin. Among other things, logical errors may occur, such as incorrect conclusion. The NCSC lists the following signs as indicative of AI-generated content:

  • Use of em dashes;
  • Overuse of bold text;
  • Specific to Switzerland: the use of the sharp ‘ß’ in German;
  • Even sentence length and structure;
  • Solid lines between paragraphs.

  Further information:
  Identifying AI-generated texts and web content

• Can AI be used to detect AI (for example, to check whether a photo is a deepfake)?

  Yes, there are various tools such as IdentifAI, which has been tested by the Cyber-Defence Campus (CYD Campus). According to the CYD Campus, this type of tool could one day even be more useful than the human eye, as AI models will continue to be refined over the next five years, making the results appear more natural and therefore harder to detect.

• What legal issues could arise from the use of generative AI, as well as from the integration of AI components and agents into business processes?

  Anyone who enters their own personal data or that of customers into an AI tool for the sake of efficiency often reveals more than they realise. This phenomenon is known as ‘oversharing’: the careless, often well-meaning disclosure of information without fully understanding the consequences for data protection. In a professional context, this concerns not only personal data, but often also sensitive personal data belonging to third parties (including customers, patients and employees), as well as trade secrets and confidential information that should never actually leave the company.

• What data are fed into AI systems?

  When using AI tools, more personal data often ends up online than we realise. Simply copy the entire text of an email into a prompt field and you have already fed personal data into the AI system. The term ‘sensitive personal data’ within the meaning of the Federal Act on Data Protection (FADP) refers to customer data, employee records, health data or lines of code containing access credentials to databases that contain personal information. The processing of sensitive data is subject to stricter controls.

  AI systems can also be trained using data gleaned from company websites and social media profiles. These include, for example, audio and image data, as well as other personal details. Fraudsters can easily exploit this data, for instance, to carry out highly convincing CEO fraud using highly personalised emails, voice spoofing and deepfakes.

  In an explanatory video on deepfakes, the NCSC demonstrates just how easy it is to perpetrate CEO fraud.

• Are there any data protection regulations in Switzerland applying specifically to AI?

  As early as 2023, the Federal Data Protection and Information Commissioner (FDPIC) pointed out that users must check whether data protection principles are being complied with before entering text or images. Current data protection legislation is directly applicable to AI. The FADP is formulated in such a way as to apply to all types of technology and is therefore also directly applicable to the use of AI-supported data processing. When developing new technologies and planning use cases, manufacturers, providers and users of such applications are therefore legally required to ensure that data subjects have the highest possible degree of digital self-determination.

• Will data protection regulations need to be adapted to AI, or will a new law be required in future?

  The current Federal Act on Data Protection (FADP) is designed to be technology-neutral and, in principle, already applies to the processing of personal data by AI systems, whether during training or when users enter prompts. The question that arises is not whether data protection applies, but whether the existing provisions effectively address the specific risks posed by artificial intelligence with regard to transparency, traceability of automated decisions or discrimination resulting from algorithmic bias.

  The Federal Council has tasked the Federal Department of Justice and Police (FDJP) with drafting a consultation paper on AI regulation in collaboration with the Federal Department of the Environment, Transport, Energy and Communications (DETEC) (specifically with the Federal Office of Communications (OFCOM)) and the Federal Department of Foreign Affairs (FDFA). The draft is intended to transpose the Council of Europe Convention on Artificial Intelligence into Swiss law and to set out the necessary legislative measures, particularly in the areas of transparency, data protection, non-discrimination and oversight. A sector-specific, risk-based approach will be used for the corresponding consultation, which is expected to take place in January 2027. This approach is deliberately more streamlined than comprehensive horizontal regulation.

• What legal implications (both positive and negative) could this have for businesses? Where do the hidden risks lie?

  There is a risk of breaching the processing principles set out in Article 6 of the Federal Act on Data Protection (purpose limitation, proportionality, transparency). Should a data breach occur, the incident may not only trigger reporting obligations to the Federal Data Protection and Information Commissioner (FDPIC), but may also cause reputational damage. In the event of a deliberate breach of certain obligations, the responsible parties may even suffer criminal penalties.

  The principle of transparency is key: manufacturers, providers and users of AI systems must disclose the purpose, functioning and data sources of their applications. In the case of language models that communicate directly with users, there is also a legal right for them to know whether they are communicating with a machine and whether their own input is being used to train the system.

  The greatest hidden risk lies in the fact that many AI tools can use input data to train future models, unless this has been contractually excluded. Once information has been fed into the system, it cannot, in practice, be retrieved and, in the worst-case scenario, may be incorporated into responses to other users.

  For example, the automated extraction of publicly accessible data (‘data scraping’) for the training of large language models poses a risk. In 2023 and 2024, the FDPIC, together with other international data protection authorities, published guidance on this matter, which obliges companies to comply with data protection regulations when training their models and to implement effective safeguards against illegal data scraping.

  Finally, careful verification of sources remains essential. This becomes particularly important in recruitment processes, for instance, when AI-assisted pre-selection or automatically generated application documents are accepted without verification. The prohibition of discrimination is also at stake here. In this context, the FDPIC emphasises the right, enshrined in the Federal Act on Data Protection (FADP), to have an automated individual decision reviewed by a human being. AI tools should support critical thinking, not replace it.

• Generating texts, images and even music raises questions about copyright. Who owns this content? When and for what purposes can I take legal action?

  In principle, content generated entirely by AI is not protected by copyright, as only human creations are protected under Swiss law (Art. 2 and 6 of the Copyright Act, CopA). Prompts are not currently regarded as a human creation. Neither Switzerland nor the European Union (EU) has introduced AI-specific regulations. Since mid-March 2026, the European Parliament has been calling for greater protection for authors (current legal basis: Digital Single Market Copyright Directive (DSM Directive), and Article 53 of the Artificial Intelligence Act, AI Act). The CopA is currently undergoing a revision and consultation process, which should be completed by the end of 2026.

  A person may bring a claim if (1) AI output imitates an existing protected work too closely, or if (2) the LLM training involves unlawful access to training data (e.g. use of the data despite the user having opted out). In November 2025, the Munich Regional Court ruled in favour of rights holders.

  Such legal disputes are resolved through civil proceedings or criminal complaints. In the case of online infringements, a report can be sent to the hosting provider (notice and takedown). If necessary, one may also seek to engage in dialogue with the opposing party and consult a specialist solicitor.

  Weiterführende Informationen:
  Swiss Federal Institute of Intellectual Property (IPI)   
  FAQ – AI and copyright (IPI).

• How can a more judicious use of AI be encouraged in the workplace?

  A more judicious approach to AI can be encouraged by striking the right balance between efficiency gains and a loss of control over one’s own data. Once data has left the company, it is difficult to retrieve it or have it deleted.

  Organisations must establish clear internal guidelines and policies (which tools are permitted, what data must not be entered), provide training for staff, regulate the use of enterprise solutions with a contractual guarantee that the data will not be used for training purposes, and implement technical measures such as data loss prevention tools.

  For projects and products that utilise AI, it is important to involve users right from the outset. This instils confidence in them, clarifies the technological framework and turns them into advocates of the project rather than opponents. Consequently, the idea that various types of content will be entirely synthetic must be woven into the corporate culture.

Are there any important questions that are still to be answered? Contact us.

Further information

Test your AI knowledge
What the future holds – Interaction in the age of AI
Detecting AI-generated images today and in the future
Identifying AI-generated texts and websites
Data Protection Act and Artificial Intelligence (FDPIC)
Copyright and Artificial Intelligence (IPI)