Author: Georges Leuenberger, in dialogue with Claude (Anthropic).

Private AI accounts at work: ban first, then introduce properly.

An employee has a customer quote polished by her private AI account. Well meant, quickly done, and at that moment your company handed customer data to a provider it has no contract with. The first step against this costs a week of work: a countersigned directive. The second step is introducing AI at work in an orderly way, starting with the business subscription.

What actually happens when data is pasted into a private account

Under data protection law, your company passes personal data to a processor it has not selected, not vetted and not bound by contract. With private and free accounts, inputs may be reused to improve the models, depending on the provider.

Then come the duties that have nothing to do with data protection law: confidentiality clauses in your customer contracts, trade secrets of third parties, and for lawyers, doctors or fiduciaries the professional secrecy set out in the Swiss criminal code. In practice, trouble with the customer is often bigger than trouble with an authority.

Who pays the fine

The Swiss data protection act provides for fines of up to CHF 250,000 (art. 60 to 62 DSG). Three points about this are told wrongly again and again.

Only intentional conduct is punishable, though conditional intent suffices: anyone who considers a breach possible and accepts it is covered. Negligence remains unpunished.

The fine falls on the responsible natural person, meaning whoever effectively decides on the data processing. That can be the employee who copied the text. Often it sits closer to management, which decides on accounts, tools and approvals and let the matter run.

The company itself can be fined instead of the person if the fine does not exceed CHF 50,000 and identifying the responsible person would take disproportionate effort (art. 64 para. 2 DSG). Prosecution is cantonal, by public prosecutors or municipal magistrates.

The law is new, the case law is thin

The revised data protection act has been in force since 1 September 2023. Publicly documented criminal proceedings under it remain rare to this day. The first penalty order to become known came from the municipal magistrate of Zurich, dated June 2024, made public by the lawyer Martin Steiger. It hit the data protection officer of an email marketing company and amounted to CHF 450, because a data subject had been informed incompletely about the origin of her data.

Between CHF 450 and CHF 250,000 lies unmapped ground. Nobody can tell you today with any authority what passing customer data through a private AI account costs, and whom it hits. That gets settled case by case, in proceedings. Those proceedings are what you want to avoid being. That is the real reason for haste.

Step one: the directive, countersigned

Four points are enough. Which accounts apply to work. Which data belongs in no AI tool, such as customer files, personnel data, health data and anything under professional secrecy. Whom to ask when in doubt. From when the rule applies. Add the signature of every employee and file it in the personnel dossier. One page is enough.

A ban without a replacement gets circumvented, usually within weeks. So the same message should carry the date from which the business account is available.

Step two: a business subscription instead of a private account

The business and enterprise tiers of the major providers come with a data processing agreement (DPA) and do not train on your inputs by default. Which licence tier changes what, and which two things get confused constantly, is set out in our June viewpoint: ChatGPT, Claude and Gemini at work.

That covers everyday work. A draft supplier contract, a set of minutes, a quote: all workable in the business subscription. What stays delicate is the combination that turns innocuous fields into an assessment of a person, for instance an analysis of absence days together with position, line manager, branch and salary. Such analyses need their own review. No subscription solves that.

Step three: the foundation that answers the model question

Anyone who only switches the subscription has released the brake without setting a direction. Four pillars carry every use of AI: processes and organisation, data hygiene, infrastructure, compliance. The same assessment also produces the answer to the model question. Which task runs in house, which in a Swiss cloud, and when a frontier model is required because nothing else would be sound. For sensitive files, anonymisation comes first and re-identification afterwards. AI models are interchangeable. The foundation is not.

More on this: AI rarely fails on the technology and The most insidious trap in AI answers.

The ban is the quick part. The replacement is the decisive one.

We guide Swiss SMEs along this path, human, competent, holistic.