Executive Summary

The Grok incident against Federal Councillor Karin Keller-Sutter in March 2026 exposed a regulatory gap in Switzerland: who is liable for AI damage – the prompter, the platform, or the provider? On 12 February 2025, the Federal Council chose a middle path and decided to ratify the Council of Europe Convention instead of the EU AI Act. A consultation proposal is to be created by the end of 2026, while the EU is implementing its AI regulation in full from August 2026 onwards and Germany has already passed its implementation law. The structural contradiction: Switzerland is regulating AI infrastructure it does not control – 54,000 Microsoft 365 workstations with Copilot enabled and the government-internal Gov-GPT based on Meta's Llama.

People

Topics

  • AI regulation and liability questions
  • Digital sovereignty and cloud dependency
  • EU AI Act and international harmonisation
  • Open-source alternatives and infrastructure transition
  • Platform responsibility and legal enforcement

Clarus Lead

Switzerland finds itself in a temporal and technological dilemma: while it plans AI regulation, its government infrastructure is already outsourced to US cloud platforms. The Federal Council responds to the Grok crisis with working meetings and feasibility studies until 2026/2027, while the EU is already fully implementing its regulation and Germany has established a central market authority. Particularly striking: an internal EDA audit showed that the safeguard against classified cloud uploads "only partially" functions – while Federal Councillor Keller-Sutter simultaneously sues a US chatbot. The reversal on 18 April (reduction of Microsoft dependency) comes months after the completion of a widespread Copilot rollout without parliamentary or training-related approval.

Detailed Summary

The Grok case as a test case for legal enforcement: On 10 March 2026, a 75-year-old retiree used Elon Musk's chatbot to compose vulgar and sexist insults against Keller-Sutter. She filed a criminal complaint for defamation and insulting behaviour and implicitly called for the prompter, operator and platform to be legally reviewed. Criminal law professor Monika Simmler (University of St. Gallen) sees good chances of holding the prompter liable – the AI is a tool, not an exculpatory reason. Platform liability, however, is only provable if operators can be proven to have accepted rights violations. SVP National Councillor Roland Rino Büchel compared the case to knife manufacturer liability; however, this comparison fails to recognise that AI systems independently compose insults, whereas a knife does not.

Regulation pace and European contrast: The Federal Council followed the middle option of a BAKOM assessment on 12 February 2025: ratification of the Council of Europe Convention with primary state requirements, less far-reaching than the EU AI Act. The EJPD and UVEK will develop a consultation proposal and action plan by the end of 2026; legislation will follow at the earliest in 2027. At the same time, EU Regulation 2024/1689 applies in full from 2 August 2026, with high-risk AI rules from August 2026 and embedded systems from August 2027. Germany passed the AI Market Monitoring and Innovation Promotion Act (KI-MIG) on 11 February 2026, with central Federal Network Agency supervision, AI service desk and real-world laboratories. France is pushing industrially: Macron's 109 billion offensive, Mistral data centre near Paris (operational by late June 2026), Franco-German administrative AI with SAP and Mistral. Switzerland held a working meeting on 27 October 2025 with 60 interest group representatives; key concepts were "regulation with proportion", "transparency" and "fairness".

Infrastructure paradox and sovereignty reversal: By the end of 2025, the federal government rolled out Microsoft 365 to 54,000 workstations – including the Defence Department and the Federal Data Protection Commissioner – with Copilot enabled by default. Training on Copilot use: none. Political pre-approval: none. An internal EDA audit found that the technical safeguard against uploading classified documents "currently only partially" functions. The government-internal experiment Gov-GPT (available since November 2024 to Federal Councillors and senior officials) uses Meta's open-source model Llama 3 – a US corporation product. Swiss showcase model Apertus (ETH, EPFL, CSCS) is used by strategic partner Swisscom primarily internally and for testing purposes. For end-customer products, Swisscom relies on Claude (Anthropic) and OpenAI variants – Apertus does not meet the requirements of a mass consumer product. Federal Chancellor Viktor Rossi bluntly described the situation in February 2026: the federal administration is dependent on external providers and large foreign corporations.

The reversal came on 18 April 2026: According to NZZ research, the federal government is aiming for a gradual reduction in Microsoft dependency – months after the rollout was completed. The BOSS project under the Federal Chancellery and BIT is testing openDesk from the German Centre for Digital Sovereignty (ZenDiS); a feasibility study is to provide recommendations by mid-2026. Schleswig-Holstein has already switched completely; Digital Transformation Delegate Daniel Markwalder is in direct contact with the federal state.

Key Statements

  • Liability Gap: The Grok-Keller-Sutter case will be a test case for Swiss legal enforcement against prompters, platform operators and AI providers – relevant case law does not yet exist.

  • Speed Differential: Federal Council plans consultation by end of 2026; EU AI Act applies in full from August 2026; Germany already passed implementation law in February 2026.

  • Structural Contradiction: Swiss AI regulation is created on 54,000 newly rolled-out Microsoft 365 workstations with Copilot enabled and Gov-GPT based on Meta-Llama – without prior parliamentary approval or comprehensive training.

  • Sovereignty Reversal: According to NZZ research from 18 April 2026, the federal government is aiming for gradual reduction of Microsoft dependency – just months after rollout completion.

  • Swisscom Dilemma: Apertus strategic partner relies on Anthropic and OpenAI in end-customer products because Apertus "does not fully meet the requirements".

Critical Questions

  1. (a) Evidence/Data Quality: What reliable data exists on how often and to what extent classified federal documents have already landed in the Microsoft cloud – beyond the partially non-functioning EDA safeguards?

  2. (a) Source Validity: How representative was the selection of 60 participants in the BJ working meeting of 27 October 2025? Were civil rights organisations and civil society adequately represented relative to the tech lobby?

  3. (b) Conflict of Interest: How compatible is the Federal Council's business-friendly regulatory course with the simultaneous goal of digital sovereignty – do not primarily those US corporations benefit, from which the federal government actually wants to distance itself?

  4. (b) Independence: How can a Swiss AI authority operate independently when its own working environment (Microsoft 365 with Copilot) runs on US Cloud Act infrastructure?

  5. (c) Causality: Does EU harmonisation actually lead to better fundamental rights protection, or does it merely shift enforcement to a level where Switzerland has no influence?

  6. (c) Counter-hypothesis: Would reallocation of resources from Microsoft licences (1.1 billion CHF over ten years) to Apertus and openDesk be structurally more effective than any AI regulation proposal?

  7. (d) Feasibility: How is Switzerland supposed to enforce platform liability if the most important AI providers have no legal Swiss presence and US law claims precedence?

  8. (d) Side Effect: Does Switzerland not face exactly that market access disadvantage it wanted to avoid with the middle path – if it lags regulatorily until end of 2026 while the EU AI Act already applies?

Source Directory

Primary Source: clarus.news – AI Regulation Switzerland: Middle Ground on American Infrastructure (21.04.2026) https://clarus.news/de/blog/ki-regulierung-schweiz-mittelweg-auf-amerikanischer-infrastruktur-20260421-de

Supplementary Sources:

  1. Federal Council: Press Release "AI Regulation: Federal Council wants to ratify Council of Europe Convention" (12.02.2025)
  2. NZZ: "The Federal Government Wants to Ditch Microsoft" (18.04.2026)
  3. NZZ: "Federal Councillor Keller-Sutter Defends Herself Against Chatbot from X" (April 2026)
  4. Blick: "Data Protection Risk: Microsoft Copilot in Federal House" (February 2026)
  5. German Federal Government: AI Act Implementation (KI-MIG) (11.02.2026)
  6. ETH Zurich / EPFL / CSCS: Apertus Launch (02.09.2025)
  7. AlgorithmWatch Switzerland: Statement on BAKOM Assessment (February 2025)

Verification Status: ✓ 21.04.2026

This text was created with the support of an AI model. Editorial Responsibility: clarus.news | Fact-Check: 21.04.2026