Skip to content
KisunoAI
Self-host for free Get started
Pricing Docs Blog Get started Self-host for free

Public sector and data protection

The federal government has drawn a line through its own body of data: three workflows that respect it

The Federal Data Protection and Information Commissioner, Switzerland’s national data protection authority, has successfully pressed for GEVER case files, the content of Outlook mailboxes and all sensitive personal data to remain in the data centres of the federal administration while the introduction of Microsoft 365 is under way. This article shows on three workflows what an AI workplace looks like under that condition, and it names the requirement our managed operation does not meet.

Public sector and data protection Reading time: 12 minutes

In brief

  • In its 33rd activity report of 30 June 2026, the Federal Data Protection and Information Commissioner, Switzerland’s national data protection authority, writes that the use of commercial language models entails storage in the provider’s cloud for at least some time and with it “inevitably a risk to data security”. That is why the report calls federally owned AI systems an essential precondition.1
  • The same report records that case files and data from GEVER, the electronic records management of the federal administration, the content of Outlook mailboxes and all sensitive personal data remain in data centres of the federal administration and are processed exclusively there, while the introduction of Microsoft 365 is under way.2
  • privatim, the conference of the cantonal and communal data protection commissioners in Switzerland, holds that public bodies moving such data into the services of large international providers is inadmissible in most cases, and allows it only where the responsible body encrypts the data itself and the provider has no access to the key.3
  • That is exactly the condition our managed operation in Lupfig does not meet. Anyone who has to meet it runs Kisuno on their own server, and that is set out under Self-hosting.

Starting point: what the federal government has decided for itself

On 30 June 2026 the Federal Data Protection and Information Commissioner, the FDPIC for short and Switzerland’s national data protection authority, published its 33rd activity report. In the chapter on artificial intelligence there is one sentence that went almost unnoticed in the coverage. Federally owned AI systems, it says, are an essential precondition for reaching the stated goals while complying with data protection and information security, because they make sure that prompts and the data they contain are processed locally and made accessible only to the authorised organisational units. The use of commercial language models, by contrast, brings with it “storage on the provider’s cloud for at least some time and thus inevitably a risk to data security”.1

The second find sits a few pages earlier and is more concrete. In the reporting year the FDPIC successfully pressed for case files and data from the electronic records management of the federal administration, GEVER for short, along with the content of Outlook mailboxes and generally all sensitive personal data and personality profiles, to remain in data centres of the federal administration and to be processed exclusively there, that is with the federal government and not in the cloud.2 The Cloud Enabling Büroautomation project carries on, the introduction of Microsoft 365 has been decided and begun. The body of data at issue here is taken out of it. So the federal government has not decided against the cloud, it has drawn a line through its own body of data.

The cantons are going the same way, only more sharply. privatim, the conference of the Swiss data protection commissioners, which brings together the data protection authorities of the cantons and communes, adopted a resolution in Bern on 18 November 2025. In it, it holds that public bodies moving sensitive personal data, or personal data subject to a statutory duty of confidentiality, into the software services of large international providers is inadmissible in most cases, Microsoft 365 in particular. As its conclusion the resolution names a single condition under which it works after all: the data has to be encrypted by the responsible body itself, and the cloud provider must have no access to the key.3

Behind this lies no hostility to technology. Case numbers at the supervisory authority are rising: in the same reporting year 2,477 complaints reached the FDPIC, more than twice the 1,053 of the year before, along with 484 notified data security breaches against 363.4 Those figures say something about the load on the authority and nothing about large projects. The experience with large undertakings rests on another finding: on 8 July 2026 the Swiss Federal Audit Office presented a synthesis report drawn from 24 audits of the federal government’s key IT projects, with an investment volume of three to five billion francs, and finds in it that the overall planning remains incomplete and that the focus on effect and benefit is missing, just as it was ten years earlier.5 Anyone starting an AI project in this environment is asked first where the data sits, and only then what the model can do.

  1. The body of data sits in your data centres or on your own server
  2. For a single request, only the extract it needs goes out
  3. Answer with a source reference, entry in the log
  4. The body of data does not leave the controlled area; the single request goes to the model
The dividing line does not run between cloud and server, but between the body of data and the single request.

Who this affects, and what sets it off

The question of place does not arise for the federal government alone. According to the harmonised Eurostat survey, 19.95% of enterprises with ten or more employees in the EU used artificial intelligence in 2025, in Germany 25.97%, in Austria 29.95%.6 For Switzerland this table holds nothing, and we come back to that in the section on limits. Anyone working around the public sector notices the movement in questionnaires anyway, not in statistics.

That is because the position of the FDPIC and the privatim resolution reach well beyond the administration. They appear in tender documents, in data processing agreements and in the security questionnaires suppliers have to fill in. A fiduciary office working for a commune is handed them. A software house running a specialist application for a hospital likewise. The requirement travels down the supply chain long before it stands in a statute.

Five groups ask about it today, and they ask for different reasons. The table sets out what sets off the need in each case and what an AI workplace can contribute there. It does not set out what is legally permissible; that is decided case by case and under the data protection law that applies.

Who is asking What sets off the need What Kisuno contributes there
Federal administration and federal offices After the FDPIC intervened, GEVER case files, Outlook content and sensitive personal data stay in data centres of the federal administration Operation on your own infrastructure under the MIT licence, with no channel back to the provider, telemetry off by default
Cantons and communes The privatim resolution requires sensitive data to be encrypted by the body itself, with no provider access to the key Self-hosting on your own server, so that the body of data and the key stay in the same hands
Hospitals, schools and social insurance bodies Patient, pupil and insured person data is sensitive, and official and professional secrecy come on top Knowledge bases from your own documents with a source reference, permissions in the order user, role, group, server default
Suppliers and contractors of the public sector Security questionnaires and tenders take over the requirements of the contracting body, often word for word Data processing agreement and subprocessor list to hand over, audit log to export, details on governance
Law firms, fiduciary offices and practices with public sector mandates Professional secrecy under article 321 of the Swiss Criminal Code, for fiduciary mandates the contractual duty of confidentiality, plus the requirements of the commissioning body Connection to specialist applications over MCP, with permissions per tool and one log entry per call

What connects these five groups is not their legal form but the burden of proof. They have to make sure data stays in the right place, and they also have to be able to show it later, to someone else and without going through the whole case again. A tool that assures you it is safe does not help with that. A tool that logs what it has done and states where a statement comes from does help. This article is no substitute for legal advice.

Use case 1: opening up files and minutes without the body of documents leaving Switzerland

A department has twenty years of minutes, directives and parliamentary motions on file, neatly ordered by the records classification scheme and still not findable. The question is rarely what a single document says. It is when a rule was last changed and on what grounds. You put the body of documents into a knowledge base, that is a place for your own documents from which the AI colleague fetches only the matching extracts for each question. Back comes an answer stating which document and which passage it comes from.

What matters is where that place sits. It is on the instance, the installation that is run for your organisation. With self-hosting it stands with you; in managed operation it stands with us in Lupfig, in the ISO 27001 certified data centres of Green, where the certification covers the data centres and not us, and the body of documents then sits outside your own administration. To answer a single question, only the extract that question needs goes out, and it goes to the model; which model that is in managed operation is set out further down under Limits. The body of documents does not travel with it, and no model is trained on your content. What that means technically is set out under Security.

  1. Minutes, directives and motions in the knowledge base
  2. Only the matching extract goes to the question
  3. Answer with document and source reference, entry in the log
An archive turns into a reference work. The assessment stays with the case handler.

The limit belongs in the same place as the benefit. A source reference does not prove that the answer is correct. It makes it possible to check what the answer rests on, and that is something else. A language model can attribute a passage wrongly or take a repealed version for the one in force, and it does so all the more readily as the body of documents grows. Anyone passing an answer on opens the passage it names.

Use case 2: the answer from your own body of documents, with a source reference

At the counter and on the phone the same questions come back again and again. Which enclosures does an application need, which deadline applies, what does a permit cost, who is responsible. The answers sit in regulations, information sheets and fee ordinances, spread over several filing places and not everywhere at the same version. The AI colleague answers the question from that body of documents and names, for every statement, the document, the section and the version.

The benefit lies less in speed than in traceability. Anyone giving out an answer has to be able to back it up if it comes to that, later and to someone else. That is why the source reference is not an extra here, but the actual point. Personal data of the person asking is not needed for it. The question can be put in the abstract, and what is not put in cannot go out either.

  1. Regulations, information sheets and fee ordinances in the body of documents
  2. The question put in the abstract, without personal data of the person asking
  3. Answer with document, section and version
The answer stays an answer given by people. What becomes checkable is what it rests on.

And the limit we draw here explicitly: this is not a chatbot for your website, and we do not recommend it as one either. A system that answers the outside world directly moves the risk to where nobody reads it over any more. The sensible way is the other way round. The answer is drafted inside, a person checks it, a person gives it out. Legally binding rulings do not come about this way in any case.

Use case 3: the case that runs across several specialist systems

An application comes in, and the answer sits in three systems. The person in the residents’ register, the plot in the geoinformation system, the correspondence so far in the records management system. Today someone clicks through all three and writes up the result by hand. The AI colleague can take these steps over, provided the systems are connected. It plans the order, calls the released tools one after another, checks every intermediate result and finally puts up a draft for approval.

The connection runs over MCP, the Model Context Protocol, an open standard through which an AI system can address other systems. Such a connection to a single system is called a connector and is released individually. Permissions apply per tool and in the order user, role, group, server default. Write access has to be released separately. Every call stands in the audit log, the record of who used which tool and when, and you can export it. Which software can be connected today is listed on the Integrations page.

  1. The application as it comes in
  2. Calls to the register, geoinformation and records management, each one released separately
  3. Draft for approval, every call in the log
Permissions apply per tool. What is not released is not called.

Here too the limit, and it is a fundamental one. The system does not create human oversight, it makes it provable. Whoever approves the draft decides, and no log changes that. A log is also not an AI inventory. It shows what has gone through this route, and not what else is in use as AI in your organisation.

Limits: where we do not meet the requirement

Now the part a provider is better off saying itself, and we start with the limitation that weighs more. In managed operation, what goes out for a single request goes to a commercial language model, for the models from OpenAI (ChatGPT) and Anthropic (Claude) through Amazon Bedrock in the Frankfurt data centre; how that path runs in detail is set out in the article on the Anthropic models on Amazon Bedrock. Amazon is one of the providers privatim names in its resolution, and AWS is a US company, so the US CLOUD Act applies. The FDPIC’s sentence on commercial language models therefore applies to us as well. Alongside them, for higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. Anyone who has to rule out a commercial model as well runs the model and the instance themselves. The second limitation concerns the key. The privatim resolution names exactly one condition, and it is narrow. The data has to be encrypted by the responsible body itself, and the provider must have no access to the key.3 Our managed operation in Lupfig does not meet that. We run the instance, and we can access it under instruction if something goes wrong. A data centre in Switzerland changes nothing about it, because the condition does not ask about the place but about who holds the key. Anyone who has to meet it gets there with us only through self-hosting on their own server. The GitHub repository under the MIT licence is coming soon; until then the installation guide is available. And a point about ourselves that matters for federal offices and cantons: Kisuno is ready for production use, and access to the managed instance is allocated in stages because demand is high.

Just as honest is the other direction, even though it serves us here. The resolution addresses public bodies, not private companies. It is a joint position of the data protection supervisory authorities and not a legal norm; a court is not bound by it, and anyone quoting it as a ban overstates it. Not even all of them back it: the canton of Glarus made use of the opt-out under article 18.2 of the statutes.3 Conversely, anyone who ignores it underestimates how strongly such positions carry over into tenders and questionnaires. What applies in your case follows from the cantonal or federal law that applies. This article is no substitute for legal advice.

  1. Managed operation in Lupfig: we run the instance and manage the keys
  2. Self-hosting: the body of data and the keys stay with you
  3. For sensitive data in the services of large international providers, privatim requires the second route
  4. The server location alone does not answer this question
The condition does not ask where the data sits, but who holds the key.

With the FDPIC too, the small print is part of it. It writes about federally owned AI systems, that is systems of the federal government for the federal government, and it accompanies the preparations of the Federal Chancellery and the Federal Office of Information Technology, Systems and Telecommunication. It does not write about providers like us, and we do not read its statement as a recommendation for us either. What is usable is something narrower: the yardstick it applies. Requests are processed locally, and only the authorised organisational units have access.1 Anyone who wants to can be measured against that yardstick, and with self-hosting and a model of your own it is within reach.

The fourth point weakens our own market argument, and it belongs here all the same. On the use of AI in Swiss companies there is no official figure. In the harmonised Eurostat survey, which for 2025 reports values for the EU as a whole, for every member state and for Norway, Turkey and several candidate countries, Switzerland is missing entirely.6 What circulates for Switzerland, a usage rate of 57% for instance, comes from surveys commissioned by providers, in the case named by Amazon Web Services, and the sample size is not stated consistently across the reporting.7 Such provider studies are not worthless, but they are no substitute for official statistics, and we carry them here only to name the gap. Solid alongside them is the Austrian survey: 30% of enterprises with ten or more employees use AI, and of the enterprises without AI, 77% have never even considered using it.8 The obstacle there is therefore not rejection, but never having looked at it.

Lastly Austria, because two things are running there at once. The Network and Information System Security Act 2026 enters into force on 1 October 2026. Affected entities have to register from that day and by 31 December 2026 at the latest, and it concerns some 4,000 companies from 18 sectors instead of the roughly one hundred operators of critical infrastructure as before.9 At the same time a formal designation under article 70 of the European AI Act was still outstanding in June 2026, even though the deadline for it was 2 August 2025; by way of preparation, the AI service point at the RTR has been in place since 2024. A parliamentary question puts fifteen questions on the subject,10 and the answer of 2 June 2026 merely points to the lack of competence of the ministry asked.11 For companies that means: the cybersecurity duties come with a date, AI supervision comes without one. If you have to plan, you plan by the calendar you have. This section is no substitute for legal advice.

Frequently asked questions on the cloud, federal data and AI in public administration

May public authorities use Microsoft 365 for sensitive personal data?

privatim holds this to be inadmissible in most cases and allows it only where the responsible body encrypts the data itself and the provider has no access to the key. That resolution is a joint position of the data protection supervisory authorities and not a legal norm, and the canton of Glarus has not signed up to it. What counts in the end is the applicable data protection law and the assessment in the individual case. This section is no substitute for legal advice.

What exactly stays on-premise with the federal government?

According to the FDPIC’s 33rd activity report, case files and data from the GEVER electronic records management, the content of Outlook mailboxes and generally all sensitive personal data and personality profiles remain in data centres of the federal administration and are processed exclusively there. On-premise here means on your own infrastructure, not with a cloud provider. The introduction of Microsoft 365 in the federal administration carries on independently of that. So the federal government has not rejected the cloud, it has taken part of its body of data out of it.

Does Kisuno meet the requirement of the privatim resolution?

With self-hosting on your own server yes, because the body of data and the keys stay there and we have no access. In managed operation in Lupfig no, because we run the instance and manage the keys. We would rather say that plainly than leave it open. Which route fits depends on whether you process sensitive personal data in the exercise of official duties or not.

Is a Swiss data centre not enough?

For many applications yes, for the case privatim describes no. The condition in the resolution does not attach to the location but to the power of disposal over the key. A location in Switzerland makes the risk smaller and still does not answer the question that was asked. Anyone who has to answer it will not get past self-hosting.

What does self-hosting cost?

The GitHub repository under the MIT licence is coming soon, and self-hosting is free. You carry your own infrastructure and the operating effort, and you enter yourself which models should be reachable, or run one of your own. The managed instance costs CHF 7 (EUR 7.50) per person per month, through the end of the current month with 50 percent off on a twelve-month term, that is CHF 3.50 (EUR 3.75). Testing is free and not limited in time; every new account starts with a starting credit of CHF 50 (EUR 55) for model usage. All the details are on the Pricing page.

Does our data train the models?

No. Customer data does not train models, and telemetry is off by default. What goes to the model is the text of the single request along with the extracts that belong to the answer, while the body of data stays on the instance. What we commit to contractually is in the data processing agreement, and everyone involved in the chain is named in the list of subprocessors.

How many Swiss companies use AI?

There is no official answer to that. Switzerland is not included in the harmonised Eurostat survey on the use of AI in enterprises, which for 2025 reports 19.95% across the EU.6 The figures circulating for Switzerland come from surveys commissioned by providers, and we use them only with that label attached. If someone sells you a Swiss AI rate as official, ask which body collected it.

What changes in 2026 for Austrian companies?

The Network and Information System Security Act 2026 enters into force on 1 October 2026, and affected entities have to register by 31 December 2026 at the latest; some 4,000 companies from 18 sectors are expected.9 With the European AI Act it looks different: a formal designation under article 70 was still outstanding in June 2026, even though the deadline expired on 2 August 2025; by way of preparation, the AI service point at the RTR has been in place since 2024. So plan by the cybersecurity calendar, which is settled, and keep the AI side open. This section is no substitute for legal advice.

Work through it on a body of documents of your own

Bring an anonymised extract from a file, a set of regulations or a typical case, and we work through the process together, once in managed operation and once with self-hosting, so that the difference becomes visible. Or sign up and try it out yourself.

Book a live demo Get started

Sources

All figures and quotations in this article come from the sources below, last checked in September 2026. Where a survey was carried out on behalf of a provider, that is stated in the text and in the source entry. The surveys refer to different countries and different populations; we have stated in the text in each case which one is meant.

  1. Federal Data Protection and Information Commissioner, 33rd activity report 2025/2026, published on 30 June 2026, focus chapter on artificial intelligence, page 21: “Federally owned AI systems are therefore an essential precondition ... By contrast, the use of commercial LLMs (Copilot, ChatGPT and so on) brings with it storage on the provider’s cloud for at least some time and thus inevitably a risk to data security.”: edoeb.admin.ch
  2. Federal Data Protection and Information Commissioner, 33rd activity report 2025/2026, page 18, section “M365 and cloud”: case files and data from GEVER, content of Outlook mailboxes and all sensitive personal data and personality profiles remain in data centres of the federal administration and are processed exclusively there: edoeb.admin.ch
  3. privatim, conference of the Swiss data protection commissioners, resolution on moving data processing into the cloud, Bern, 18 November 2025, with the note that the canton of Glarus made use of the opt-out under article 18.2 of the statutes: privatim.ch
  4. Federal Data Protection and Information Commissioner, 33rd activity report 2025/2026, key figures for the reporting year: 2,477 complaints received against 1,053 in the year before, and 484 notified data security breaches against 363; the figure 2,477 is the one in the running text of the report, while table 9 of the same report gives 2,447 complaints: edoeb.admin.ch
  5. Swiss Federal Audit Office, information and communication technology of the federal government, key projects of the federal administration, synthesis report EFK-26716, evaluation of 24 reports from 2024 and 2025, investment volume of the key projects considered three to five billion francs, published on 8 July 2026: efk.admin.ch
  6. Eurostat, Use of artificial intelligence in enterprises, dataset isoc_eb_ai, enterprises with ten or more employees, reference year 2025, data extracted in December 2025: EU-27 19.95%, Germany 25.97%, Austria 29.95%; for Switzerland this dataset holds no values: ec.europa.eu
  7. Study “Unlocking the potential of AI in Switzerland 2026”, carried out by Strand Partners on behalf of Amazon Web Services, so a provider study; reported on 28 August 2026 with a usage rate of 57% against 46% in the year before, the sample size being stated differently across the reporting: moneycab.com
  8. Statistics Austria, press release 14 207-126/26 of 24 June 2026 on the survey of the use of information and communication technologies in Austrian enterprises with ten or more employees: 30% of enterprises use AI, and 77% of the enterprises without AI use have not considered it: statistik.at
  9. Network and Information System Security Act 2026, promulgated as Federal Law Gazette I No. 94/2025 on 23 December 2025: 18 sectors under section 2, entry into force on 1 October 2026 under section 51, registration within three months of that under section 29 paragraph 3; the expected number of some 4,000 entities affected comes from the legislative materials: ris.bka.gv.at
  10. Parliament of the Republic of Austria, parliamentary question 5638/J of the XXVIII legislative period on the implementation of the European AI Act, fifteen questions on the supervisory authority, the regulatory sandbox and the penalty provisions among other things: parlament.gv.at
  11. Parliament of the Republic of Austria, answer 5062/AB of the XXVIII legislative period of 2 June 2026: parlament.gv.at