AI in business — where to start, what it costs and what the law says

AI in business today means four different things: an assistant in your office suite, automation with a language model inside, a chat on your website and an agent that chooses its own next steps. Each has a different cost, a different risk and different legal duties, and under one name it is easy to buy something other than what the company needs.

In Switzerland no official statistic matches Eurostat's, because Switzerland is not part of the Eurostat survey. The latest official indicator, from the Federal Statistical Office (FSO), rests on a 2023 survey and shows, by our reading of its chart, around one company in ten using AI-based systems. Large companies use AI most.

This guide helps you make three decisions: which kind of AI fits your problem, what it really costs, including outside the invoice, and what Swiss law requires, and the EU AI Act where you serve the EU. Where a topic has its own article, we link to it. We checked the data, prices and rules on 8 October 2026.

How many Swiss companies use AI — and for what

In Switzerland AI is used most in large companies and in services, and the latest official indicator, from 2023, shows around one company in ten. The FSO publishes the indicator on its page Other ICT use (in German and French), based on the innovation survey of the KOF Swiss Economic Institute: data year 2023, companies with five or more employees. The FSO writes that large companies use AI-based systems most often, followed by medium-sized and then small ones, that use is most widespread in the services sector, and that companies use these systems mainly in marketing, cybersecurity, sales and manufacturing and production (our translation from the German). The bars in the FSO chart carry no values; read off the axis (our reading), they show around one company in ten overall and about a third of large companies. The survey went to 9,307 companies and returned 2,040 usable questionnaires (21.9%), and KOF uses a simplified version of Eurostat's definition of AI.

A second signal comes from the SECO SME portal, which relays an insurer's survey, the AXA annual labour-market study (5 November 2025): between 2024 and 2025 the share of SMEs that incorporated AI rose from 22% to 34%. It is an insurer's survey whose method we have not reviewed, so treat it as a signal, not an official statistic.

We found no data on AI agents in Swiss companies. The FSO and KOF measure AI-based systems in general, and surveys about agents, such as Gartner's or McKinsey's, are global and say nothing about Swiss SMEs.

Four kinds of AI in a business

One question decides which kind of AI you are looking at: who chooses the next step — a person, a pre-written workflow or the model. The answer determines the cost, the risk and the amount of work before launch.

Assistant in an office suite. ChatGPT on a business plan, Copilot in Microsoft 365 or Gemini in Google Workspace help you write, summarise and search, but an employee decides every step. Gartner describes assistants (26 August 2025) as tools that "depend on human input and do not operate independently", and calls referring to them as agents the most common misconception. You pay a subscription per user. What the Google and Microsoft plans include, and what Copilot costs as an add-on, we compare in Google Workspace vs Microsoft 365; how a business plan differs from a private one, and what ChatGPT Business, Claude Team, Copilot and Gemini cost per user, is in ChatGPT Business, Copilot or Gemini for business.

Automation with a model inside. The workflow is written in advance and the model performs single steps in it, for example reading the content of a document. Anthropic, the maker of the Claude models, calls this a workflow: the model and tools are orchestrated "through predefined code paths" (Building effective agents, 19 December 2024). How automation differs from RPA and integration is covered in our article on business process automation, and the tools in which you can assemble such a workflow without a programmer in the piece on low code and no code.

Chat on your website. It answers customers from the company's knowledge and hands the conversation to a person when it does not know the answer. It usually works as RAG (retrieval-augmented generation): before answering, it searches the company's documents for matching passages. It has two risks an internal assistant does not: the model can make up an answer that the customer takes for fact, and the customer has a right to know they are talking to a machine, which the Swiss Federal Data Protection and Information Commissioner (FDPIC) reads from the Federal Act on Data Protection (explained below). If the chat also serves people in the EU, Art. 50 of the EU AI Act applies from 2 August 2026. Where a chatbot fits in an online shop's support is covered in our article on ecommerce customer service.

Agent. The model chooses the next steps and tools itself. Anthropic writes that agents are systems where models "dynamically direct their own processes and tool usage". OpenAI, in its guide to building agents (2025), states that a simple chatbot is not an agent. Gartner estimates (25 June 2025) that of the thousands of "agentic AI" vendors only about 130 are real, and that many rebrand existing products such as assistants, RPA and chatbots. Anthropic warns that an agent's autonomy means higher costs and the potential for compounding errors. What separates an agent from a chatbot and from ordinary automation, and when it really makes sense, we explain in the article on the AI agent in business.

Gartner gives a simple rule of thumb in the same press release: agents where decisions are needed, automation for routine workflows, assistants for simple retrieval.

Where to start — the order that saves money

Start with what blocks most companies: knowledge, rules and data, and choose the tool last. We found no Swiss data on why companies do not use AI, so this order rests on how the technology works and on the vendors' own guidance, not on statistics. One Swiss signal points at the first step: in the AXA study relayed by SECO, only one third (34%) of companies had set clear rules on what data employees may or may not enter into AI tools, and the figure falls to 23% among small firms with fewer than ten employees (an insurer's survey).

That gives four steps.

1. Rules for using AI. Decide which data may be typed into which tool and from which account. The FADP applies directly to AI-supported data processing (FDPIC), so what employees type in matters whenever it is personal data. The terms differ by vendor and plan, so read them for the plan you actually use; the business plans we compare are in ChatGPT Business, Copilot or Gemini for business. How to list where company data lives and who can reach it is covered in company data security.
2. The assistant in the suite you already have or can add. It is the cheapest way for the team to learn to work with a model. Before switching it on, tidy file permissions (below, in the section on costs).
3. One process to automate. Pick a process that repeats and has a clear, checkable result. Anthropic advises "finding the simplest solution possible", which may mean not building agentic systems at all, and adds that for many applications a single model call with retrieval and in-context examples "is usually enough".
4. An agent only when the workflow does not fit. OpenAI lists three conditions: complex decisions with exceptions, rules that are hard to maintain, and heavy reliance on unstructured data. If your process meets none of them, then in OpenAI's words "a deterministic solution may suffice", that is, ordinary automation. Once you do build an agent, the same guide says actions that are sensitive, irreversible or high-stakes should trigger human oversight until confidence in the agent grows. OpenAI's examples: cancelling an order, authorising a large refund, making a payment.

A test before step four: can you write down the rule an employee uses today to make the decision? If so, you need automation, not an agent. In our view the rule OpenAI states for agents holds at every stage: start small, validate with real users and grow capabilities over time.

What AI costs a business — three kinds of cost and one hidden one

The cost of AI in a business is a subscription, token charges and implementation work, and before all of them comes tidying up your data, which appears on no price list. Each grows by a different rule.

Subscription per user. Assistants in office suites cost a fixed amount per person per month. The bill grows with headcount, not with how heavily the tool is used. Current Google and Microsoft plans with AI are compared in Google Workspace vs Microsoft 365.

Tokens. When a model works in an automation, a chat or an agent, you pay for the amount of text processed, counted in tokens (pieces of words). That is how Anthropic and OpenAI bill. We calculated an example ourselves on the Claude Sonnet 5.5 price list ($2 per million input tokens, $10 per million output tokens, read 8 October 2026). Anthropic publishes prices in US dollars; we leave them in dollars rather than convert. One chat reply, with 3,000 input and 300 output tokens, costs $0.009. An agent task with ten model calls, averaging 8,000 input and 500 output tokens per step, costs $0.21, about 23 times more. A thousand such tasks a month come to $210. These are assumptions of the example, not a market average, and they ignore discounts for caching and batch processing. Gartner estimates (17 August 2026) that routing a task to an agentic reasoning model raises the model provider's inference cost at least fivefold compared with a basic chatbot interaction. The full token calculation for an agent, with a chart comparing a chat reply and a multi-step task, is in the article on the cost of an AI agent.

Implementation and maintenance. Integration with your systems, preparing a knowledge base, testing and later model changes are work whose price depends on scope. We found no independent study of AI implementation prices in Switzerland, so we quote no market figure.

The hidden cost: data and permissions. Buying a licence does not finish the preparation. Microsoft's Copilot documentation (read 8 October 2026) says the assistant only shows organisational data that individual users have at least view permission for, and tells you to make sure the right people have access to the right content. The same page states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models. It cuts both ways (our example): if personnel files sit in a folder shared with the whole company, the assistant will find them for anyone who asks. That is why the first step in Microsoft's deployment guide (read 8 October 2026) is to fix oversharing: find sites and files shared too broadly, ownerless, unused or holding sensitive data, and then correct access. Gartner writes (11 May 2026) that without a clear understanding of the relationships and rules in an organisation's data, AI agents "cannot operate accurately and are far more likely to hallucinate". Those hours of tidying are an implementation cost even if nobody invoices them. The same principle applies to an AI chat built on company documents: permissions must be enforced by the retrieval itself. It is also true of an assistant or agent connected to company systems through MCP (Model Context Protocol): it sees and does whatever the account it uses allows.

Money also limits those who have already deployed AI. In McKinsey's global survey (25 August 2026, 1,719 respondents from 97 countries, self-reported) about 20% said AI operating costs, including tokens, constrained their use of AI, and 37% attribute at least some EBIT impact to AI. A third of respondents (36%) work for organisations with revenue above $1 billion, and the survey says nothing about Swiss small companies.

The law: FADP now, an AI bill in preparation, the EU AI Act when you serve the EU

Switzerland has no AI act: the revised Federal Act on Data Protection (FADP) already applies to AI, a consultation draft on AI regulation is due by the end of 2026, and the EU AI Act reaches a Swiss company only where its AI system or the system's output reaches the EU. The Federal Chancellery writes on its page Regulation of AI: "In Switzerland, there is not yet any overarching legislation that deals specifically with AI."

The FDPIC states that the FADP, which has been in force since 1 September 2023, "is directly applicable to AI-supported data processing", and that "regardless of future regulations, the data protection provisions already in force must be complied with" (FDPIC). This is the FDPIC's reading of the FADP, not a court ruling. On 12 February 2025 the Federal Council decided that Switzerland will ratify the Council of Europe's AI Convention and that, where legislative amendments are necessary, they should be sector-specific as far as possible, with general rules limited to central areas relevant to fundamental rights such as data protection (OFCOM). The Federal Department of Justice and Police is to prepare a consultation draft by the end of 2026, and Switzerland signed the convention in March 2025. As of 8 October 2026 we found no consultation opened, so the draft is a plan, not law.

The key dates in order:

• 1.09.2023 — the revised FADP enters into force.
• 9.11.2023 — the FDPIC states that the FADP applies directly to AI.
• 12.02.2025 — the Federal Council decides to ratify the Council of Europe AI Convention and to make sector-specific changes.
• March 2025 — Switzerland signs the convention.
• End of 2026 — a consultation draft on AI regulation is due. It is a plan, not law.
• For companies serving the EU: 2.08.2026, Art. 50 of the AI Act on transparency applies; 2.12.2027, obligations for high-risk systems in Annex III, including AI in recruitment; 2.08.2028, obligations for high-risk systems in Annex I.

When the EU AI Act reaches a Swiss company. Art. 2(1) of the AI Act covers providers placing AI systems on the market or putting them into service in the Union, "irrespective of whether those providers are established or located within the Union or in a third country", and providers and deployers in a third country "where the output produced by the AI system is used in the Union". A Swiss company that offers its own AI system, such as a chatbot, to users in the EU is therefore a provider. A Swiss company that merely uses AI in Switzerland is not a deployer in the EU sense; it is caught only where the output of the system is used in the Union. Where exactly that line runs, for example for AI-written texts sent to EU clients, the texts we read do not settle, so ask a lawyer. Member-state authorities enforce the AI Act, not a Swiss one, and its fines are in euros. Duties by company role, fines and a checklist are in the article EU AI Act for business.

Chat and agent talking to people. The FDPIC writes that, "in the case of intelligent language models that communicate directly, users have a legal right to know whether they are speaking or corresponding with a machine and whether the data they have entered is being processed to improve self-learning programs or for other purposes". No Swiss statute says "label your chatbot"; this is the FDPIC's reading of the FADP. If your chat serves people in the EU, Art. 50(1) of the AI Act obliges the provider from 2 August 2026 to make sure users know they are dealing with an AI, at the latest at the first interaction, with a fine of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, and for SMEs whichever is lower (Art. 99(4) and (6)).

Automated decisions and risk assessment. Under Art. 21(1) FADP the controller informs the data subject of any decision based exclusively on automated processing that has a legal consequence or a considerable adverse effect, and the person may ask for it to be reviewed by a natural person (Art. 21(2)). Art. 22(1) requires a data protection impact assessment beforehand where processing is likely to result in a high risk to personality or fundamental rights. Wilful breaches of the information duties in Arts 19 and 21 are punishable by a fine of up to CHF 250,000 on the responsible private person (Art. 60), prosecuted by the cantons (FDPIC). The English version of the Act on Fedlex has no legal force; the French text is authoritative.

Training your staff. Art. 4 of the AI Act says that providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff, without guaranteeing any specific level. It applies where the AI Act reaches you; we know of no Swiss statutory counterpart. The Commission explains in its questions and answers that Article 4 does not entail an obligation to measure the knowledge of employees.

GDPR. If you also serve people in the EU, the GDPR may apply alongside the FADP; we do not assess when.

Articles in this section

Below are the articles in this section, followed by articles from other sections that cover AI as part of their own topic.

• AI agent in business: how an agent differs from a chatbot and from automation, the three conditions that justify one, token cost and the AI Act.
• EU AI Act for a Swiss business: when the AI Act reaches a Swiss company, how the FADP applies to AI, deadlines to 2028, fines and a checklist.
• ChatGPT Business, Copilot or Gemini for business: what a business plan changes compared with a private one, and what each assistant costs per user.
• Business process automation: how automation differs from RPA and AI, the QR-bill as a first step, our hands-off funnel and examples by department.
• Low code and no code: when a platform without programming is enough, which limits you cannot see at the start and what you lose if you want to leave.
• Google Workspace vs Microsoft 365: plans and prices of both suites in Swiss francs, including their AI features.
• Ecommerce customer service: fewer "where is my order" tickets, complaint handling under Swiss law and chatbot disclosure.
• Ecommerce automation: what to automate first, what Zapier, Make and n8n cost, and how to calculate the return on automation in hours worked, not in promises.

How we work with AI at Digital Vantage

We use OpenAI and Anthropic models through their APIs and advise starting with the simplest solution that solves the problem. We build automations in n8n and Node.js on servers in Warsaw (EU); the scope of that service is described on our process automation page.

We are preparing an AI chat for our own website that answers from company knowledge and hands the conversation to a person. The first message tells the visitor that an AI is answering. A person takes over, among other cases, when the visitor asks for it, when the bot does not know the answer, for a complaint and for legal or financial topics, and when the monthly token budget is exceeded. The CRM receives a summary, not the full transcript. Where the model itself processes the data depends on the provider and platform, and we have not yet decided that. The chat is not live, so we publish no results. After launch we will watch it for at least four weeks before proposing a similar solution to clients.