# AI Governance Package: AI, Security and Data Protection in One Mandate

> AI Governance Package for SMEs: AI rules, security, data protection and contracts from one partner. Agreed fixed price from CHF 17'900 + CHF 1'550/month.

- Source: https://www.sidd.swiss/en/services/ai-governance-package
- Language: en
- Last updated: 2026-10-17
- Publisher: SIDD Institute for Data Protection and Data Security, a brand of Priverion GmbH, Zugerstrasse 32, 6340 Baar (ZG), Switzerland

EU AI Act · ISO/IEC 42001 · FADP and GDPR

AI reaches your company through Copilot, SaaS tools, AI-built apps and questions from EU customers. Several providers mean several lists and no clear overall responsibility. The Package bundles AI rules, security, data protection and contracts in one mandate. You get one contact, one contract, one list of all AI applications and one evidence repository in the Priverion Platform.

Agreed fixed price from CHF 17'900 + CHF 1'550/month Governance, security, data protection, contracts Governance operational in 6–12 weeks

Free and without obligation · 30 minutes · confidential under NDA · quote within one working day

**Responsible for this mandate**

**Dr. Dominic Staiger**

LL.M., Dr. iur., CIPP/E · Attorney at Law (New York) · Solicitor (UK)

The team of Dr. Dominic Staiger leads the Package. Dr. Staiger holds an LL.M., a Dr. iur. and the CIPP/E. He is an Attorney at Law (New York) and Solicitor (UK). As your point of contact, he is responsible for data protection, contracts and the legal assessment of every finding. Senior Associate Mohamed Afhim leads the AI Governance Buildup. The team led by Oliver Stutz handles the Security Architecture Review, the Security Review for Vibe-Coded Projects and the AI Security assessment. Oliver Stutz is Co-Founder and InfoSec & Cybersecurity Expert.

[LinkedIn profile](https://www.linkedin.com/in/dominicstaiger/)

## What is the AI Governance Package?

> **Short definition**
> 
> The AI Governance Package bundles AI governance, information security and data protection under one point of contact. A one-off setup is followed by a mandate at a monthly price. The setup produces the policy set and the clause library, and we review your systems. The mandate then covers data protection, AI rules, contracts and training. All modules share the kickoff, contract, evidence repository and AI inventory. Every module remains bookable on its own.

Roles, policies, training and templates are set up by the [AI Governance Buildup](https://www.sidd.swiss/en/services/ai-governance-buildup) (agreed fixed price from CHF 9'800). Your system architecture is checked for weaknesses by the [Security Architecture Review](https://www.sidd.swiss/en/services/security-architecture-review) (agreed fixed price from CHF 6'900). AI-built app code is checked by the [Security Review for Vibe-Coded Projects](https://www.sidd.swiss/en/services/vibe-coding-security-review) (agreed fixed price from CHF 3'900). The ongoing mandate covers the [external DPO mandate](https://www.sidd.swiss/en/services/data-protection-advisor-switzerland) and the [AI Officer](https://www.sidd.swiss/en/services/ai-officer) for your AI rules, each from CHF 500/month. If you need an EU data protection officer, the [EU DPO](https://www.sidd.swiss/en/services/data-protection-officer-eu) is added from CHF 600/month.

As a review of your current AI use, the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) remains bookable on its own. If it exists, the Buildup takes over its inventory and action plan. Otherwise the Buildup compiles the inventory in the first two weeks. Within the Package, the Check updates inventory and classification every year. If you want a certificate straight away, start with the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance). The Package keeps this path open.

## Who should book the AI Governance Package

The Package pays off when several triggers apply and no one is in charge. Otherwise a single module is usually enough.

1. **AI is in use and no one is in charge:** Executive management wants a policy, a customer wants evidence. According to the [AXA SME Labour Market Study 2026](https://www.axa.ch/de/ueber-axa/medien/medienmitteilungen/aktuelle-medienmitteilungen/2026/20260915-kmu-arbeitsmarktstudie-kuenstliche-intelligenz.html) , 35 % of Swiss SMEs use AI deliberately. Another 39 % are testing it. The Package sets up inventory, roles and rules and defines who runs them.
2. **You build with AI or integrate language models:** One example is an agent with access to mail and CRM. The Buildup governs development and human oversight. The Security Review checks access rights and secrets such as passwords in the app. The Architecture Review checks the trust boundaries: points where data leaves a protected area.
3. **EU customers or EU market:** The EU AI Act is the EU law on artificial intelligence. It also covers Swiss providers and deployers whose system or its output is used in the EU. Transparency obligations have applied since 02.08.2026, for example labelling AI-generated content. From 02.12.2027, obligations for high-risk systems apply in areas such as credit checks or recruitment. The Package delivers the evidence and reviews the clauses in contracts with EU customers.
4. **Regulated industry:** FINMA expects an AI inventory with risk classification, defined responsibilities and contract clauses for outsourced AI. In healthcare, the FADP often requires a DPIA: a risk assessment before sensitive data processing. Package Plus implements this in inventory, policies and supplier reviews.
5. **Suppliers become AI providers:** CRM and office suite receive AI features by update. New terms then govern training, retention and data location. Your data processing agreement (Art. 9 FADP, Art. 28 GDPR) often does not cover this. This agreement governs how a provider processes your data. The contract reviews in the mandate capture such changes with a fixed annual quota.

What makes us unique

## Law, engineering and in-house AI in one team

Law and engineering belong in one team. **Neither a pure law firm nor a conventional consultancy can deliver this combination.** A law firm reviews the contract, but not the RLS policy behind it. This database rule sets who may see which data. It can undermine the contract. A security consultancy finds the gap but does not assess a duty to notify the data protection authority (FDPIC). At SIDD, all practice leads work on the same AI inventory.

### Deep legal expertise

The team of Dr. Dominic Staiger leads the Package. Dr. Staiger is an Attorney at Law (New York) and Solicitor (UK). Our clause library for AI contracts comes from our own practice and is adapted to every mandate.

### In-house software engineers

Our [Priverion Platform](https://www.sidd.swiss/en/priverion-platform) comes from our own development and runs on our own Swiss infrastructure. The team led by Oliver Stutz reviews your architecture and reads your AI-generated code. It knows cloud configuration and user permissions from its own operations, not just from audit reports.

### In-house AI development

We develop our own AI systems such as the legal AI LexCommand and write code with AI ourselves. That is why we write policies that engineers can implement. For supplier clauses we know what lies behind them technically, for example whether your data feeds into training.

## What the Package includes

The Package comprises nine modules plus options, each with a price and a fixed quantity per tier. The quantities are shown under the packages.

- **AI Governance Buildup (1 project):** In the setup, the [AI Governance Buildup](https://www.sidd.swiss/en/services/ai-governance-buildup) turns your inventory and action plan into governance for daily work. It delivers roles, the policy set, the clause library, training and an evidence structure. The DPIA template contains AI questions (Art. 22 FADP, Art. 35 GDPR). The FRIA template assesses impacts on fundamental rights (Art. 27 EU AI Act). Providers of high-risk systems receive templates for documentation and logging (Art. 11 and 12 EU AI Act). Individually: Agreed fixed price from CHF 9'800, duration 4–10 weeks.
- **Security Architecture Review (1 Check or Review):** In the setup, the [Security Architecture Review](https://www.sidd.swiss/en/services/security-architecture-review) examines your systems with a threat model, a list of possible attacks. The focus is on trust boundaries, access rights, key management and data paths to AI providers. Essentials and Standard include the Architecture Check for one system. Where AI is only used, it checks your Microsoft 365 or Google environment. Plus includes the Architecture Review for one platform or two to three core systems. Individually: Agreed fixed price from CHF 6'900 (Check) and from CHF 14'000 (Review).
- **Security Review for Vibe-Coded Projects (1 Review):** For apps built with AI tools, the [Security Review for Vibe-Coded Projects](https://www.sidd.swiss/en/services/vibe-coding-security-review) checks the code, backend configuration and running app. The focus is on access rights, secrets and data protection. Essentials includes the Launch Check, Standard the Go-Live Review. Plus includes the Due Diligence for three to five apps. Individually: Agreed fixed price from CHF 3'900, from CHF 6'900 and from CHF 10'500. Without AI-built apps, you swap it for a second training session or more contract reviews.
- **External DPO mandate (12 months):** [External data protection officer](https://www.sidd.swiss/en/services/data-protection-advisor-switzerland) under Art. 10 FADP advises on and monitors your data protection. They maintain the record of processing, support DPIAs and data subject requests and keep contact with the FDPIC. Essentials and Standard include the Standard mandate with half a day per quarter, individually from CHF 500/month. Plus includes the Premium quota from 30 hours per year, individually from CHF 1'200/month. Standard gets it at a surcharge. Where Art. 37 GDPR requires a designation, the [EU DPO](https://www.sidd.swiss/en/services/data-protection-officer-eu) is added from CHF 600/month. It is included in Plus.
- **AI Officer (12 months):** After the Buildup, the [AI Officer](https://www.sidd.swiss/en/services/ai-officer) maintains your AI rules as an external person. Essentials includes the Readiness tier as a contact for ad-hoc questions, individually from CHF 500/month. You then maintain inventory and policies internally. Standard and Plus include the Governance tier, individually CHF 1'500–3'500/month. The AI Officer then maintains inventory, risk classification and policy set and prepares approvals. They run the AI literacy programme and report quarterly to executive management.
- **Policy set (5 or 9 documents):** Essentials delivers the AI governance directive under the AI management standard ISO/IEC 42001 clause 5.2. Four core policies follow: AI use, procurement, data and retention, incidents and notifications. Standard and Plus add development and MLOps as well as human oversight (Art. 14 and 26 EU AI Act). Transparency and marking as well as model and change management are also added (Art. 25(1) and Art. 3(23) EU AI Act). Plus adds high-risk procedures by role and the documentation framework for your AI management system (AIMS).
- **Contract reviews (4, 8 or 16 units per year):** Within the mandate, we review new and amended AI supplier contracts against the review grid below. The Buildup reviews the most important existing contracts. The quota counts from handover. If you sell AI features, a customer contract counts as two units. We quote framework agreements with corporate groups and negotiation support separately. Individually: Agreed fixed price from CHF 950 per standard contract, for complex contracts from CHF 1'900.
- **AI literacy training under Art. 4 EU AI Act (1 to 3 units per year):** We train by role and record each attendance in the training register. The European Commission names this as possible evidence. Art. 4 does not require a certificate. The Buildup delivers the first training for executive management and staff. In the first year, the units go to the remaining groups, then to refreshers. Individually: Agreed fixed price from CHF 1'900 for a half day, from CHF 2'900 for a full day.
- **Annual reassessment with the AI Governance Check (1 per year):** Each time, the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) reclassifies your AI inventory against the EU AI Act, ISO/IEC 42001 and the FADP. It picks up new applications, changed deadlines and model changes. The report goes to the board of directors and executive management. Essentials includes the Basic Check for up to around five applications, individually from CHF 3'900. For more applications, we quote the difference to the Standard Check. Standard and Plus include the Standard Check for up to 15 applications, individually from CHF 7'500.
- **Options at individual prices:** With active attacks, the [AI Security assessment](https://www.sidd.swiss/en/services/ai-security) tests your AI systems for CHF 8'000–15'000 per application. The Architecture Advisory Retainer has an agreed fixed price from CHF 1'900/month. The path to certification under [ISO/IEC 42001](https://www.sidd.swiss/en/services/iso-42001-ai-governance) is available on request.

All evidence sits in the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform), hosted in Switzerland. This includes inventory, policies, training records, contract reviews and review findings. [SaaS providers](https://www.sidd.swiss/en/services/saas) with AI features for EU customers also get a customer view there. It contains the data processing agreement, sub-processor list and transparency information to pass on to their customers.

## What the contract review covers

> **Review grid**
> 
> **Supplier side:** We review the data processing agreement (Art. 9 FADP and Art. 28 GDPR) for inputs, outputs and usage data. Training on your data must be excluded in writing. We check retention periods, waiver of storage and data location including cross-border disclosure (Art. 16 and 17 FADP). We also check sub-processors, confidentiality, acceptable use policies and model licences. We add output rights, indemnification, liability caps, audit rights (Art. 28(3)(h) GDPR) and exit. **Value chain for high-risk systems (obligations under Annex III from 02.12.2027):** We clarify the role as provider or deployer. Information and support are agreed in writing (Art. 25(4) EU AI Act). Instructions for use (Art. 13) and incident reporting (Art. 73) are also covered. **Customer side, if you sell AI features:** We define roles and purpose. This way a customer cannot repurpose your system as a high-risk system without becoming a provider. We also cover transparency and a support package for deployer obligations of high-risk systems. We review warranty and liability with regard to the Swiss Code of Obligations, Product Liability Directive (EU) 2024/2853 and CRA. **Reference framework:** The non-binding EU model clauses MCC-AI of 05.03.2025 serve as a checklist, adapted clause by clause.

## Where rules for AI are often missing

Three dated figures show that rules for AI are often missing. Shadow AI means AI tools used without approval.

- **20 %** of organisations with a data breach reported an incident involving shadow AI. 63 % had no AI policy or only one in development. Source: IBM Cost of a Data Breach Report 2025 of 30.07.2025, covering 600 organisations.
- **34 %** of Swiss SMEs that use AI have a clear data protection rule for AI applications. So two thirds do not. Source: AXA SME Labour Market Study 2025 of 08.10.2025.
- **24 %** of developers say their employer has approved AI tools or an official AI policy. At the same time, 83 % use AI tools at work. Source: Stack Overflow Developer Survey 2026 of 06.10.2026, with over 30'000 respondents.

## Three tiers with entry prices

All prices exclude VAT. We agree the fixed price after an initial scoping call. The mandate runs for twelve months from the kickoff. After that, it can be terminated with three months' notice to the end of a month.

### Package Essentials

Agreed fixed price from CHF 17'900 + CHF 1'550/month up to approx. 50 employees · uses AI, builds at most one tool

For SMEs using Copilot or AI in SaaS tools. Setup in 6–8 weeks.

- AI Governance Buildup Essentials: roles, AI directive, four core policies, training, DPIA and FRIA screening and evidence in the Priverion Platform.
- Security Architecture Check for one system. Plus a Vibe-Coding Launch Check for one AI-built app, or instead a second training session or four more contract reviews.
- External data protection officer with a quarterly mandate. AI Officer in the Readiness tier. You maintain inventory and policies yourself.
- 4 contract reviews and one half-day training session per year, first for power users and new joiners.
- Annual reassessment with the AI Governance Check Basic for up to five applications
- EU DPO optional for CHF 600/month.

### Package Standard

Agreed fixed price from CHF 26'500 + CHF 3'100/month recommended · 50–250 employees · builds with AI

For companies that build with AI or integrate language models. It is the first tier to cover all questions from EU customers and auditors. Setup in 8–10 weeks.

- AI Governance Buildup Standard: all nine policies, clause library, DPIA template with two initial runs, FRIA template and ISO 42001 gap list. For providers of high-risk AI: documentation and logging templates.
- Security Architecture Check for one system and Vibe-Coding Go-Live Review for one app
- External data protection officer with a quarterly mandate and AI Officer in the Governance tier
- 8 contract reviews and two training sessions per year. In the first year a day for development and power users, a half day for oversight staff.
- Annual reassessment with the AI Governance Check Standard
- Optional: EU DPO for CHF 600/month.

### Package Plus

Agreed fixed price from CHF 43'900 + CHF 4'900/month 250–1'000 employees · regulated or high-risk AI

For mid-sized companies, regulated finance and healthcare firms and groups in Switzerland, the EU and the UK. Setup in 10–12 weeks. Because we run the governance, a third party carries out the independent review under section 2.7 of FINMA Guidance 08/2024.

- AI Governance Buildup Plus: everything in Standard plus high-risk readiness (Art. 9, 11, 12, 14, 26 and 27 EU AI Act). Documentation framework under ISO/IEC 42001 with Statement of Applicability. Due diligence for up to ten AI suppliers and a board workshop.
- Security Architecture Review for one platform or 2–3 core systems and Vibe-Coding Due Diligence for 3–5 apps
- External data protection officer with Premium quota from 30 hours per year. Plus EU DPO and AI Officer in the Governance tier.
- 16 contract reviews and three training sessions per year. In the first year two days for additional units and development, a half day for oversight staff.
- Annual reassessment with the AI Governance Check Standard, Enterprise Check on request
- Optional: Architecture Advisory Retainer (agreed fixed price from CHF 1'900/month).

Not in the Package: the attack tests of the [AI Security assessment](https://www.sidd.swiss/en/services/ai-security) for CHF 8'000–15'000 per application. Likewise certification under [ISO/IEC 42001](https://www.sidd.swiss/en/services/iso-42001-ai-governance) and the classic [penetration test](https://www.sidd.swiss/en/services/penetration-test) from CHF 1'490. In the [initial consultation](https://www.sidd.swiss/en/contact) we clarify the tier and module swaps.

## Individual prices of the components in the Standard Package

The table shows the entry prices if you book the components individually. In the Package, all components share the kickoff, AI inventory and evidence repository. The annual reassessment replaces the AI Officer's annual status review.

| Module | Booked individually (entry prices) | In Package Standard |
| --- | --- | --- |
| AI Governance Buildup Standard | Agreed fixed price from CHF 16'500 one-off | in the setup |
| Security Architecture Check (1 system) | Agreed fixed price from CHF 6'900 one-off | in the setup |
| Security Review for Vibe-Coded Projects, Go-Live Review (1 app) | Agreed fixed price from CHF 6'900 | in the setup |
| External data protection officer and AI Officer Governance tier | CHF 500/month and CHF 1'500/month | in the mandate |
| 8 contract reviews per year | Agreed fixed price from CHF 950 per standard contract | in the mandate |
| 2 training sessions and annual reassessment (Check Standard) | Training: Agreed fixed price from CHF 2'900 (full day) and from CHF 1'900 (half day). Standard Check from CHF 7'500. | in the mandate |

Certification under [ISO/IEC 42001](https://www.sidd.swiss/en/services/iso-42001-ai-governance) is not included in the Package.

## The process: running governance in 6 to 12 weeks

The modules run in parallel, shown here for Standard. You provide one project lead and five to ten half-day workshops with your business units. We need read access to architecture documents and the repository.

### Week 0: Scoping and mandate agreement

In the 30-minute initial consultation we clarify headcount, AI use, in-house development, EU exposure and existing roles. Within one working day you receive the quote with tier and entry prices. We agree the fixed price after an initial scoping call.

### Weeks 1–2: Kickoff and inventory

After the kickoff we take over the data protection mandate and set up the evidence repository in the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform) . Then we record AI applications, systems and contracts. An existing [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) provides the starting inventory.

### Weeks 2–6: Reviews

The team led by Oliver Stutz runs the Architecture Check or the Review as well as the Security Review. We report critical findings immediately. All findings go into the risk register with severity and remediation measure.

### Weeks 3–8: Policies and contracts

Mohamed Afhim works out roles and the policy set with your business units for approval by executive management. First DPIAs follow, plus the FRIA where needed. In parallel, Dr. Staiger's team reviews your most important AI supplier contracts and releases the clause library. The contract quota counts from handover.

### Weeks 7–10: Training and governance launch

Training with attendance records for staff and executive management. The incident and approval processes go live. After acceptance, the [AI Officer](https://www.sidd.swiss/en/services/ai-officer)takes over. Executive management receives a report on inventory, risk situation and open measures.

### From week 11: Mandate in regular operation

The data protection mandate and the AI Officer now run governance. You draw on your contract quota. We train further groups. From the second year, refreshers follow. Once a year, the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) reassesses the inventory and risk classification.

## Why SIDD

One partner for four disciplines:

### One mandate lead for all modules

Dr. Dominic Staiger's team leads the mandate and knows the inventory, findings and contracts. It is your single point of contact towards customers, auditors and the data protection authority FDPIC. All practice leads report in one joint status report. The board and management keep their duty of care and liability (Art. 716a, 717 and 754 CO). The Package documents how they exercise this care.

### Law, technology and AI in one team

Lawyers, security engineers and our AI development assess linked points as one risk. Example: the contract clause on AI training, the EU AI Act transparency duty and your app's database rules.

### One shared register

Your evidence is kept together in the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform), hosted in Switzerland. This includes inventory, policies, review findings and the DPIA and FRIA risk assessments. If an EU customer asks about your AI governance, you export the current state.

### LexCommand substantiates every clause

Our Swiss legal AI backs every policy and clause with its source in the EU AI Act, FADP and GDPR. Its crosswalk shows which measure also meets ISO/IEC 42001 or ISO 27001. This keeps your contract reviews fast and thorough.

### Confidential, documents stay in Switzerland

All documents and your code stay under NDA, with no copies at third-party cloud providers. Legal assessment by Dr. Staiger is also protected by attorney-client privilege (Art. 321 Swiss Criminal Code).

### Advisory and review kept separate

Buildup, policies, data protection mandate and contract reviews are advisory work. Architecture Review, Vibe-Coding Review and AI Security assessment are reviews. We also report findings on our own policies independently. If a third party later certifies or tests a system, we name our role and separate the mandates.

Our tool: LexCommand

## Why we work with LexCommand, our own Swiss legal AI

LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform).

### Sovereign in Switzerland

The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.

### No citation, no claim

Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.

### From effort to judgement

LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.

### Three disciplines, one picture

We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.

LexCommand backs every policy, clause and legal assessment with the exact reference in law or standard. A comparison shows where one measure meets several obligations.

Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.

## Frequently asked questions

### What does the AI Governance Package cost, and what is included?

Package Essentials: Agreed fixed price from CHF 17'900 + CHF 1'550/month. Package Standard: Agreed fixed price from CHF 26'500 + CHF 3'100/month. Package Plus: Agreed fixed price from CHF 43'900 + CHF 4'900/month, each excluding VAT. We agree the fixed price after an initial scoping call. The one-off setup comprises the Buildup, the Security Architecture Review and the Security Review for Vibe-Coded Projects. The ongoing mandate comprises data protection advice, the AI Officer, a contract review quota, training and the annual reassessment.

### Can we swap or drop modules, such as a security review?

Yes: without AI-built apps, swap the Security Review for Vibe-Coded Projects for a second training session or more contract reviews. With a current Architecture Review, the Architecture Advisory Retainer or a pro rata credit replaces the Architecture Check. The Buildup and the AI Officer are fixed, because they provide the responsible point of contact. Optional extras are [AI Security](https://www.sidd.swiss/en/services/ai-security) testing and the [penetration test](https://www.sidd.swiss/en/services/penetration-test), deliberately at separate prices. This keeps them credible as independent reviews.

### How do the start, minimum term and termination of the mandate work?

The mandate starts with the kickoff and takes over governance once the Buildup is accepted. It runs for twelve months and can then be terminated as a whole with three months' notice to month-end. At the annual reassessment we adjust modules, for example more contract reviews. If you keep only the DPO mandate or the AI Officer after the first year, the respective individual price applies.

### How much internal effort does it take on our side?

During setup you need a project lead for a few hours per week and five to ten half-day workshops depending on the tier. For the reviews we need read access to architecture documents and the repository. Executive management decides on the role structure and the policy set for AI. During the mandate you give approvals, upload new contracts and take part in training and the reassessment.

### When does the Package fit, and when the AI Officer mandate?

With governance in place and only the role missing, the [AI Officer mandate](https://www.sidd.swiss/en/services/ai-officer) fits at CHF 1'500–3'500/month in the Governance tier. Building governance from scratch or consolidating several providers calls for the Package, with the Buildup as its foundation. For a company of 20 people that only uses Copilot, the Package is usually too big. The right entry point is then the [AI Governance Check Basic](https://www.sidd.swiss/en/services/ai-governance-check) from CHF 3'900 or the AI Officer Readiness tier from CHF 500/month.

### We already have a data protection officer. What then?

Then the DPO mandate is dropped and your monthly price falls by around CHF 430/month (Plus: around CHF 1'000/month). We coordinate DPIA and FRIA templates, the AI suppliers' data processing agreements and the notification process with your DPO. We likewise coordinate with your CISO or information security officer and deliver findings and policies in the vocabulary of your [ISMS](https://www.sidd.swiss/en/services/iso-27001-isms). The Package does not include an [external CISO](https://www.sidd.swiss/en/services/vciso) from SIDD.

### How many contract reviews are included and how fast are they done?

One unit is a SaaS or API contract with AI clauses: Essentials includes 4 per year, Standard 8 and Plus 16. After upload to the Priverion Platform, you receive a redline and a risk rating for executive management within the agreed turnaround. Framework agreements with corporate groups and negotiation support have a separate agreed fixed price from CHF 1'900. For [SaaS providers](https://www.sidd.swiss/en/services/saas-data-protection-processor-dpa) , we also build your own processor documentation during the Buildup.

### Does the Package cover Swiss law or only the EU AI Act?

Both, because Switzerland has no AI-specific statute. The FDPIC states that the FADP applies to every AI processing of personal data, notably Art. 6 to 8 and 21 to 24. The EU AI Act reaches Swiss companies via Art. 2(1)(a) and (c), with deadlines as amended by Regulation (EU) 2026/1744. There is no guaranteed compliance, but there are documented measures and evidence.

### Does the Package lead to ISO/IEC 42001 certification?

Not on its own: an accredited body issues the certificate, not SIDD. Package Standard delivers a gap list against ISO/IEC 42001 Annex A, Package Plus a documentation framework with a Statement of Applicability. The rest of the way is covered by the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance). An existing ISMS under [ISO 27001](https://www.sidd.swiss/en/services/iso-27001-isms) shortens it, because both standards share the same basic structure.

*This page does not replace legal advice in individual cases.*

On this page

- What is the Package?
- Who is it for?
- Why only SIDD
- What is included
- Contract review
- Figures and sources
- Packages and prices
- Individually vs. Package
- Approach
- Why SIDD
- LexCommand
- FAQ

---

This document is the Markdown rendition of the page linked above. Please cite the HTML URL.