You assign responsibility for AI in a demonstrable way and reduce liability and organizational risks, without a dedicated full-time position. We handle the ongoing operational steering of your AI governance under mandate: inventory, risk classification under the EU AI Act, AI literacy (Art. 4) and reporting to executive management. Ultimate legal responsibility remains with executive management and the board of directors.
15 min · no obligation · free of charge · directly with Dr. Dominic Staiger
Working for regulated industries and SMEs
Brief definition
An AI Officer as a service is an external, permanently staffed function that, under mandate, handles the operational management of your AI governance; ultimate legal responsibility remains with executive management and the board of directors (Art. 717/754 CO). We build up your AI inventory, classify every system under the EU AI Act (Regulation (EU) 2024/1689), and manage AI literacy (Art. 4 EU AI Act), policies, the coordination of FRIA and DPIA, and reporting to your executive management. The model follows the proven principle of the external Data Protection Officer: a designated, competent point of contact without a dedicated full-time position.
An AI Officer is not a legally mandatory role, but rather governance- and market-driven; in practice it is nevertheless the most effective way to demonstrably consolidate AI literacy and oversight responsibility. ISO/IEC 42001:2023 requires clear assignment of roles, responsibilities and oversight across the entire AI lifecycle; for executive management and the board of directors, the documented assignment of this responsibility is part of a diligent organisation. This does not guarantee compliance, but it does deliver demonstrable risk reduction and accountability. (Why the EU AI Act itself does not prescribe an "AI Officer" is explained in the frequently asked questions.)
Many Swiss companies already make broad use of ChatGPT, Microsoft Copilot, Claude and similar tools, without anyone being responsible for them. These four triggers indicate that an AI Officer is warranted:
In your executive management or your board of directors, the question arises "Who is actually responsible for AI here?", and there is no clear, designated answer.
Your employees use GPAI tools (general-purpose AI models, e.g. ChatGPT, Copilot, Claude) productively, but a binding usage policy is lacking, and shadow AI is spreading uncontrolled.
EU customers or procurement questionnaires request information about your AI governance, or the output of your AI systems is used in the EU (Art. 2(1)(c) EU AI Act, output clause).
You make, with AI, automated individual decisions or carry out profiling (e.g. scoring, HR pre-selection, creditworthiness) and are thereby directly affected by Art. 21 revised FADP and, depending on the application, by the Annex III obligations of the EU AI Act.
What makes us unique
At our firm, these three disciplines interlock within a single team. Neither a pure law firm nor a conventional consultancy can deliver this combination. This is how we manage your AI governance substantively rather than merely formally: legally, technically and with genuine AI understanding.
Lawyers with doctorates holding CIPP/E, Attorney at Law (NY) and Solicitor (UK) qualifications. We classify AI with legal certainty under the EU AI Act, the FADP and the GDPR, drawing on ongoing mandates rather than textbooks.
Our own development centre and the Priverion Platform. We know how AI systems are built today, and we examine what a system technically really does instead of relying on self-declarations.
We develop and operate our own LLM and AI systems. As a result, we know the best practices and pitfalls firsthand, from RAG to prompt security.
As your external AI Officer, we manage AI governance on an ongoing basis, not as a one-off project but as a permanent mandate. Here is what you get:
Building up a dedicated AI governance role in-house is expensive and inflexible; a mandate scales with your actual use of AI. Dedicated AI governance roles are moreover increasing significantly in the market (IAPP AI Governance Profession Report 2025).
CHF 120k–180k+
Full cost of an internal AI Officer position per year; a mandate starts at CHF 6'000/year.
since 02.02.2025
Art. 5 (prohibitions) and Art. 4 (AI literacy) of the EU AI Act apply directly.
EUR 35 million
maximum fine range (7% of global turnover) for prohibited practices, Art. 99 EU AI Act.
Under Art. 99 EU AI Act, prohibited practices (Art. 5) carry fines of up to EUR 35 million / 7% of worldwide annual turnover, and breaches of deployer obligations (Art. 26) up to EUR 15 million / 3%. These are statutory upper limits for the most serious categories, not a typical deployer case. A mandate reduces this risk through demonstrable allocation and documentation, but it is not a guarantee.
We offer three mandate levels, all on an ongoing retainer basis, with usage-based escalation when needs increase. The specific scope (number of AI systems, locations, response times) is agreed in the mandate.
Readiness
from CHF 500 / month
The designated point of contact for SMEs with a manageable use of AI.
Governance
CHF 1'500–3'500 / month
Ongoing oversight for companies with an active GPAI rollout.
Full mandate
on request
Complete AI governance for groups and regulated industries.
An AI Officer delivers value over time. Our approach is based on ISO/IEC 42001:2023 and structured into a clear sequence of phases:
At the outset, we capture your use of AI, your roles (provider/deployer) and any EU output nexus, on request as AI Governance Check.
We build the AI inventory and carry out the initial risk classification in order to prioritise the need for action.
We adopt the AI policy and launch the literacy programme.
We keep the inventory and classification up to date, manage shadow AI and coordinate FRIA/DPIA as needed.
We report regularly to executive management and make adjustments whenever the legal or technical landscape changes.
What the three disciplines above mean for you in concrete terms within the mandate:
The same proven mandate model as for the external Data Protection Officer (DPO), applied to AI, in shared responsibility with your DPO und CISO role.
Communications and assessments are covered by Swiss professional secrecy (Art. 321 SCC), a level of confidentiality that pure consulting or InfoSec firms cannot offer.
AI inventory, risk classification and reporting as maintained, auditable tooling on the Priverion Platform, not as one-off slides.
Assessment and a robust AI inventory in four to six weeks, without the recruiting, training and backup an internal position would require.
Mandates spanning jurisdictions, aligned with the extraterritorial reach of the EU AI Act (Art. 2) and with group structures.
We keep advisory and independent audit strictly separate, which makes our assessments credible to supervisory authorities and auditors.
The following mandates are data-protection and governance engagements whose role, inventory and evidence structures translate directly to responsible AI governance. Both clients are named with their consent.
Aviation · regulated industry
We built role, inventory and evidence structures vis-à-vis supervisory authorities and executive management, the same governance logic that the EU AI Act requires for Annex III systems: clear responsibilities, a complete inventory and robust documentation.
Learn moreHealthcare · sensitive personal data
In a healthcare setting involving sensitive personal data, we implemented governance and security requirements, the kind of borderline case for which an AI inventory, risk classification and a robust acceptable-use policy for GPAI tools must be designed.
Learn moreOur tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For the AI Officer mandate, concretely: when we classify your AI inventory under the EU AI Act, LexCommand traces every rating to the exact article in the version valid on the chosen date and surfaces overlapping duties from the AI Act, ISO/IEC 42001 and the FADP together.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
The mandate starts at CHF 500/month for the readiness tier (named point of contact, annual assessment, ad-hoc questions). The governance tier typically ranges between CHF 1'500 and CHF 3'500/month. As AI use and steering needs grow, the mandate scales on a usage-based model; the specific scope, such as the number of AI systems covered, is agreed in advance.
No. Unlike the GDPR with the Data Protection Officer (Art. 37 GDPR), the EU AI Act does not provide for a corresponding mandatory role. Art. 4 EU AI Act merely requires a sufficient level of AI literacy within the organisation. The AI Officer is therefore not legally compelled but governance- and market-driven, yet in practice the most effective way to demonstrably consolidate this competence and the oversight responsibility.
Through a binding internal AI policy (acceptable-use rules) for GPAI tools such as ChatGPT, Copilot and Claude: which tools are approved, what data may go into them, who bears responsibility. We identify existing shadow AI, assess it and transition it into governed, approved use. For more, see our guide to the EU AI Act for Switzerland and the AI policy template for SMEs.
Possibly yes. The EU AI Act has extraterritorial effect: it captures Swiss companies as providers (Art. 2(1)(a)) and via the output clause (Art. 2(1)(c)) when the output of an AI system is used in the EU. Independently of this, Swiss law already applies today, in particular Art. 21 revised FADP for automated individual decisions, as well as the liability and organisational obligations under the Swiss Code of Obligations.
Art. 5 (prohibitions) and Art. 4 (AI literacy) have applied since 02.02.2025. The GPAI obligations (Art. 53, 55) have applied since 02.08.2025 for models newly placed on the market; for existing models there is a transition period until 02.08.2027. Most high-risk obligations (Annex III) were originally scheduled to apply from 02.08.2026. Following the provisional agreement on the "Digital AI Omnibus", they are expected to be postponed to 02.12.2027 (Annex III) and 02.08.2028 (Annex I) respectively. As of 18.06.2026 this agreement had not yet been published in the EU Official Journal and is therefore not final; until formal adoption, the original deadlines formally apply. As a precaution, we plan against both scenarios. The longer lead time is an advantage, not an all-clear.
The mandate runs as a monthly retainer with a three-month notice period, with no annual lock-in. The specific terms are agreed in the mandate contract.
The initial assessment and a robust AI inventory are typically available within four to six weeks. The internal effort is essentially limited to providing access to your system and tool lists and to one or two workshops.
The Priverion Platform is hosted in Switzerland or the EU; the standard configuration for Swiss mandates is hosting in Switzerland. Your inventory and governance data is additionally covered by attorney professional secrecy (Art. 321 SCC). We set out the specific storage location in the mandate.
Complementary. The AI Officer works in shared responsibility with your existing DPO und CISO role: He coordinates the FRIA (fundamental rights impact assessment, Art. 27 EU AI Act) alongside the DPIA (data protection impact assessment, Art. 35 GDPR) and steers AI-specific governance without duplicating existing responsibilities. We can also provide both roles from a single source.
A designated, documented AI responsibility is a demonstrable building block of the duty of care and organisation (Art. 717/754 CO); it reduces organisational and liability risk but does not replace a case-by-case assessment of liability. Ultimate legal responsibility remains with executive management and the board of directors and cannot be transferred to an external mandate. We cannot promise guaranteed compliance or an exclusion of liability; the aim is demonstrable risk reduction and accountability.
This page does not constitute legal advice for a specific case. Within the mandate, we provide concrete advice tailored to your organisation, under Swiss professional secrecy (Art. 321 SCC).
This page as of: 18.06.2026, last reviewed by Dr. Dominic Staiger. This page does not replace legal advice for a specific case.
In a 15-minute, non-binding initial consultation with Dr. Dominic Staiger, we assess your use of AI and tell you the appropriate mandate level and the effort involved straight afterwards, under attorney secrecy (Art. 321 SCC).