Zum Inhalt
Verein in Gründung
Pilotbetrieb

Diese Plattform befindet sich im Pilotbetrieb. Trotz sorgfältiger Prüfung können Inhalte und Funktionen Fehler enthalten. Bitte überprüfe wichtige Angaben anhand der verlinkten Originalquellen.

SW-Version alpha 0.41
Darstellung: System
Sprache: DE

Digital Sovereignty of Switzerland

Machine-supported translation — please verify against the German master version. — Original German version

Digital Sovereignty of Switzerland

Politics

Autumn session 2026 (14 September–2 October). Council decisions, pending business and the popular vote are distinguished below.

Politics · National Council · Council of States

National Council

On 23 September it adopted motion 24.3209 on sovereign digital infrastructure in the AI era. The Federal Council is tasked with proposing a legislative revision for its development and co-funding. business 24.3209.

Council of States

The Council of States had previously approved motion 24.3209. No new autumn-session decision by that council is documented. business 24.3209.

Political decisions: as of 6 September 2026

New political decisions checked on 6 September 2026; earlier background retains its stated reference date.

23.06.2026 — Business 26.3221 calls for a digital sovereignty stimulus programme. Its updated procedural status is assignment to the responsible committee. This does not establish an adopted or funded federal programme. Original source.

01.09.2026 — For business 24.3209 on sovereign digital infrastructure in the AI age, examination by the National Council committee is complete. This procedural step does not mean legislation is complete or infrastructure already operational. Original source.

04.09.2026 — The Administrative Delegation approved an approximately one-year PIA pilot from the autumn session, costing up to CHF 150,000 from the existing IT budget. Swisscom operates it in Switzerland using open-weight models, without training on inputs. Current internet research is not yet supported. Original source.

Further reading: KI / IA / AI

The concrete problem: Office 365 in Swiss public administration

The Swiss federal administration, a majority of cantonal administrations and many municipalities work today with Microsoft 365 — e-mail (Exchange Online), documents (Word, Excel, PowerPoint in the cloud), chat (Teams), file sharing (OneDrive, SharePoint), identity management (Entra ID, formerly Azure AD). All these services are operated by Microsoft Corporation from Redmond, Washington, USA. The Swiss data copies are stored in the Microsoft data-centre regions «Switzerland North» (Zurich) and «Switzerland West» (Geneva).

At first glance this looks like sovereignty: data on Swiss soil, contracts with Swiss subsidiaries, certifications (ISO 27001, FedRAMP, BSI C5).

Legally, this sovereignty cannot be enforced. Three US-law mechanisms reach across the storage location:

  1. CLOUD Act (18 U.S.C. § 2713): US authorities can compel Microsoft Corporation in Redmond to hand over data in the corporation's «possession, custody or control» — regardless of whether the data sits in Zurich, Frankfurt or Texas. The «Switzerland North» region is irrelevant under US law.
  2. FISA Section 702 (50 U.S.C. § 1881a): The NSA can compel Microsoft to deliver communications data of non-US persons — without an individual warrant, and without Microsoft being allowed to inform the Swiss customer.
  3. National Security Letters (18 U.S.C. § 2709): The FBI can demand connection data, regularly with a gag order — Microsoft is not allowed to inform the customer.

In concrete terms for a Swiss federal office: an e-mail conversation with a foreign authority, a OneDrive file with case notes, a Teams chat between staff — all of this is reachable under US law at any time, without the Swiss oversight (FDPIC, PDel, IS-FIS) being informed. Claims like «EU Data Boundary» or «Microsoft Customer Lockbox» do not change this, because they rest on Microsoft's operational self-commitment — not on a US statutory limitation.

The Swiss Federal Chancellery awarded the «Cloud Services of the Public Administration» programme in 2021 to five US hyperscalers (AWS, Microsoft, Google, Oracle, IBM). Risk analyses were performed, but no exclusion of US-jurisdictional providers occurred. The FDPIC (Federal Data Protection and Information Commissioner) has pointed out the structural problem in several activity reports without this leading to a policy change.

This wiki documents the mechanics of this dependency, its Swiss enforcement dimension, the legal limits, and a concrete legislative recommendation (FADS — Federal Act on Digital Sovereignty).

About this chapter

This chapter is a reference work — a source-based assessment of the digital sovereignty of Switzerland in the tension between transatlantic data collection, Swiss enforcement practice and proprietary software tools.

Every page follows an eight-part outline (In three sentences / Mechanics / Sources / What this means for Switzerland / Logical conclusion / What this means for legislation / Further reading / Status and versioning) and rests exclusively on primary sources, source-curated reference materials and field dossiers. No literary narrative, no dramatisation — factual basis.

Sections