AI compliance for the DACH market, for Irish businesses selling into Germany, Austria and Switzerland

Three markets, two rulebooks, one language

From Cork, the DACH market looks like one place: Germany, Austria and Switzerland, one language, similar customers. For an Irish business shipping AI features into it, it is three compliance environments. Germany and Austria are in the EU, like Ireland, so the EU AI Act and the GDPR apply there exactly as they do at home, and what differs is who enforces them. Switzerland is not in the EU, so the AI Act does not apply there, but its own data protection act does, and it differs from the GDPR in ways that catch developers out.

I build software for businesses selling across the DACH market, and this is my map of the territory. Not the legal theory, the practical differences that change how you build, ship and maintain AI features when your customers are in Hamburg, Graz and Zürich and your servers answer to a company in Cork. Every date and authority below is as I could confirm it from official sources on 8 November 2026. This is not legal advice.

The running example is invented. Kinsale Labs is a SaaS company in Cork, at kinsalelabs.example. It sells shops an AI product recommendation engine and an AI chat assistant, and its customers are in Germany, Austria and Switzerland.

What an Irish base saves you, and what it does not

Being inside the EU spares an Irish business the paperwork a seller from outside it carries into Germany and Austria. Not all of it reaches Switzerland.

The GDPR applies to an Irish business through its establishment here, whether its users are in Cork, Hamburg or Graz.¹ The duty to appoint a representative in the EU, in Article 27, falls only on controllers and processors not established in the EU, so you need none.¹ And with your main establishment in Ireland, the Data Protection Commission is your lead supervisory authority for processing that crosses borders inside the EU.¹

The EU AI Act applies to providers who place AI systems on the EU market wherever they are based.² An Irish provider is placing on that market already. The authorised representative in Article 22 is a duty for providers established in third countries, so an Irish provider of a high risk system needs none.²

The Swiss Federal Act on Data Protection (FADP) is where the EU base stops helping. Switzerland treats Ireland as abroad, so the FADP requires a foreign private controller to appoint a representative in Switzerland when its processing of people in Switzerland is connected with offering them goods or services or monitoring their behaviour, and is large scale, regular and high risk.³ All four conditions have to be met.

The data flows are the easy part. Between Germany, Austria and Ireland there is no international transfer at all, because it is one market under one regulation. For Switzerland, the European Commission treats it as adequate,⁴ and Switzerland in turn lists Ireland, with the other EU Member States, among the countries with adequate protection.⁵ Data can travel back to Cork from all three.

The EU AI Act, with the dates as they now stand

For Germany and Austria the AI Act is directly applicable. Its timetable was changed by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026.⁶ The dates that matter for a SaaS seller:

• Since 2 February 2025: the prohibited practices and the AI literacy duty, which the Omnibus softened to a duty to take measures to support staff literacy.²⁶
• Since 2 August 2026: the transparency duties in Article 50. Chatbots must tell people they are talking to an AI, and generated content must be marked as artificial.²
• 2 December 2026: generative systems already on the market before 2 August 2026 must mark their output by then.⁶
• 2 December 2027: the high risk rules for uses listed in Annex III, such as recruitment, credit scoring and education.⁶
• 2 August 2028: the high risk rules for AI in products under EU safety law.⁶

The first version of this article gave August 2026 as the date for the high risk rules. That was the law in March 2026. It is not now. I take the classification apart step by step in the EU AI Act for SaaS builders.

The Act is the same text in Germany and Austria. What differs is who enforces it, and that is where the two countries have gone in very different directions.

Germany: the KI MIG and the Bundesnetzagentur

Germany passed its implementing law. The Gesetz zur Durchführung der Verordnung über künstliche Intelligenz is dated 22 July 2026, was published in the Federal Law Gazette as BGBl. 2026 I Nr. 223 on 28 July 2026, and entered into force the day after.⁷ Its first article is the KI MIG, the act on AI market surveillance and innovation.

What it sets up:⁷

• The Bundesnetzagentur (the Federal Network Agency) is the market surveillance authority for the AI Act, unless the act says otherwise.
• BaFin, the financial regulator, supervises AI systems directly connected with regulated financial activity.
• An independent AI market surveillance chamber at the Bundesnetzagentur covers certain high risk systems, including those used for law enforcement, migration, justice and democratic processes.
• A coordination and competence centre at the Bundesnetzagentur supports the other authorities and works for consistent answers to cross cutting questions.
• A central complaints office at the Bundesnetzagentur takes complaints about breaches of the AI Act and passes them to the competent authority.
• At least one AI regulatory sandbox, run by the Bundesnetzagentur.

The complaints office is the part to notice. Anyone who thinks your chatbot failed to say it was an AI has one address to write to.

Data protection is split differently. Private companies are supervised by the data protection authorities of the 16 federal states, under section 40 of the Federal Data Protection Act (BDSG), while the federal commissioner, the BfDI, sits at federal level.⁸⁹ German law also adds a duty the GDPR does not have: a company that usually employs at least 20 people permanently in automated processing of personal data must appoint a data protection officer.¹⁰ Your German customers will usually have one, and that person will read your processing contract closely.

The first version of this article also listed a German data quality framework with 143 metrics, a planned criminal offence for deepfakes, and differing positions of individual state authorities on AI training data. I could not confirm them from official sources and have cut them.

Austria: the EU rules apply, the national authority is still missing

In Austria the AI Act applies as it does everywhere in the EU. The data protection authority is the Österreichische Datenschutzbehörde, the DSB.⁹

On AI supervision, Austria is behind. Under Article 70 of the Act, Member States had to designate a notifying authority and at least one market surveillance authority by 2 August 2025.² A parliamentary question of 2 April 2026 noted that Austria had not done so, and that the KI Servicestelle, an AI service point set up at the regulator RTR in 2024, was meant as the preparation for that structure.¹¹ The Federal Chancellor's answer of 2 June 2026 said a draft implementing law, including the penalties the Act requires, was being coordinated between ministries.¹² On 30 July 2026 ORF reported that Austria still had no AI supervisory authority, and that the Federal Chancellery had said businesses and the public administration must meet the legal requirements whether or not an authority had been designated.¹³ I found no later official designation before publishing this.

For an Irish seller the practical meaning is simple. The duties are the same as in Germany, and as at home, and they apply now. Who would enforce them in Austria is the open question, not whether they apply. The first version of this article described a Digital Austria Act 2.0, a sovereignty compass and a micro data centre deadline. I could not confirm them from official sources, and they concern the public sector in any case, so I have cut them.

Switzerland: no AI Act, and a data protection act of its own

The AI position

Switzerland has no overarching AI law. On 12 February 2025 the Federal Council chose a Swiss approach: ratify the Council of Europe's AI Convention and bring it into Swiss law, with amendments as sector specific as possible and general rules only in areas relevant to fundamental rights, such as data protection.¹⁴ The draft act, with rules on transparency, data protection, non discrimination, supervision and risk assessment, is being prepared by the justice ministry with the communications office and the foreign ministry, and its consultation is scheduled for spring 2027.¹⁴

Until then, the regulator has been clear that the existing law already covers AI. The Federal Data Protection and Information Commissioner (FDPIC) said in November 2023 that the FADP applies directly to AI supported processing. Providers and users must make the purpose, functionality and data sources of AI processing transparent. Users of language models that communicate directly have a legal right to know whether they are talking to a machine and whether what they type is used to improve the system. Falsified faces, images or voices of identifiable people must always be clearly indicated.¹⁵

That corrects the first version of this article, which said Switzerland has no chatbot disclosure duty. Under the FADP, as the FDPIC reads it, it does.

Where the FADP differs from the GDPR

The revised FADP has applied since 1 September 2023.³ It is close to the GDPR in spirit, which is why the EU treats Switzerland as adequate,⁴ but it is built differently.

No list of legal bases. The GDPR requires one of six legal bases for every processing. The FADP instead says personal data must not be processed in a way that unlawfully breaches someone's personality rights, and a breach arises in particular when the principles are ignored or data is processed against the person's express wishes. A breach is justified by consent, an overriding private or public interest, or the law.³ The first version of this article called this "opt out as the default". That is a fair shorthand for how it feels, not what the act says: an express objection matters, and consent is one justification among three.

Explicit consent where it counts. Where consent is required, it must be given freely for specific processing on the basis of proper information, and it must be explicit for sensitive personal data and for high risk profiling by a private person.³ High risk profiling means profiling that poses a high risk to the person's personality or fundamental rights by matching data that allow an assessment of essential aspects of their personality.³

Automated decisions. A controller must tell people about any decision based exclusively on automated processing that has a legal consequence or a considerable adverse effect on them, let them express their view on request, and on request have a person review it, unless the decision is tied directly to a contract and their request is granted, or they explicitly consented to automation.³

Fines on people, not companies. The FADP's criminal provisions fine private persons up to CHF 250,000, for wilful acts only, not negligence. They are prosecuted by the cantonal authorities, and several of them only on complaint.³¹⁶ That is a different risk from a GDPR fine on the company, because the person who wilfully failed to inform a customer is the one in the dock.

No mandatory adviser. Appointing a data protection adviser is always optional for private companies.¹⁶

Impact assessments and breaches. A data protection impact assessment is required where processing is likely to pose a high risk, and the FDPIC names high risk profiling and extensive processing of sensitive data as serious risks. Breaches likely to pose a high risk must be reported to the FDPIC as soon as possible.¹⁶

Where the three overlap, and where they do not

Topic	Germany	Austria	Switzerland
Data protection law	EU GDPR and BDSG	EU GDPR and the Austrian DSG	FADP
Data protection authority	State authority for private companies	DSB	FDPIC
Legal basis	One of the GDPR's six	One of the GDPR's six	No breach of personality, or a justification
Explicit consent needed for	Special category data and some automated decisions	The same	Sensitive data and high risk profiling
AI Act	Applies	Applies	Does not apply in Switzerland
AI market surveillance	Bundesnetzagentur under the KI MIG	Not yet designated	None. The FADP applies to AI directly
Chatbot disclosure	Article 50, since 2 August 2026	Article 50, since 2 August 2026	Required under the FADP, as the FDPIC reads it
Data protection officer	Required from 20 people in automated processing	GDPR rules	Optional
Who is fined	The company	The company	The individual, for wilful breaches

Read the table row by row, not column by column. Most rows show Germany and Austria together against Switzerland, which is the pattern of the whole article: two EU countries sharing one rulebook with different enforcers, and one country with its own.

Worked example: the fine ceiling against the personal fine

Kinsale Labs has a worldwide turnover of €6 million (the example's figure). A serious GDPR breach, such as processing without a legal basis, sits in the top fine band: up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹

$$\text{cap} = \max(F,\; p \times T)$$

Here $F$ is the fixed amount, €20 million, $p$ the percentage as a decimal, 0.04, $T$ the worldwide annual turnover of the preceding financial year, and $\max$ takes the larger of the two. Percentages as decimals are explained in Foundations: percentages.

$$0.04 \times 6{,}000{,}000 = 240{,}000$$

Here $0.04$ is the 4% and $6{,}000{,}000$ the turnover of Kinsale Labs in euros, so 4% is €240,000. The fixed €20 million is far higher, so it is the ceiling. That is the company's exposure in Germany and Austria, and the same as at home in Ireland.

In Switzerland, if the head of product at Kinsale Labs wilfully failed to tell Swiss shoppers about an automated decision, the fine would be on that person, up to CHF 250,000.³ Lower in absolute terms. Much more personal.

The architecture: one codebase, configured per jurisdiction

Here's how I handle this. The principle is one compliance architecture, configured per jurisdiction, rather than three systems.

Read it from the top. The question is about the end user, not the customer's company and not yours, because data protection follows the person whose data it is. The bottom box is the evidence you will need if anyone asks.

module DACHCompliance
  class JurisdictionConfig
    JURISDICTIONS = {
      germany: {
        data_protection_law: "EU GDPR + BDSG",
        ai_act_applicable: true,
        data_protection_authority: "Data protection authority of the federal state",
        ai_authority: "Bundesnetzagentur (KI-MIG)",
        basis_model: :gdpr_legal_basis,
        explicit_consent_for: %i[special_category_data],
        dpo_rule: :bdsg_20_persons,
        fines_on: :company,
        breach_notification: { authority: "State data protection authority", deadline: "72 hours" },
        chatbot_disclosure: true,      # AI Act Article 50, since 2026-08-02
        content_marking: true
      },
      austria: {
        data_protection_law: "EU GDPR + DSG",
        ai_act_applicable: true,
        data_protection_authority: "Datenschutzbehoerde (DSB)",
        ai_authority: nil,             # not yet designated, duties apply regardless
        basis_model: :gdpr_legal_basis,
        explicit_consent_for: %i[special_category_data],
        dpo_rule: :gdpr_standard,
        fines_on: :company,
        breach_notification: { authority: "DSB", deadline: "72 hours" },
        chatbot_disclosure: true,
        content_marking: true
      },
      switzerland: {
        data_protection_law: "FADP",
        ai_act_applicable: false,      # unless the output is used in the EU
        data_protection_authority: "FDPIC",
        ai_authority: nil,             # no AI law yet, the FADP applies to AI directly
        basis_model: :fadp_justification,
        explicit_consent_for: %i[sensitive_data high_risk_profiling],
        dpo_rule: :optional,
        fines_on: :individual,         # wilful breaches, up to CHF 250,000
        breach_notification: { authority: "FDPIC", deadline: "as soon as possible" },
        chatbot_disclosure: true,      # FDPIC: users have a right to know
        content_marking: true          # FDPIC: falsified faces and voices must be indicated
      }
    }.freeze

    def self.for(country_code)
      key = { "DE" => :germany, "AT" => :austria, "CH" => :switzerland }[country_code]
      JURISDICTIONS.fetch(key || :germany) # unknown: the EU rules as the baseline
    end
  end
end

The consent pipeline uses that configuration for every AI processing step:

module DACHCompliance
  class ProcessingGate
    def process_for_ai(user:, purpose:, data:)
      config = JurisdictionConfig.for(user.country_code)

      if config[:explicit_consent_for].include?(purpose_category(purpose)) &&
         !explicit_consent?(user, purpose)
        return skip(user, purpose, "explicit consent missing")
      end

      case config[:basis_model]
      when :gdpr_legal_basis
        basis = LegalBasisRegister.for(purpose) # decided once, in the impact assessment
        return skip(user, purpose, "no legal basis") unless basis_satisfied?(basis, user, purpose)
      when :fadp_justification
        # An express objection makes further processing a breach of personality
        return skip(user, purpose, "user objected") if objected?(user, purpose)
      end

      ProcessingRecord.create!(user_id: user.id, jurisdiction: user.country_code,
                               purpose: purpose, rule: config[:basis_model],
                               processed_at: Time.current)
      yield data
    end
  end
end

And the disclosures, one place for all three markets, in du form for the German texts:

module DACHCompliance
  class AIDisclosure
    TEXTS = {
      "de-DE" => "Du chattest mit einem KI-Assistenten. Ein Mensch ist auf Wunsch erreichbar.",
      "de-AT" => "Du chattest mit einem KI-Assistenten. Ein Mensch ist auf Wunsch erreichbar.",
      "de-CH" => "Du chattest mit einem KI-Assistenten. Ein Mensch ist auf Wunsch erreichbar.",
      "en"    => "You're chatting with an AI assistant. A person is available if you prefer."
    }.freeze

    def self.chatbot_notice(user)
      config = JurisdictionConfig.for(user.country_code)
      TEXTS.fetch(user.locale, TEXTS["en"]) if config[:chatbot_disclosure]
    end
  end
end

All three markets disclose now, so the condition rarely bites. It stays in the code for the day a market's rule changes.

Worked example: three customers of Kinsale Labs

A shop in Hamburg. EU GDPR and BDSG. Personalised recommendations from tracked browsing need consent for the tracking, and Kinsale Labs, as processor, needs an Article 28 contract that names the AI processing. The chat assistant must disclose that it is an AI at the first message, which has applied since 2 August 2026. Neither feature is high risk. Kinsale Labs needs no EU representative under the GDPR, because it is established in Ireland.¹ Complaints about the chatbot's transparency go to the Bundesnetzagentur's central complaints office.⁷

A shop in Graz. The same EU rules, with the DSB for data protection. No AI market surveillance authority has been designated that I could confirm, but the duties are identical and apply now.¹³

A shop in Zürich. The FADP. No legal basis is needed as such, but shoppers who object must be excluded, and if the recommendations from Kinsale Labs were to match data into an assessment of essential aspects of someone's personality, that would be high risk profiling and need explicit consent.³ A product carousel built from what someone looked at this week is far from that line. The chat assistant still discloses, because the FDPIC says users have a right to know.¹⁵ Kinsale Labs checks whether it meets all four conditions for a Swiss representative. It processes regularly and at scale, but not at high risk, so not all four are met.³ The output is not used in the EU, so the AI Act does not reach these Swiss shoppers.

The DACH checklist for an Irish seller

Before shipping AI features into the DACH market:

1. Map every end user's jurisdiction. Germany, Austria or Switzerland, and log which rule you applied.
2. Check which representatives you need. None inside the EU: an Irish establishment needs no GDPR representative and no AI Act authorised representative. A Swiss representative if all four FADP conditions are met.
3. Set the legal basis per purpose. A GDPR basis for Germany and Austria, a FADP justification for Switzerland, explicit consent for high risk profiling and sensitive data everywhere.
4. Disclose AI everywhere. Article 50 in Germany and Austria since 2 August 2026, the FADP in Switzerland as the FDPIC reads it. Mark generated content.
5. Know the regulators. At home: the DPC, your lead supervisory authority for cross border processing in the EU. Germany: the state data protection authority for your customer, the Bundesnetzagentur for the AI Act. Austria: the DSB, and an AI authority still to come. Switzerland: the FDPIC.
6. Write one impact assessment that covers all three. The risks differ because the legal model, the enforcement and the liability differ, so say so per market.
7. Brief the people, not just the company, on Switzerland. Fines for wilful breaches land on individuals.
8. Keep the data flows simple. Hosting in Ireland, or anywhere in the EU, covers Germany and Austria, and Switzerland and the EU recognise each other.⁴⁵
9. Write the texts per market. German German, Austrian German and Swiss German differ in words and legal terms, and English for everyone else.
10. Watch three calendars. Austria's implementing law, the Swiss consultation in spring 2027, and the AI Act's high risk dates in December 2027 and August 2028.

The bottom line

The DACH market is three regulatory worlds sharing one language. Germany has its implementing law, one central AI authority and 16 state data protection authorities. Austria applies the same EU rules and is still building the authority to enforce them. Switzerland has no AI Act, a data protection act that already covers AI, and fines that find the individual.

For an Irish business, the answer is not three systems. It is one architecture that knows where each end user is and configures itself. The same Rails codebase, the same patterns from building GDPR compliant AI features and the right to be forgotten, and a different configuration per market. Build the compliance once. Configure it per market.

Footnotes

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3(1), 27(1), 56(1) and 83(5), EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

2. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2(1), 4, 22(1), 50, 70 and 113, Official Journal of the European Union, 12 July 2024, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689

3. Federal Act on Data Protection (FADP), SR 235.1, Articles 5, 6, 14, 21, 30, 31 and 60, unofficial English translation, version of 1 September 2023, Fedlex, https://www.fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20230901/en/pdf-a/fedlex-data-admin-ch-eli-cc-2022-491-20230901-en-pdf-a.pdf

4. European Commission, Adequacy decisions, accessed November 2026, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

5. Data Protection Ordinance (DPO), SR 235.11, Annex 1, version of 1 September 2023, Fedlex, https://www.fedlex.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/568/20230901/en/pdf-a/fedlex-data-admin-ch-eli-cc-2022-568-20230901-en-pdf-a.pdf

6. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1, points 5, 39 and 40, and Article 4, Official Journal of the European Union, 24 July 2026, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744

7. Gesetz zur Durchführung der Verordnung über künstliche Intelligenz vom 22. Juli 2026, BGBl. 2026 I Nr. 223, Article 1 (KI-MIG), sections 2, 4, 5, 8 and 13, and Article 5, recht.bund.de, https://www.recht.bund.de/eli/bund/bgbl-1/2026/223

8. Bundesdatenschutzgesetz (BDSG), section 40, gesetze-im-internet.de, https://www.gesetze-im-internet.de/bdsg_2018/__40.html

9. European Data Protection Board, Members, accessed November 2026, https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

10. Bundesdatenschutzgesetz (BDSG), section 38, gesetze-im-internet.de, https://www.gesetze-im-internet.de/bdsg_2018/__38.html

11. Parlament Österreich, 5638/J XXVIII. GP, Anfrage betreffend Wo bleibt die Umsetzung des AI Acts?, 2 April 2026, https://www.parlament.gv.at/dokument/XXVIII/J/5638/fname_1752944.pdf

12. Parlament Österreich, 5056/AB XXVIII. GP, Anfragebeantwortung des Bundeskanzlers, 2 June 2026, https://www.parlament.gv.at/dokument/XXVIII/AB/5056/imfname_1761608.pdf

13. ORF, Grüne kritisieren fehlende KI-Aufsicht, 30 July 2026, https://orf.at/stories/3437724/

14. Federal Office of Communications (OFCOM), Artificial Intelligence: Regulation in Switzerland, 28 October 2026, https://www.bakom.admin.ch/en/artificial-intelligence

15. Federal Data Protection and Information Commissioner (FDPIC), Current data protection legislation is directly applicable to AI, 9 November 2023, https://www.edoeb.admin.ch/en/09112023-current-data-protection-legislation-is-directly-applicable-to-ai

16. Federal Data Protection and Information Commissioner (FDPIC), The new Data Protection Act from the FDPIC's perspective, https://www.edoeb.admin.ch/dam/en/sd-web/uZlw439wGOR9/Leitfaden%20Das%20neue%20Datenschutzgesetz%20aus%20Sicht%20des%20ED%C3%96B_20221009_EN.pdf