AI in Swiss healthcare: legal framework, hospital uses and Galeon AI

The essentials in 30 seconds

Introduction

No cross-sector Swiss law targets AI to date, so the rules on healthcare AI in Switzerland are read in three texts already in force: the Federal Act on Data Protection, in force since 1 September 2023, medical device law and cantonal law. The uses moving forward in hospitals are clinical documentation, coding and decision support, always under human validation.

Few pages connect the applicable law, hosting decisions and real deployments in a single read. This article follows the order of a management committee's questions: who governs what, what is already running, what public evaluations establish.

Every figure carries its source and date. When a piece of information could not be confirmed, the text says so rather than filling the gap. This is the case for AI-assisted coding: no publicly documented Swiss deployment was found, so no example is made up.

Galeon, a French electronic health record (EHR) vendor founded in 2016, is extending its offer to Swiss hospitals. Its answer to the framework described here is in the first section.

How does Galeon's AI fit the Swiss framework?

Galeon equips 19 hospitals in France, with about 10,000 clinician users. Its AI is built into the patient record and trained on about 3 million records. The Swiss examples cited below describe the market, not Galeon.

Structured data at the source

Record data is coded and structured from the moment of entry, which makes it usable by AI. A model works on what the record contains: this foundation meets the condition that Swiss sources place last, and the most decisive one.

Uses built into the record

• Automatic coding: Galeon spots uncoded or under-coded procedures and proposes PMSI (French hospital activity information system) and CCAM (French classification of medical procedures) codes, which matches the need for reliable upstream documentation revealed by the Vaud review.
• Prescription scanning: handwritten or printed prescriptions are read and fill the record, with no re-entry. The scan is built into the EHR.
• Prescribing support: interactions, contraindications and doses are checked at entry by a module with LAP certification (certification of prescribing support software) from the HAS (French National Authority for Health). The tool assists, the prescriber decides.
• Human validation: summaries proposed by the AI are reviewed and validated by the clinician, as institutional charters require.

Hosting in France, HDS-certified

The health data of Galeon's clients is hosted in France with an HDS-certified host (French health data hosting certification). A Swiss hospital weighs this hosting against its own cantonal law and the privatim position, together with its legal counsel.

What does Swiss law say about AI in hospitals?

The Federal Act on Data Protection (FADP) applies directly to AI, because it covers all technologies. For a public cantonal hospital, it is generally cantonal law that governs the processing.

The FADP applies to every technology, AI included

The Federal Data Protection and Information Commissioner (FDPIC) says so on its page on AI, published on 24 September 2025. Manufacturers, providers and users must make the purpose, operation and data sources of an AI-based processing transparent.

The person concerned can object to automated processing and ask for a human to review an automated decision. Where the risk is high, the law requires an impact assessment, that is, a written review of the processing risks for the persons concerned, carried out before go-live.

Health data calls for an impact assessment

Health data is sensitive data within the meaning of the law. Large-scale processing of such data is among the examples of high risk that call for an impact assessment (FADP, art. 5 and 22). An AI project connected to the patient record therefore documents its assessment before deployment.

The law does not say which model is allowed. Each institution answers for its choices, and the quality of its documentation is what protects it if a supervisory authority asks questions.

Public hospital, private hospital: two regimes

In a joint memo of 16 September 2026, the FDPIC and privatim, the conference of Swiss data protection commissioners, separate two cases. Public institutions fall under the principle of legality and cantonal law. Private clinics without a public mandate fall under the FADP.

A hospital in French-speaking Switzerland therefore first checks the law of its canton and the authority that oversees it, then reads the FADP. The text names no cantonal law: a lawyer must confirm the regime of each canton concerned.

Is there a Swiss law on AI?

Not to date. The Swiss Confederation's SME Portal states that no cross-sector law specific to AI exists and that general and sector-specific laws apply.

What the Federal Council has announced

On 12 February 2025, the Federal Council announced its intention to ratify the Council of Europe Convention on AI. It is also pursuing sector-specific regulation, with health cited as an example. Switzerland has signed the Convention, according to the federal press release of 23 September 2026, which does not give the signing date.

What is not in force

A draft for consultation is announced for spring 2027. It covers transparency, data protection, non-discrimination and oversight. None of this is in force, and its final content may still change.

Is a clinical AI a medical device in Switzerland?

It depends on the product, and qualification is the manufacturer's responsibility. An AI software can be a medical device, or not, depending on its intended purpose.

Software is part of the definition of a medical device

Swissmedic points out that software falls within the definition of a medical device (Medical Devices Ordinance, art. 3). The manufacturer classifies its product as class I, IIa, IIb or III under article 15, with Annex VIII of the European regulation and the MDCG 2019-11 guidance (Swissmedic, frequently asked questions).

Swissmedic has no framework of its own for AI in devices

Swissmedic's page on AI mainly concerns medicines. The authority states that it relies on international guidelines, including the IMDRF principles on machine learning (January 2025). The page consulted does not present a Swiss framework specific to AI in devices, which does not prove that none exists.

The HUG go in the same direction in their charter of 21 January 2025: an AI medical device must be validated under their security policy and carry a CE marking.

What to ask the vendor, in writing

The question takes a few lines, and the answer binds the vendor. Three points are enough to open the discussion:

• Qualification: is the tool a medical device according to the manufacturer, yes or no?
• Class: I, IIa, IIb or III, with the classification rule applied.
• Marking: does the product carry a CE marking, and for which intended purpose?

Where can health data be hosted, and can it be transferred abroad?

The FADP allows disclosure abroad to a country judged adequate, or subject to safeguards. For a public hospital, this federal green light does not settle everything.

What federal law allows

Disclosure of data abroad is allowed to a country judged adequate by the Federal Council, or subject to safeguards such as standard clauses (FADP, art. 16). For the United States, the Federal Council recognised on 14 August 2024 that companies certified under the Data Privacy Framework offer an adequate level of protection, effective 15 September 2024.

What cantonal commissioners read

In November 2025, privatim adopted a resolution on international cloud services. Public bodies should entrust particularly sensitive data to them only with full encryption, managed by the bodies themselves (publication of the Fribourg data protection authority, 24 November 2025).

How institutions are reacting

The HUG charter bans sending identifying data to a generative AI tool, because these tools run on infrastructure the HUG do not operate. A CHUV study of September 2026 notes that small open models can run inside the hospital infrastructure, with no external cloud.

Does the AI Act apply to a Swiss vendor, and is every clinical AI high risk?

The AI Act targets providers first, including those established outside the Union. Not every clinical AI is high risk: classification depends on the use and on the regulatory status of the product.

Scope: the Union market

The AI Act applies to providers that place a system on the Union market, whether they are established in the Union or in a third country. It also covers providers and users in third countries whose outputs are used in the Union (art. 2). A vendor serving the Union is therefore concerned for those products. The effect for a Swiss hospital that is not a provider is not covered here.

The two routes to high risk

Article 6 provides two routes. First route: the system is a safety component of a product governed by Annex I legislation and subject to third-party conformity assessment, which can cover certain medical devices.

Second route: the system falls under a use listed in Annex III. In that case, a derogation exists for narrow procedural or preparatory tasks, except profiling.

A timetable that has moved

Regulation (EU) 2026/1744, in force since 27 July 2026, pushes the Annex III rules to 2 December 2027 and the Annex I rules to 2 August 2028 (European Commission). Medical devices remain in Annex I, according to a law firm's analysis (QLE, 3 August 2026).

Earlier deadlines are therefore out of date. A vendor that announces August 2026 or August 2027 is referring to a timetable that predates this regulation.

Which AI uses are actually deployed in Swiss hospitals?

Three uses stand out in public sources: clinical documentation, coding and decision support. Only the first is documented as deployed.

Clinical documentation: a deployment with figures

Swiss Medical Network operates 19 hospitals and 60 medical centres. In January 2026, after a pilot, the group deployed an assistant that drafts notes and letters from conversations between physicians and patients. The tool is connected to the hospital patient record and to the outpatient software.

The group counts 43,967 documents created in eight months (CIO.de, 23 October 2026). The article does not specify the hosting, and its two estimates of time saved do not agree: they are not quoted here.

Coding: the issue is upstream documentation

Swiss coding relies on ICD-10-GM and CHOP, and an external audit checks it. In the review of the canton of Vaud on 2024 data, 95 of the 915 principal diagnoses reviewed were wrong, and 22 of the 802 principal treatments (NICE Computing report, 2026).

This gap locates the issue: a correct code depends on the quality of upstream documentation. This is a reviewed sample, which should not be extrapolated to the whole of Switzerland. No Swiss deployment of AI-assisted coding was found in open public sources, and adding it to a list of uses without a source would be a promise.

Decision support: evaluations, not yet routine

The CHUV evaluated six open models of 8 to 24 billion parameters on real, de-identified data in French. Information extraction gave near-perfect results for two of them.

One model added information absent from the text in more than half of the discharge letter translations evaluated. Decision support received ratings ranging from neutral to unsatisfactory, and no model was judged reliable enough for autonomous clinical reasoning (CHUV, 24 September 2026).

The MOOVE-CHUV project mobilised 241 clinicians from 22 specialties, for more than 3,700 clinical vignettes and more than 12,500 evaluations. A trial of Meditron in the CHUV emergency department was announced for May 2026 (swissinfo, 31 December 2025): its progress has not been confirmed by an official source.

What conditions make a healthcare AI project succeed in Switzerland?

Seven conditions emerge from the sources, from the written rule of use to the quality of data at the source. Each has a cost that management must face squarely.

Frame the use and the product

• A written rule of use. The HUG charter bans identifying data in unauthorised tools and requires human verification before any publication.
• An impact assessment documented before any large-scale processing of health data (FADP, art. 22).
• A written qualification of the product: medical device or not, class, marking (Swissmedic).
• Hosting that withstands the reading of supervisory authorities, particularly for a public hospital (privatim).

Evaluate and validate

The CHUV suggests starting from a clinical need, testing on representative data, involving clinicians and analysing errors before going into production. Human validation remains systematic: fluent text can be wrong, and the CHUV study showed it on translation.

Have structured data at the source

The Vaud coding gap is a reminder of the weight of upstream documentation: badly entered data stays bad, whatever tool sits behind it.

Accept the cost of these conditions

Human validation reduces the time saved. Local hosting requires resources that not every institution has. These trade-offs are the price of a deployment that clinicians and supervisory authorities can defend.

What it changes for management, IT and clinicians

For management

Management answers for the choice of the applicable regime. It starts by identifying its institution's cantonal law and the authority that oversees it, then has a lawyer confirm that regime.

It also requires a written record of the impact assessment before any deployment on the patient record.

For IT

The IT department asks the hosting questions: where the model runs, who manages the encryption key, how much of the data leaves the infrastructure. The HUG charter and the CHUV study show two answers, banning external tools for identifying data and trialling small local models.

IT also asks the vendor for its written qualification decision, its class if any, and its CE marking.

For clinicians

Clinicians keep control of the content. An AI that drafts notes and letters produces a draft, and human verification before publication is the rule adopted by the HUG charter.

They can also rely on the CHUV results: information extraction proves reliable, autonomous clinical reasoning does not, and a translation can add elements absent from the original text.

Limits and points of caution

• Cantonal law is not detailed. No cantonal law is named here. The regime of each public hospital must be confirmed by a lawyer.
• The privatim resolution was not read in full. The adoption date varies by source (18 or 24 November 2025), and its exact scope remains to be checked on the privatim website.
• Federal regulation is not settled. The signing date of the Council of Europe Convention is not known, and the draft announced for spring 2027 may still change.
• Deployment figures come from operators. Those of Swiss Medical Network need confirming with the group, in particular the scope (hospitals or outpatient centres) and the hosting.
• The Meditron trial in the CHUV emergency department is not confirmed by an official source, and the Vaud coding figures do not generalise to Switzerland.

FAQ

What does Galeon's AI do in the patient record?
It proposes PMSI and CCAM coding of procedures, reads scanned prescriptions, checks each prescription with a module with LAP certification from the HAS, and supports voice dictation. The clinician validates.

Does the nFADP apply to an AI that reads the patient record?
Yes, when it processes personal data. The FDPIC states that the law applies directly to data processing based on AI. For a public cantonal hospital, it is generally cantonal law that governs the processing.

Is there a Swiss law on AI?
Not to date. The Swiss Confederation's SME Portal states that no cross-sector law specific to AI exists and that general and sector-specific laws apply. A draft for consultation is announced for spring 2027.

Is a tool that writes clinical reports a medical device?
Qualification is made case by case, under the manufacturer's responsibility, according to article 15 of the Medical Devices Ordinance. Ask the vendor for its written decision.

Can a Swiss hospital use an AI hosted in the United States?
Federal law has accepted transfers to US companies certified under the Data Privacy Framework since 15 September 2024. A public hospital must also take its cantonal law and the privatim resolution of November 2025 into account.

Does the AI Act concern a Swiss vendor?
Yes, if it places a system on the Union market or if its outputs are used there. High-risk classification depends on the use and the product, with deadlines now set at 2 December 2027 and 2 August 2028.

Are there examples of AI deployed in a Swiss hospital?
Yes for clinical documentation: Swiss Medical Network deployed a writing assistant in January 2026. For decision support, the CHUV has run evaluations, with no documented routine use. No AI coding deployment was found.

In summary

Galeon, a French EHR vendor, equips 19 hospitals for about 10,000 clinicians. Its AI, trained on about 3 million records, rests on structured data at the source, with automatic coding, prescription scanning and LAP-certified prescribing support, hosted in France with an HDS-certified host. The vendor is extending its offer to Swiss hospitals.

On the framework side, healthcare AI in Switzerland does not wait for a law: the FADP, medical device law and cantonal law already apply, and a public hospital looks first at the law of its canton. Hosting is read in federal law and in the position of cantonal commissioners. The AI Act concerns vendors that serve the Union, with deadlines pushed back to December 2027 and August 2028. Documented deployments remain centred on documentation, with systematic human validation.

Read also: AI and health data, what every hospital must master

Sources

• Data protection: FDPIC, AI and data protection (the FADP applies to AI, transparency, objection, impact assessment), Fedlex, FADP (RS 235.1) (sensitive data, disclosure abroad, impact assessment) and FDPIC and privatim, memo of 16 September 2026 (public institutions under cantonal law, private clinics under the FADP).
• AI regulation in Switzerland: Swiss Confederation SME Portal (no cross-sector law, draft in spring 2027), Federal Office of Justice, artificial intelligence (mandate of 12 February 2025) and Federal Council, ratification of the Council of Europe Convention (12 February 2025, sector-specific approach).
• Medical devices and transfers: Swissmedic, frequently asked questions (software, classification, manufacturer's responsibility), Swissmedic, artificial intelligence (reliance on international guidelines) and Federal Council, Swiss-US Data Privacy Framework (14 August 2024).
• Institutional rules: HUG, charter on the use of AI solutions (21 January 2025) and Fribourg data protection authority, privatim resolution (24 November 2025, international cloud and encryption managed by the public body).
• AI Act: article 2 and article 6 (scope, routes to high-risk classification), European Commission, regulatory framework for AI (timetable of 2 December 2027 and 2 August 2028) and QLE, 3 August 2026 (Regulation (EU) 2026/1744, medical devices in Annex I).
• Uses in Switzerland: CIO.de, Swiss Medical Network (43,967 documents in eight months), canton of Vaud, 2024 medical coding review (95 wrong principal diagnoses out of 915), CHUV, small language models, MOOVE-CHUV project and swissinfo, announced Meditron trial.
• Galeon: Galeon AI in practice and the Galeon EHR, then structured health data, the prerequisite for AI and how to evaluate a clinical AI.
• Galeon: which EHR to choose to feed the EPR in Switzerland.

‍