AI Assistant for Microsoft Teams in Swiss SMEs: What Are the Rules?

Swiss SMEs can use an AI assistant for Microsoft Teams such as amaiko even though the data sits in Germany, because Germany and the entire EU appear on the Swiss list of countries with adequate data protection. The real work lies elsewhere. It sits in the data processing agreement, in transparency toward employees, and in one setting in the Microsoft Admin Center that has affected Swiss tenants since March 2026. This article walks through them in the order a managing director or IT lead would tackle them.

Does the Swiss Federal Act on Data Protection apply to AI assistants in Teams?

Yes, with no special exemption. On 24 September 2025 the Federal Data Protection and Information Commissioner (FDPIC) confirmed that the Swiss Federal Act on Data Protection (FADP) is worded in a technology-neutral way and therefore applies directly to AI-based data processing. Anyone who feeds personal data into an AI tool is the controller under the Act, regardless of whether Microsoft, OpenAI or a provider from Bavaria runs the tool.

For use inside a company, this comes down mainly to transparency. You have to disclose the purpose, the functioning and the data sources of the AI-based processing, including whether user data is reused for training. On top of that comes the entry in the register of processing activities, where the company is obliged to keep one. A data protection impact assessment is only due once the processing carries a high risk for the people affected.

A Teams assistant that writes minutes, prioritizes emails and finds internal documents stays below the threshold for an impact assessment in most SMEs. Profiling customers or evaluating applicant data would be a different matter.

May the data be stored in Germany?

Yes. The FADP allows cross-border disclosure of personal data without additional safeguards when the Federal Council has certified that the destination country provides adequate data protection. Those countries are listed in Annex 1 of the Data Protection Ordinance (DPO), and the EU member states are among them. As far as data protection law is concerned, Germany is domestic territory with a different currency for Swiss companies.

amaiko stores all data in German data centers and processes it exclusively within the EU. For a Swiss SME that means signing a data processing agreement and, where you are obliged to keep one, adding an entry to the register. That is the whole job. Standard contractual clauses, transfer impact assessments and the debate around the US Data Privacy Framework fall away, because not a single byte travels to a country without an adequacy decision.

Things look different as soon as a provider processes data in the United States. Then you need contractual safeguards and a risk assessment, which is where the next section comes in.

What does Flex Routing mean for Swiss Copilot tenants?

Microsoft has introduced a feature called Flex Routing for Microsoft 365 Copilot. During peak load, model processing may take place outside the EU Data Boundary, specifically in the United States, Canada or Australia. The feature explicitly applies to tenants in the EU and the EFTA, which includes Switzerland. For tenants created after 25 March 2026 it is switched on by default.

Microsoft writes that “All tenant administrators are encouraged to check their tenant’s flex routing setting.” For a Swiss SME this means a check in the Admin Center under Copilot, Settings, Flex routing during peak load periods, plus documenting the decision for your data protection advisor. Anyone unaware of the setting can neither assess nor document the cross-border disclosure — and that assessment is what the law asks for.

Microsoft has announced in-country processing of Copilot interactions for 15 countries, Switzerland among them. Since the April 2026 update, though, only Australia, India, the United Arab Emirates, the United Kingdom and the United States are named for the end of 2026, with Canada following in 2027 and Japan in 2028. Switzerland has no date. Flex Routing therefore stays a setting someone has to manage actively for the foreseeable future. What this means on the GDPR side is covered in Is Copilot GDPR-compliant in 2026, or are there alternatives?

Criterion	amaiko	Microsoft 365 Copilot (Swiss tenant)
Data storage location	Germany	Switzerland or EU Data Boundary
AI processing	EU only, by design	EU Data Boundary, at peak load United States, Canada, Australia if Flex Routing is active
Flex Routing	not present	on by default for tenants created from 25 March 2026, opt-out in the Admin Center
Legal basis for cross-border disclosure	adequacy (DPO Annex 1)	adequacy for the EU, safeguards required for processing outside it
Required license	any Microsoft 365 license with Teams	Business Basic, Standard, Premium, Apps for Business; enterprise edition adds E3, E5, F3 and more
Memory across conversations	persistent, grows automatically	per session
Price per user per month	€29.91 billed annually, billing in CHF available	€18.20 (Business) to €26.00 (Enterprise) plus base license

What does a Swiss SME need from the assistant itself?

More than 99% of Swiss companies are SMEs, and most of them have no IT department of their own. Their requirements for an AI assistant therefore differ from a large corporation’s.

It has to start without a project. amaiko is installed in Teams from the Microsoft Marketplace, signs in through Microsoft Entra and inherits the existing permissions. A channel an employee is not allowed to see stays invisible to that employee’s assistant as well.

It has to retain knowledge. In a 40-person business, one person knows the supplier terms and another knows the customer history. If one of them leaves, the knowledge leaves with them. amaiko builds a persistent company memory from conversations, meetings and documents, and that memory stays. An employee resigns: how to secure their knowledge describes what this looks like day to day.

It has to speak up on its own. An assistant nobody opens meets no compliance requirement and saves no hours. The Morning Briefing in Teams summarizes open tasks, new emails and the day ahead before anyone asks.

How do you roll out the assistant in line with data protection law?

The sequence that has proven itself in Swiss SMEs has four steps. First, sign the data processing agreement with the provider and check that the storage location is in a country with an adequacy decision. Then, if the company is obliged to keep a register of processing activities, add the entry with purpose, data categories and recipient. Next, extend your privacy policy and an internal usage policy by a paragraph on AI use so that the transparency obligation is met. Finally, review the access rights in Teams, because the assistant sees exactly what the respective user sees.

For teams with particularly strict requirements, such as fiduciaries, law firms or healthcare providers, there is liberté at €44.87 per user per month, or €429 per user per year when billed annually. Every model comes from Mistral and every token is processed in the EU, as a permanent architectural decision.

To see how amaiko fits into your tenant, book a demo. We go through the data processing agreement and the permissions together, with your data protection advisor in the meeting if you like. What the rollout costs, and which items appear on no price list, is worked out in What does amaiko cost per user in everyday Microsoft 365 work?

Frequently Asked Questions (FAQ)

Can a Swiss SME use an AI assistant that stores data in Germany?

Yes. Germany and every EU member state are listed in Annex 1 of the Data Protection Ordinance (DPO) as countries with adequate data protection. Personal data may be disclosed there without additional safeguards.

Does the Swiss Federal Act on Data Protection apply to AI tools at all?

Yes. On 24 September 2025 the Federal Data Protection and Information Commissioner (FDPIC) clarified that the Swiss Federal Act on Data Protection (FADP) is worded in a technology-neutral way and applies directly to AI-based data processing.

Do I need a data protection impact assessment to use the assistant?

Only where the processing poses a high risk to the people affected. An assistant that works through a team’s internal documents, meetings and emails usually stays below that threshold. The data processing agreement is mandatory regardless. The register of processing activities only applies if the company has 250 or more employees, processes sensitive personal data at scale, or carries out high-risk profiling; below that it is advisable but not required.

Is Microsoft 365 Copilot affected by Flex Routing for Swiss tenants?

Yes. Flex Routing applies to tenants in the EU and the EFTA, which includes Switzerland. For tenants created after 25 March 2026 it is switched on by default. Microsoft encourages every administrator to check the setting; if you do not want processing outside the EU, you switch it off in the Admin Center.

Does amaiko store data in Switzerland?

No, in German data centers. All AI processing takes place inside the EU. Data leaves the EU only if you explicitly book that.

What does amaiko cost for a Swiss team?

€29.91 per user per month, billed annually. Billing runs through Stripe in the currency of your choice, including Swiss francs.

Do I have to inform employees and customers about the use of AI?

Yes. The FDPIC requires that the purpose, functioning and data sources of AI-based processing are disclosed transparently. A paragraph in your privacy policy and an internal usage policy cover this in most cases.