Germany is the most important foreign market for many Swiss companies, and this website now also receives more visitors from Germany than from Switzerland. Selling there means bringing not only products across the border but also duties into the company. This article sets out the most important ones as of November 2026.
Data protection: GDPR and EU representative
The GDPR applies to a Swiss company when it targets people in the EU with goods or services or monitors their behaviour, for example through tracking. Indications of targeting are prices in euros, delivery to Germany or advertising aimed at German customers. Without an establishment in the EU, the company then usually has to appoint a representative in the EU. Transfers of data from the EU to Switzerland need no additional safeguards, because the EU recognises Switzerland’s level of data protection.
Accessibility: BFSG
Germany’s Accessibility Strengthening Act has applied since 28 June 2025. It covers, among other things, online shops and apps through which consumers conclude contracts, regardless of the provider’s seat. Microenterprises with fewer than ten employees and at most EUR 2 million turnover are exempt for services. The practical yardstick is WCAG 2.1 level AA. Pure B2B offerings are generally not covered.
E-invoicing: a duty for German companies
From 1 January 2027 companies in Germany with more than EUR 800,000 prior-year turnover must issue invoices to other domestic businesses as e-invoices under EN 16931, from 2028 all of them. According to the German tax authorities, this applies only when both supplier and recipient are established in Germany. For a Swiss company without a German establishment the duty therefore generally does not apply. It still matters in practice: German customers are switching their incoming processes to structured invoices and asking their suppliers for them.
Data Act: connected products and SaaS
Anyone offering connected products or software as a service in the EU has been subject to the Data Act since September 2025. Users of connected products are entitled to the data generated; for products placed on the market from 12 September 2026, access must be built into the design. SaaS providers must enable customers to switch to another provider, and switching charges disappear from 12 January 2027.
NIS2: indirectly through the supply chain
Germany’s NIS2 implementation act has applied since 6 December 2025 to important and essential entities in Germany. A Swiss company is not directly covered. Its German customers, however, must address supply chain security and pass requirements down by contract: security measures, incident reporting, evidence. Companies with a German subsidiary check that subsidiary’s own applicability.
AI Act and KI-MIG
If a Swiss company offers AI systems in Germany or their output is used there, the AI Act applies. Since 29 July 2026, Germany’s KI-MIG has regulated supervision: the Federal Network Agency is the central market surveillance authority, BaFin for the financial sector. For most applications the transparency duties under Article 50, applicable since 2 August 2026, are what matters.
Whistleblower protection and further thresholds
A German subsidiary with at least 50 employees is subject to the Whistleblower Protection Act with an internal reporting office. The Swiss parent is not affected, because Switzerland has no general law on this. Groups with several entities should therefore check thresholds per entity, not for the group as a whole.
Summary
Most duties reach Swiss companies through their offering in Germany, not through their seat. Directly relevant are mainly the GDPR, accessibility for consumer offerings, the Data Act and the AI Act. E-invoicing and NIS2 act indirectly through customer expectations. Which rules apply in a given case is shown by a compliance assessment; the differences between the three countries are summarised in our overview regulations compared across DACH, and the competent authorities in supervisory authorities in the DACH region.