Regulations in Switzerland, Germany and Austria compared
Switzerland, Germany and Austria regulate key compliance topics differently. Germany and Austria implement EU law such as NIS2, the European Accessibility Act and whistleblower protection; Switzerland has its own laws such as the FADP and the ISA, and EU law reaches Swiss companies mainly through their offering in the EU.
Last updated: 13.11.2026
This overview sets the main regulations for companies side by side, as of 13 November 2026. It shows which law applies in which country and where the differences lie, and links to detailed explanations in the glossary.
Whether a regulation applies to a given company depends on seat, size, sector and offering. The overview does not replace that check; our regulatory check gives a first impression.
| Topic | Switzerland | Germany | Austria | Explainer |
|---|---|---|---|---|
| Data protection | Federal Act on Data Protection (FADP) since 1 Sep 2023; GDPR additionally when offering in the EU | GDPR and Federal Data Protection Act (BDSG) | GDPR and Data Protection Act (DSG) | Explainer |
| Data protection supervisor for companies | FDPIC | Data protection authority of the federal state | Data Protection Authority | Explainer |
| Cybersecurity | Information Security Act (ISA); reporting duty for critical infrastructure since 1 Apr 2025 | NIS2 implementation act since 6 Dec 2025; registration with the BSI | NISG 2026 since 1 Oct 2026; registration within three months | Explainer |
| Cyber incident reporting deadline | 24 hours to the NCSC (BACS) | 24-hour early warning, 72-hour notification, one-month final report | 24-hour early warning, 72-hour notification, final report | Explainer |
| Artificial intelligence | No AI act; EU AI Act when offered or used in the EU | EU AI Act and KI-MIG since 29 Jul 2026 | EU AI Act; AI service desk at RTR as contact point | Explainer |
| AI supervision | Sector supervision, such as FINMA Guidance 08/2024 in finance | Federal Network Agency, BaFin in the financial sector | Under Austrian implementing law | Explainer |
| Accessibility for private providers | No general duty; EAA applies to consumer offerings in the EU | Accessibility Strengthening Act (BFSG) since 28 Jun 2025 | Accessibility Act (BaFG) since 28 Jun 2025 | Explainer |
| Whistleblower protection | No general law | HinSchG since 2 Jul 2023, internal channel from 50 employees | HSchG since 2023, internal channel from 50 employees | Explainer |
| B2B e-invoicing | No duty | Receipt since 1 Jan 2025; issuing from 2027 (prior-year turnover above EUR 800,000) or 2028 | No general duty | Explainer |
| E-invoicing to public authorities | Federal administration since 2016 from CHF 5,000 contract value | Federal level since 2020 | Federal level since 2014 | Explainer |
| Transparency register | TJPG, register since 1 Oct 2026 | Transparency register under the Money Laundering Act | Register of beneficial owners (WiEReG) | Explainer |
| Supply chain due diligence | Conflict minerals and child labour, Art. 964j et seq. CO | Supply Chain Due Diligence Act (LkSG), revision announced | No national law; EU directive pending | |
| Data from connected products | EU Data Act when offering in the EU | EU Data Act since 12 Sep 2025 | EU Data Act since 12 Sep 2025 | Explainer |
| Financial sector ICT resilience | FINMA Circular 2023/1 | DORA since 17 Jan 2025 | DORA since 17 Jan 2025 | Explainer |
Notes
- Legal position 13 November 2026. Deadlines and responsibilities may shift through legislative changes; the overview is updated when they do.
- For Germany’s LkSG, a narrowing of scope has been announced but not yet adopted.
- In Liechtenstein, EU legal acts apply once incorporated into the EEA Agreement; the GDPR applies directly there.
Frequently asked questions
Does EU law apply to Swiss companies?
Not because of their seat, but often because of their offering: the GDPR, AI Act, European Accessibility Act and Data Act attach to offerings in the EU.
Which country has the strictest rules?
There is no blanket answer. Germany has additional national duties such as the HinSchG, BFSG and e-invoicing; Switzerland has its own, such as the ISA reporting duty and the transparency register.
How do I find out what applies to my company?
With an applicability check per regulation. Our regulatory check gives a first impression, a compliance assessment a robust one.
Sources
- Federal Act on Data Protection (FADP), SR 235.1
- Information Security Act (ISA), SR 128
- German NIS2 Implementation and Cybersecurity Strengthening Act
- Austrian Network and Information Systems Security Act 2026
- KI-MIG of 22 July 2026, BGBl. 2026 I No. 223
- Sections 14 and 27(38) German VAT Act
- Regulation (EU) 2023/2854 (Data Act)
More overviews
- Regulatory deadlines 2023 to 2028: data protection, AI, cyber and anti-money laundering
- Beneficial ownership (UBO) thresholds by jurisdiction
- Recognised self-regulatory organisations (SROs) in Switzerland
- Thresholds in Swiss public procurement for 2026 and 2027
- Supervisory authorities in the DACH region: data protection, cybersecurity, AI and financial markets
- Compliance thresholds in the DACH region: when which duty applies