GuideFADP · Article 21Version 1.025 October 2026

Automated individual decisions under the Swiss FADP

Article 21 of the Swiss Federal Act on Data Protection, in force since 1 September 2023, requires a controller to inform a person of any decision based exclusively on automated processing that has a legal effect on them or significantly affects them, and to let them state their position and ask for a review by a natural person. This page sets out its 2 exceptions, the impact assessment of Article 22, the FDPIC position on AI and the record that answers a review request, read in primary sources on 25 October 2026.

Book a 30‑min call Read what Article 21 requires
Evidence and audit plane (C2): one record per action, the record a review request is answered from.
Reference text
Federal Act on Data Protection, SR 235.1, Articles 21 and 22
In force
Since 1 September 2023
Exceptions
2, in paragraph 3: contract, express consent
Status checked
25 October 2026, in primary sources
On this page
  1. Status and conventions
  2. 1. What Article 21 requires
  3. 2. When a decision is exclusively automated
  4. 3. Article 22: the impact assessment
  5. 4. The FDPIC position on AI
  6. 5. The record that answers a review request
  7. 6. Questions controllers ask
  8. 7. References and sources
  9. 8. Versioning and citation
0 · Status and conventions

A data protection rule that already governs AI decisions.

In this page, "we" means Hikari Blue, which engineers and operates the AI operating layer for companies in Switzerland, the United States and France. Article references are to the Federal Act on Data Protection (FADP), SR 235.1, in its version of 7 July 2025; Articles 21 and 22 read as they did on 1 September 2023.

English is not an official language of the Swiss Confederation: the English text on Fedlex is a translation for information only, with no legal force. The English quotations on this page come from it; the French edition quotes the official French text.

This is not legal advice. Whether one decision is exclusively automated, and whether an exception covers it, is a question for counsel, on the facts of that decision.

1 · Article 21

What Article 21 requires, and the exceptions of paragraph 3

Article 21 contains no prohibition of automated decisions. It attaches to them a duty to inform and, on request, a right to be heard and to a review by a natural person. It binds private controllers and federal bodies, which the act covers alike.

Provision What the text says What the controller does
Art. 21(1) · Duty to inform "The controller shall inform the data subject about any decision that is based exclusively on automated processing and that has a legal consequence for or a considerable adverse effect on the data subject (automated individual decision)." Tells the person that the decision was automated, without waiting to be asked.
Art. 21(2) · Point of view and review "It shall on request allow the data subject to express their point of view. The data subject may request that the automated individual decision be reviewed by a natural person." Hears the person when asked, and has a natural person review the decision when the person requires it.
Art. 21(3)(a) · Contract exception Paragraphs 1 and 2 do not apply if the decision "is directly connected with the conclusion or the processing of a contract between the controller and the data subject and the data subject's request is granted". Both conditions are cumulative: a contract-related decision that refuses what the person asked for stays under paragraphs 1 and 2.
Art. 21(3)(b) · Consent exception Paragraphs 1 and 2 do not apply if "the data subject has explicitly consented to the decision being automated". Keeps the express consent, given for the automated decision itself, with the record of each decision it covers.
Art. 21(4) · Federal bodies A federal body designates the decision as automated. Paragraph 2 does not apply where the person need not be heard before the decision under Article 30(2) of the Administrative Procedure Act or another federal act. Concerns federal bodies: federal authorities and services, and persons entrusted with a public task of the Confederation (Article 5(i)).
Art. 25(2)(f) · Right of access A person who asks for access receives, "if applicable, whether an automated individual decision has been taken and the logic behind the decision". Can state the logic of the decision, in general within 30 days and free of charge.
Art. 60(1) · Sanction On complaint, a fine of up to CHF 250,000 for private persons who wilfully fail to inform under Article 21(1), or who wilfully give false or incomplete information under Article 21. Keeps, decision by decision, the proof that the information was given.

Wording. The official French text reads "a des effets juridiques pour elle ou l’affecte de manière significative", the German text "mit einer Rechtsfolge verbunden ist oder sie erheblich beeinträchtigt". The English translation renders the second limb as "a considerable adverse effect".

Compared with GDPR Article 22 and EU AI Act Article 86

The 3 texts cover close ground with different mechanisms. The table states only what each text says.

Point FADP, Article 21 GDPR, Article 22 EU AI Act, Article 86
Mechanism Duty to inform; on request, point of view and review by a natural person Right not to be subject to the decision Right to clear and meaningful explanations of the role of the AI system and the main elements of the decision
Trigger Decision based exclusively on automated processing, with a legal consequence or a considerable adverse effect Decision based solely on automated processing, including profiling, with legal effects or a similarly significant effect Decision taken by a deployer on the basis of the output of an Annex III high-risk system, except point 2, with legal or similarly significant effects the person considers adverse to health, safety or fundamental rights
Human involvement Review by a natural person, if the person requires it In the contract and consent cases, at least the right to obtain human intervention, to express one's point of view and to contest the decision None set by the article; it governs the explanation
Exceptions Contract with the request granted; express consent Necessary for a contract; authorised by Union or Member State law; explicit consent Exceptions or restrictions under Union or national law; applies only where Union law does not otherwise provide the right

GDPR Article 22(4) adds that decisions under its exceptions are not based on special categories of personal data, unless explicit consent or a substantial public interest under Article 9(2)(a) or (g) applies and safeguards are in place. Under Article 113 of the EU AI Act, as amended by Regulation (EU) 2026/1744, the Act applies from 2 August 2026, and the high-risk requirements of Chapter III, Sections 1 to 3, apply to Annex III systems from 2 December 2027.

In our reading, a system built to give a natural person the case, the reasons and the authority to change the outcome answers the review duty of Article 21 and the human intervention of GDPR Article 22 with the same mechanism. When the EU AI Act reaches a Swiss company, Article 86 adds a right to an explanation for decisions based on Annex III high-risk systems.

2 · In our reading

When an AI-supported decision is exclusively automated

In our reading. The act does not define "exclusively", and this page cites no FDPIC guidance or court decision on the term. The test below follows the wording of Article 21(1): a decision is exclusively automated when no natural person, with the information and the authority to decide otherwise, takes part in it before it takes effect.

Mapping prepared by Hikari Blue; the FDPIC has not reviewed it. The situations are generic, not client cases. This is not legal advice.

Situation In our reading
A model scores an application and the system issues the refusal; no person sees the case. Exclusively automated. Article 21 applies if the refusal has a legal consequence or a considerable adverse effect, unless an exception of paragraph 3 covers it.
A model recommends; a competent person reads the case, can depart from the recommendation and decides. Not exclusively automated, provided the review is real and recorded. The other duties of the act still apply.
A person confirms each model output in bulk, without the case file or the authority to change the outcome. Exclusively automated in substance. A confirmation the person cannot refuse is not a decision by a natural person.
An AI agent executes a step that decides for a person, such as closing an account or rejecting a claim. The action is the decision. The same test applies to the step, whatever the number of models and tools before it.
A model sorts internal requests or drafts a text that a person rewrites and sends. No automated individual decision about the person, and so outside Article 21. The principles of Article 6 and the duty to inform of Article 19 still apply to the personal data processed.

The difference between rows 2 and 3 cannot be seen in the interface. It shows in the record: who verified, what they decided, and whether verifiers ever reject or override.

3 · Article 22

Article 22: the impact assessment

If processing is likely to result in a high risk to the personality or fundamental rights of the data subject, the controller carries out a data protection impact assessment beforehand. Several similar processing operations can share one assessment.

  • When the risk is high

    It depends on the nature, extent, circumstances and purpose of the processing, in particular when new technologies are used. The act names 2 cases: large-scale processing of sensitive personal data, and systematic monitoring of large public areas (Article 22(2)).

  • What the assessment contains

    A description of the planned processing, an evaluation of the risks to personality or fundamental rights, and the measures to protect them (Article 22(3)).

  • When a private controller is exempt

    When the law requires the processing, or when it uses a system, product or service certified under Article 13 for the intended use, or follows a code of conduct under Article 11 that rests on an impact assessment, provides protective measures and was submitted to the FDPIC (Article 22(4) and (5)).

  • When the risk remains high

    Article 23 requires consulting the FDPIC before processing; the FDPIC states its objections within 2 months, 3 for complex processing. A private controller may instead consult its data protection officer under Article 10.

High-risk profiling matches data to assess essential aspects of a person's personality (Article 5(g)); where a private person relies on consent for it, the consent must be express (Article 6(7)(b)). In our reading, an AI system that takes automated individual decisions with a considerable effect on people is a candidate for an assessment, to be settled case by case.

4 · The FDPIC

The FDPIC position on AI (8 May 2025)

On 8 May 2025, the Federal Data Protection and Information Commissioner updated its statement of 9 November 2023. It holds that the act, in force since 1 September 2023 and formulated to apply to all types of technology, is directly applicable to AI-supported data processing, regardless of future regulation.

Point of the statement What the FDPIC writes
Transparency Manufacturers, providers and users of AI systems must make the purpose, functionality and data sources of AI-based processing transparent.
Objection and human review Transparency is closely linked to the right to object to automated data processing or to request that automated individual decisions be reviewed by a human being, as the act expressly provides.
Conversational models Users have a right to know whether they are speaking or corresponding with a machine, and whether their input is processed to improve the programs or for other purposes.
High risk High-risk AI processing is permitted in principle with appropriate measures; the law requires an impact assessment in high-risk cases.
Prohibited uses Applications that aim to undermine privacy and informational self-determination, such as real-time facial recognition on a large scale or social scoring.

The statement is the reading of the supervisory authority, not a rule of its own. The act applies to the processing of personal data of natural persons by private persons and federal bodies (Article 2(1)).

5 · The record

The record that answers a review request

A review by a natural person needs the decision as it was taken: which system, which version, which rule, which data, and whether a person already looked at it. The 9-field record of our AI audit trail, written at the moment of each action, holds those answers; the human verification field holds the review itself.

Mapping prepared by Hikari Blue; the FDPIC has not reviewed it. It is neither legal advice nor a guarantee of compliance.

Question in the review Field of the record
Was the decision exclusively automated? Human verification: empty, or the identity of the verifier, the decision taken (approve, reject, override) and the reason where given.
What was decided, and with what effect? Action: the output produced or the tool call made, with its target system and result.
Which system decided? Model and version, and actor identity for the agent or operator that acted.
Under which rule? Policy applied: identifier and version of the policy evaluated, with the decision it returned.
On which data? Inputs reference: pointers to the data and sources consulted, by reference or hash, not in cleartext.
When, where, and is the record intact? Timestamp, residency corridor and hash chain.
  1. 01

    Find the decision

    Retrieve the record of the action that decided for the person, and read its human verification field.

  2. 02

    Hear the person

    Take their point of view in writing, with the elements they bring, under Article 21(2).

  3. 03

    Assign a reviewer who can change the outcome

    A named, competent natural person, with the record, the inputs and the authority to confirm, change or reverse the decision.

  4. 04

    Record the review

    The review writes a new record, chained to the first: the reviewer's identity, the decision and the reason, in the human verification field.

6 · Direct answers

What controllers ask about Article 21 of the FADP.

What does Article 21 of the Swiss FADP require when AI makes a decision about a person?

It requires informing the person of a decision based exclusively on automated processing, letting them state their position and offering a review by a natural person, with 2 exceptions in paragraph 3: a decision directly connected with a contract where the person's request is granted, and express consent. The hearing and the review are owed on request.

Does the FADP prohibit automated decisions?

No. Article 21 attaches a duty to inform and, on request, a right to be heard and to a review by a natural person. GDPR Article 22 works differently: it gives a right not to be subject to such a decision, with exceptions.

Is a decision still automated if a person clicks approve?

In our reading, it depends on the person. A reviewer with the case, the competence and the authority to decide otherwise makes the decision human; a confirmation the reviewer cannot refuse leaves it automated in substance. The human verification field of the record shows which.

Does the FADP apply to AI?

Yes, whenever AI processes personal data of natural persons. In its statement updated on 8 May 2025, the FDPIC holds that the act, in force since 1 September 2023, is directly applicable to AI-supported data processing.

Does an AI system need a data protection impact assessment?

When its processing is likely to result in a high risk to the personality or fundamental rights of the people concerned, the assessment comes before the processing (Article 22). If the risk stays high despite the measures, Article 23 requires consulting the FDPIC, unless a private controller consulted its data protection officer.

How does Article 21 compare with Article 86 of the EU AI Act?

Article 86 gives a person affected by a deployer's decision based on an Annex III high-risk system the right to clear and meaningful explanations of the role of the AI system and the main elements of the decision, where Union law does not otherwise provide it. Article 21 is Swiss law; one system can answer to both.

7 · References

Reference documents and primary sources.

Every article, quotation and date on this page comes from the sources below, consulted on 25 October 2026.

Reference documents

Primary sources, consulted on 25 October 2026

8 · Versioning and citation

How to cite this document.

This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.

  • Preferred citation

    Hikari Blue, "Automated individual decisions under the Swiss FADP v1.0", 25 October 2026, https://hikariblue.com/switzerland/fadp-automated-decisions

    Section anchors are stable: #status, #article-21, #comparison, #exclusively-automated, #article-22, #fdpic, #review-record, #faq, #references, #cite.

  • Changelog

    v1.0 · 25 October 2026. First public version.

    License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.

For data protection officers, general counsel and operations heads of Swiss companies

Take one automated decision through Article 21.

30 minutes with a named partner. We take one decision your AI systems make about people today and show whether it is exclusively automated, which duty of Article 21 applies, and which field of the record would answer a review request. You leave with that map, whether or not we work together.

  • One decision, read against Article 21
  • The exceptions that apply, or not
  • The record a review request needs
Book a 30‑min call Or read the EU AI Act for Swiss companies Verify Hikari Blue with a model we do not control