AI Training for Swiss Municipalities: What Is Different from the Private Sector

AI training for a municipal administration is not an SME workshop with the examples swapped out. Four things apply differently in a public body than in a company, and all four change what the course has to cover: official secrecy, the applicable data protection law, the duty to keep records, and the freedom-of-information principle. Training that does not address these four is not merely incomplete for an administration — it is misleading at the decisive point.

Swiss municipalities face a double pressure here. The workload grows, staff are hard to find, and at the same time there is less room for manoeuvre than in a company of the same size. What an SME's management settles in one meeting needs, in an administration, a directive, a defined responsibility and usually a check with the cantonal data protection authority.

Which is exactly why the question ends up in a loop: people wait for a rule while the departments have long been working anyway — on personal accounts, because there are no official ones. The fastest way out of that loop is not a legal opinion but training that handles the four particularities properly and produces a directive as its output.

The first misunderstanding: not the revDSG

The revised federal data protection act has been on everyone's lips since 2023, and almost every training deck on the market is built on it. For a municipality that is the wrong foundation. The act describes its own scope: it applies to the processing of personal data by private persons and by federal bodies. There is no third category — cantonal and communal authorities are neither. That is not interpretation; it is the wording.

There is an exception, and it is narrow: where a municipality executes federal law on the Confederation's behalf — tasks around register-keeping, or the execution of federal social-insurance law, for instance — it acts functionally as a federal body to that extent. For the overwhelming majority of an administration's daily work, it does not apply.

What governs instead is the canton's own data protection law, and that is where the confusion with names begins. Zurich, Basel-Stadt and Basel-Landschaft each have an act on information and data protection. Bern maintains a cantonal data protection act plus its own, very early information act. Aargau bundles information, data protection and archiving into a single statute. St. Gallen simply calls its a data protection act, Solothurn an information and data protection act, Schwyz a transparency and data protection act. Geneva and Vaud have their own French-language statutes, and Neuchâtel and Jura even share a single intercantonal convention rather than two separate laws.

This is more than a curiosity. It explains why training "on data protection" is only useful to an administration when it is built on the right statute. In Zurich, for instance, a single act governs both data protection and freedom of information, and oversight sits with the cantonal data protection commissioner, not the federal one. Note also that this act is currently undergoing a full revision; anyone building a directive on it should check the current status before adopting it.

In substance the underlying ideas are similar — proportionality, purpose limitation, security. But the responsibilities, the reporting routes and the rules on disclosure to third parties differ, and processing by a provider abroad is regulated differently in a cantonal statute than in a federal act for private parties. Training that does not separate the two gives an administration cleanly delivered answers to the wrong law.

What is already regulated — and what you therefore need not invent

The second most common error is assuming that nothing exists yet. In fact Swiss public administration is further along on this point than its reputation suggests.

At federal level, guidelines on artificial intelligence for the federal administration have existed since 2020, supplemented by a strategy for deploying AI systems and several information sheets on using generative tools and on awareness of large language models; there are even tool-specific sheets for individual translation services.

At cantonal level there are strategies, directives and information sheets from Aargau, from Appenzell Innerrhoden — which additionally maintains a public register of algorithmic systems — and from Bern, Fribourg, Lucerne, St. Gallen, Vaud and Zurich. Lucerne's expressly covers administration, schools and courts. The cities of Zurich and Geneva have their own rules on the use of generative AI, and for municipalities there are information sheets aimed directly at communal staff rather than cantonal employees.

Two observations from these documents matter more for training than their mere existence.

First: not one of them imposes a blanket ban. The consistent pattern is "permitted with conditions". One cantonal guideline, for example, expressly permits use for simple, standard requests and draws the line not at the tool but at the inputs: secret and confidential data must not be entered at all, with an explicit reference to official secrecy. An information sheet aimed at municipal staff lists permitted uses — summaries, drafting help for correspondence, analysis support, code — and then the impermissible ones: ongoing, unpublished political business, unchecked reuse of generated content, producing legally binding decisions. Alongside recommendations you can adopt immediately: register only with a work address, restrict the data-use settings in the account, label generated content, train staff regularly.

Second: the cantonal requirements are process requirements. Zurich's data protection commissioner published a procedure for public bodies in 2025 that begins with defining concrete use cases and checking the legal basis — where special categories of personal data are involved, a basis at the level of formal legislation is required. That is notable, because the first step of that process is exactly what good training produces anyway: a solid list of the use cases that genuinely occur in the building. Treating training as preparatory work for the process, rather than as a reward after it, gets you moving considerably faster.

The second: official secrecy is personal

Official secrecy under Article 320 of the Criminal Code is directed not at the municipality but at the individual. Anyone who reveals a secret entrusted to them in their official capacity, or which they became aware of in that capacity, risks a custodial sentence of up to three years or a monetary penalty. Three details about it are regularly underestimated.

It does not end with the employment relationship — the statute says so expressly. It is prosecuted ex officio and does not depend on anyone filing a complaint. And the only exemption is disclosure made with the written consent of the superior authority; that is a narrow, documented exception, not the general assurance that use has been approved.

The term "official" is broader than the word suggests. The Criminal Code defines it functionally and also covers people working temporarily or provisionally for a public administration. Apprentices, interns, casual staff and temporary employees are therefore under the same duty as permanent staff — and are simultaneously the group least often briefed and most likely to be working on a personal account, because one was never set up for them.

Distinct from this is professional secrecy under Article 321, which covers a closed list of professions — doctors, lawyers, psychologists, nursing staff and others — and is prosecuted only on complaint. For a municipality the distinction is not academic: in school social work, in health services or in a communally run care home, both duties can apply side by side, and then the stricter one governs.

For training all of this is an advantage, odd as that sounds. "May I copy this text into this tool" is an abstract compliance question in an SME, discussed politely. In an administration it is a personal one, and that produces an attentiveness you otherwise have to manufacture. The course's job is then not to counsel caution but the opposite: to make clear what is unproblematic, so that caution does not block all use.

Data tiers look different in an administration

In a company, three tiers for everyone usually suffice. In an administration that works poorly, because the departments do not do the same work. A tier that is generous for the building department is untenable for social services — and conversely, a rule built for social services slows the chancellery down for no reason.

The classification that works is therefore a shared structure with department-specific examples:

• Social services: the most sensitive unit in a municipality. Information on support payments, health, family circumstances, guardianship. Here the top tier is the normal case, not the exception.
• Residents' services: nationality, civil status, sometimes religious affiliation for church tax. Looks harmless; is not.
• School administration: children's data, sometimes health and special-needs information.
• Tax office: the income and assets of whole households.
• Building department: comparatively open, since planning applications are published anyway — but objections and third-party submissions are not.
• Chancellery: the most inconspicuous and in practice the trickiest case, because that is where ongoing, not-yet-published political business sits. It is not "sensitive personal data", but it still belongs in no external tool.

The last line is the one missing from standard courses. An SME scheme knows personal data and trade secrets; an administration additionally knows the category "not yet public", and it is time-limited: what is confidential before publication is official afterwards.

The third: records management

Administrative action has to be traceable, and that is what records management is for. The obvious worry: does every chat transcript now go into the file?

Here too the question of jurisdiction comes first, because it holds the same surprise as data protection: the federal archiving act expressly excludes the cantons from its scope. For a municipality, the canton's own archiving law applies — in some cantons a separate act, in others built into the same statute as data protection and freedom of information. The standard is similarly broad everywhere: material is retained where it has legal or administrative significance or a high information value. That is deliberately more than just the formal decision.

On the other side stands an equally express limitation: unfinished material and documents for purely personal use do not count as official documents. That is the nearest basis for handling drafts — and it is applied narrowly in practice, not as a blanket exemption for anything informal.

And now the honest part: whether an AI chat transcript has to be archived is not settled. No published guidance addresses it, and the existing cantonal AI papers deal predominantly with data protection rather than records management. Anyone claiming otherwise is overstretching the available sources.

What can sensibly be derived from existing law is a working rule, which is exactly how we teach it — as a reasoned analogy and not as a rule in force: if the model's output substantively carried the reasoning — an assessment, a factual claim, a recommendation the decision rests on — the result belongs in the file in traceable form. If it only polished the wording while the substance is fully present in the filed final version, it is a draft.

More important than either is the inverse, and it belongs in every course: a result that exists only in a chat transcript and never reaches the file is missing from the record. The real danger is not too much documentation but too little — because work is happening in a tool nobody regards as a filing system.

The fourth: freedom of information

Since the federal transparency act of 2004, the federal administration has operated on the openness principle rather than the secrecy principle: what is not protected by a specific exception is accessible. A majority of cantons now have a comparable regime, some in a dedicated act, some — as in Zurich — in the same statute as data protection. It is not universal, though, and anyone relying on it should check for their own canton.

An official document is information recorded on any medium, held by the authority, concerning the performance of a public task. Excluded are documents used commercially, documents not yet finished, and documents for personal use — the same categories that appear in records management.

This changes how AI is handled at a point few people think about: what gets written into a file note can be read later — by the person concerned and by the press.

The practical consequence is not a restriction but a question of wording. A text produced with a model has to carry the same tone and precision as one written by hand, because it will be read in the same light. Anyone who "quickly has something summarised" and files it unchecked produces a document the administration answers for without anybody having taken responsibility for it. That includes the stylistic point that gets the most laughter in workshops and sticks the longest: left to itself, a model writes more amiably and more non-committally than a formal decision is allowed to be.

Where an administration actually gains time

After four sections of particularities, the other side, because the benefit is real and sits almost exactly where an administration's work sits: in language.

• Minutes from meeting notes, in the form the committee is used to.
• Recurring correspondence: deadline extensions, enquiry responses, acknowledgements, refusals.
• Translating officialese: turning a correct formal decision into an explanation the affected person understands. This is where residents' services save the most time and the most aggravation.
• Summarising long documents: consultations, reports, submissions to the executive.
• Multilingual responses: answers nobody can currently give in English, French or Italian without sending the text out for translation.
• Structuring instead of phrasing: turning a long email containing five separate requests into a task list before anyone answers at all.

What does not belong on the list: anything involving discretion and anything with legal effect. Not out of caution, but because that is where responsibility sits, and responsibility cannot be outsourced. The published information sheets draw the line in the same place — nobody produces legally binding decisions with a language model.

Where the time gain is not, is notable: not in the big procedures, but across the breadth of small writing tasks nobody sees in the staffing plan. Which is also why it rarely shows up unless you name it in advance — one more reason to fix two or three workflows before the training as the things you will check afterwards.

Procurement is easier than many assume

The most frequent reason an administration does not book training is the assumption that something like this has to go out to tender. As a rule, it does not.

The intercantonal agreement on public procurement was revised in 2019, and that revision is precisely what harmonised the thresholds nationally after they had diverged from canton to canton. For services the position since then is: below CHF 150,000 the direct award procedure is available. From CHF 150,000 to just under CHF 250,000 the invitation procedure applies. From CHF 250,000 there is an open or selective tender, and from CHF 350,000 the stricter treaty rules come into play on top.

Three notes all the same. First, these figures apply to cantons that have acceded to the revised agreement; most have, and the procurement office confirms it in minutes. Second, what counts is the total value of a contract across its whole term including foreseeable extensions, not the individual session — plan a series over two years and you count the series. Third, "direct award" is no licence for informality: a written offer with a scope of work and documentation of the award still belong in the file, if only because of records management.

The most common mistake: waiting for the directive

The sequence many administrations choose runs: first the rule, then the tools, then the training. It is logical and it does not work, because months separate the first step from the third and the work does not wait. What emerges in the meantime is not abstinence but use on personal accounts — no contract, no settings, no traces.

The sequence that gets there faster swaps the first two steps. First an official account for a manageable group, then training on the real use cases, and out of the training the directive — written by people who by then know what they are writing about. That also matches the logic of the cantonal requirements: their first step is defining concrete use cases, and nobody can invent those at a desk.

How we would set it up

A shared foundations part for all departments, covering the four particularities rather than the revDSG slides. Including a look at what the Confederation, the canton and possibly your own city have already published — usually more exists than is known in the building, and part of the work is thereby already done.

Then separate deep-dives, because the data classes differ sharply between residents' services, building, social services and schools — school social work needs different answers from the building department. Half an hour of it belongs to the apprentices and temporary staff, and not as an afterthought, but because they are under the same criminally sanctioned duty as everyone else.

The output at the end is not a slide deck but a directive: one page saying which tools are permitted, which data may go into them and who decides in case of doubt. What that page looks like is set out in the internal AI policy — for an administration with the difference that the middle data tier is narrower, the top tier is governed by name, and an additional category for not-yet-published business is added.

Conclusion

An administration's particularities are not a reason to wait; they are the content that will be missing if you book a standard course. Handle cantonal data protection law, official secrecy, records management and freedom of information properly and you can permit more afterwards, not less — and that is the point: clarity produces use, uncertainty produces private accounts.

How we build training and what goes home with people is on the AI training page. Which format suits which size is covered in the format comparison.