The canton of Geneva commissioned an interdisciplinary study from the University of Geneva on the relationship between artificial intelligence and digital sovereignty. According to Netzwoche, the researchers delivered 22 recommendations aimed at governing the use of AI within the cantonal administration.
For a Romandy SME leader, this work deserves attention. Geneva is the first Swiss canton to advance a dedicated strategy in this way. The choices emerging there likely foreshadow what other cantons — and perhaps the Confederation — will adopt in the coming years. Anticipating these expectations means avoiding the need to rebuild your tools in haste.
What the Geneva study contains
The research team — Cédric Durand, Yaniv Benhamou, Diego Kuonen, and Gaia Valenti — analyzed AI from three angles: political-economic, legal, and data-scientific. Their report covers infrastructure, data, software, skills, the evolution of work, and environmental impact.
Three guiding principles structure the 22 recommendations: frame the use of AI in administration, preserve leeway against technological dependency, and protect individuals as well as the environment. The authors insist on a central question: what guarantees enable trust in systems deployed by authorities?
The recommendations translate into concrete practices. Tool selection must start from business needs, not technological enthusiasm. The pace of introduction must be controlled, with experimentation phases before any wide deployment. Employees must retain the skills to evaluate tool outputs, particularly when processing authorization requests, awarding subsidies, or prioritizing cases. Only then come the definition of responsibilities, usage limits, and oversight mechanisms.
For high-risk applications, the researchers outline a risk management framework including human control of automated decisions, technical documentation, and impact assessment. They emphasize data quality, integrity, and protection. These elements are presented as possible guarantees, not as obligations already in force.
Vigilance must continue in operation: validation, testing, continuous monitoring, and quality assurance. The authors remind that generative systems can produce incorrect answers with apparent confidence. With the emergence of AI agents chaining tasks with less human intervention, questions of reliability and oversight become more pressing.
The risk of bias is documented: direct or indirect discrimination, for instance in hiring or the granting of public benefits. Transparency is another axis, notably informing people that they are interacting with an AI or that automated processing strongly influences a decision.
Three complementary avenues are suggested: verify whether cantonal law sufficiently protects fundamental rights against AI, create a registry of decision-making systems, publish a self-assessment of risks every two years. The authors also call for effective appeal procedures, with possibility of compensation and sanctions. The canton, which adopted a digital sovereignty strategy in summer 2026, indicates that some points align with ongoing work, while others remain to be examined from legal, financial, and competence-sharing-between-collectivities angles.
What actually changes for a Romandy SME
This framework does not directly address private companies. It concerns the Geneva administration. Yet several lessons apply to any Romandy SME deploying or considering AI.
First: the logic of digital sovereignty is gaining ground. Choosing tools based on real needs, keeping control of your data, documenting your decisions — these principles apply as much to a carpentry in Sierre as to an accounting firm in Lausanne. Second: controlled experimentation is becoming the expected norm. Deploying widely without a testing phase means taking an increasing reputational and operational risk. Third: transparency toward affected individuals is no longer a goodwill option, but a probable regulatory direction.
The most affected SMEs are those processing sensitive data (health, financial, legal), those automating decisions touching clients or employees, and those supplying services to public administration. A housing authority sorting rental applications, a firm pre-qualifying cases, a hotel personalizing its rates: these hypothetical scenarios fall within the vigilance perimeter.
Conversely, an SME using AI to draft internal email drafts or generate images for social media faces fewer immediate regulatory risks.
Hypothetical scenario: a Geneva accounting firm
Imagine a ten-person accounting firm in Carouge, deploying an AI tool to pre-qualify clients' tax deduction requests. The tool suggests which supporting documents are missing and which items merit attention.
Without a framework, the team might tend to blindly follow the system's recommendations. With the Geneva study's principles, it would structure its project differently: pilot phase on fifty cases, with one employee verifying every suggestion; documentation of cases where the tool errs; training for the whole team to spot errors; written notice to clients that their case is processed with automated assistance; internal procedure allowing a client to contest a decision and obtain human re-examination.
This approach takes a few more hours to set up. In return, it avoids having to rebuild the process if cantonal or federal regulation makes these practices mandatory — or if a dissatisfied client approaches the Federal Data Protection and Information Commissioner.
Watch points for your SME
Sovereignty and hosting. The Geneva study highlights technological dependency as a political-economic risk. For a Romandy SME, this translates to the question of data hosting. Storing your information with an American or Asian provider means accepting foreign jurisdictional conditions. The Swiss alternative exists, sometimes at comparable cost. We work exclusively with Switzerland-hosted infrastructure, notably for our Valais and Romandy clients.
nFADP and personal data. The Swiss Federal Act on Data Protection already applies. The study's principles — data quality, integrity, protection — are its logical extension. An SME that will automate decisions concerning individuals will likely, in time, need to inform those individuals and provide for appeal. The FDPIC remains the competent contact for precise questions.
Hidden costs of maturity. Test before deploying, monitor continuously, train teams: these requirements have a cost in hours, not just in CHF. An SME that underestimates this governance phase risks seeing its automation savings absorbed by late corrections. Hypothetical time gains — for example a few hours per week on repetitive case processing — must be weighed against this initial investment.
Vendor dependency. Large generative models evolve without notice. What works today may degrade tomorrow, become paid, or disappear in a redesign. Retaining the ability to revert to manual processing, even partially, is insurance against this dependency. We design our automations with this modularity: the human always keeps control.
Limits of AI. The study states this forcefully: generative systems produce errors with confidence. AI agents, more autonomous, amplify this risk. Automating a full chain without a human validation step means accepting an exposure that future regulation will likely penalize, and that commercial prudence should already forbid.
What to do now
- Inventory your current uses. What AI tools do you already use, even informally? An employee going through ChatGPT to draft, recruitment software sorting CVs, a chatbot on your website: list them without judgment.
- Identify automated decisions. Among these tools, which influence or replace human judgment on people (clients, employees, suppliers)? These are your framing priorities.
- Document your processes. Even summarily, note who does what, with which tool, according to which rule. This documentation will surely be missing if a liability question arises.
- Plan a test phase. Before any expansion of an AI tool, plan an experimentation period with systematic human control. Measure errors, not just time savings.
- Evaluate your hosting. If your sensitive data transits through foreign infrastructure, look into Swiss alternatives. Migration cost is often lower than that of a subsequent problem.
At FlowBiz.ai, in Sion, we support Romandy SMEs on these questions through concrete steps. Our two-minute AI quiz lets you assess where you stand. Contact us to discuss over coffee — or dinner, depending on your availability.
