Your staff are already doing what Parliament has just forbidden itself from doing.

What happened under the Dome

According to watson.ch, Parliamentary staff have been entering entire committee meeting minutes into consumer-grade AI tools to have them summarized, before forwarding these summaries to interest groups. Parliamentary services themselves are also alleged to have circulated classified documents via Microsoft Outlook, despite a 2023 directive explicitly prohibiting cloud services for classified information.

National Councillor Mauro Tuena: "There is no justification for downloading the minutes." His colleague Gerhard Andrey: "It's a matter of Swiss security."«

Remember the sequence: a rule existed, it was written down, it was known — and it didn't hold.

Why prohibition is never enough

A ban doesn't eliminate the need that created it. The employee who has thirty pages to summarize before 4 p.m. has a concrete problem; the 2023 directive, on the other hand, is an abstraction. Between the two, they choose what moves their project forward.

Shadow AI is not a discipline problem, it is a symptom of insufficient coverage. When the official tool doesn't do the job—or doesn't exist—the unofficial tool takes its place. And it takes its place all the more easily because it's free, instant, and already open in a tab.

This is, in fact, the most interesting aspect of the Pia case: Parliament has not only set a ceiling, it has above all provided a tool. Otherwise, the ceiling wouldn't have changed anything.

What really comes out of your business

Take stock honestly. In a Swiss SME, the documents that most often go through a free tool are always the same: the contract that you want to have reviewed, the competitor's offer that you want to compare, the minutes of the committee that you want to summarize, the lawyer's letter that you want to understand, the CV that you want to sort.

Some of these documents contain sensitive data within the meaning of Art. 5 let. c of the nLPD Health data, personal information, religious, philosophical, political, or trade union opinions, social welfare measures, criminal or administrative proceedings and sanctions, genetic and biometric data. A medical certificate in an HR file falls into this category. A performance review often does as well.

For this data, "I didn't know the team was using ChatGPT" is not a defensible position.

Three measures that actually work

None of the three is a prohibition.

1. To provide a tool that is at least as practical. As long as the official alternative is slower than the personal account, it will lose. This is the only lever that will bring about lasting behavioral change.
2. State what has the right to be released, document by document. Not a six-page policy: a rule anyone can apply in three seconds when faced with a file. The Confederation does it with three levels of classification; an SME manages very well with that many.
3. Keep track of what comes out. Without logging, you will never know if the incident occurred — and you won't be able to tell the data protection officer if they ask.

Note what these three measures have in common: they assume that the company takes a position, not that the employee becomes virtuous.

What we do with this observation

The Swiss cloud covers the general case: Swiss jurisdiction, no subcontractors subject to the CLOUD Act, compliance with the nLPD (Swiss Federal Act on Data Protection), and a record of every transaction. For the typical workflows of an SME—invoices, orders, reminders—it's the right level of service.

There remains the category of documents that must not leave the premises. For these, WivenLLM runs on your own machines The file doesn't go anywhere; the model is already there. This is the only answer that makes arbitration unnecessary—when nothing is sent, there's nothing left to monitor.