Swiss Cybersecurity Act: what is coming for cloud providers

On 25 September 2026 the Swiss Federal Council instructed the Federal Department of Defence, Civil Protection and Sport (DDPS) to prepare a consultation draft of a standalone Swiss Cybersecurity Act (Cybersicherheitsgesetz, CSG) by June 2027. The act would bundle rules for software and hardware modelled on the EU Cyber Resilience Act (CRA), protection of the most important digital data, duties for hosting and cloud providers, and the 24-hour duty to report cyberattacks that has applied since 1 April 2025. No bill text exists yet, but Swiss-seated cloud providers that serve third parties for payment already fall under that reporting duty, and multi-year cloud contracts signed now may still be running when the new act applies.

This post covers what is decided and what is open, the reporting duty already in force, the link with the CRA and the clauses to add. The English release calls the act CySA; in French it is the loi fédérale sur la cybersécurité. The Information Security Act (ISG), the Cybersecurity Ordinance (CSV) and the parliamentary debate exist only in German, French and Italian, so summaries and quotations of them are ours.

What the Federal Council decided on 25 September 2026

The Federal Office for Cybersecurity (BACS; in English publications, the National Cyber Security Centre, NCSC), part of the DDPS, is working on the three motions the act would bundle, each originally to be implemented through ISG amendments, according to the release:

• Mo. 24.3810, formally “Durchführung dringend notwendiger Cybersicherheitsprüfungen” (carrying out urgently needed cybersecurity checks), which the Federal Council links to the cyber resilience of products with digital elements.
• Mo. 23.3002, on securing the most important digital data of public bodies and critical infrastructure operators.
• Mo. 25.3011, on the role of hosting and cloud providers in dealing with cyber threats.

The content is announced, not enacted: CRA-style requirements for manufacturers, importers and distributors of software and hardware, with market surveillance and a ban on selling insecure products; duties to protect important digital data; and, for hosting and cloud providers, “obligations to cooperate and to defend against cyberthreats”. The reporting duty would move into the new act; the ISG would keep federal information security.

The decision folds in a product-only bill the Federal Council mandated on 20 August 2025 for consultation “by autumn 2026”, so the product rules now come later.

When will the Swiss Cybersecurity Act apply?

No date is set. As of 1 October 2026 there is no bill text or consultation, we found no later step, and the drafting mandate creates no new obligations. Also open:

• Scope. A Swiss seat, infrastructure in Switzerland, or both.
• Detail. No thresholds, deadlines, sanctions or transition periods are named.
• Open source. The release says only that “specific issues, such as open-source software, can be covered more effectively”. No exemption has been announced.
• CRA alignment. “No additional compliance requirements” is a stated aim for internationally active companies already subject to the CRA, not a promise to everyone.

After June 2027 come a consultation of at least three months (Consultation Procedure Act, art. 7 para. 3), a dispatch to Parliament, debate in both chambers, a possible referendum (Federal Constitution, art. 141) and entry into force, none of them dated. For scale, the reporting duty took 28 months from its dispatch on 2 December 2022 to entry into force on 1 April 2025. At that pace after its consultation, the CSG would apply around 2030 or later. That is our estimate, not an official date.

Does the Swiss reporting duty already apply to cloud providers?

Yes, for many. Since 1 April 2025, ISG art. 74b para. 1 let. t has covered “providers and operators of cloud computing, search engines, digital security and trust services and data centres, provided they have a seat in Switzerland”. The ordinance’s only exemption for letter t (CSV art. 12 para. 1 let. e) is for providers that serve no third parties for payment, so a Swiss-seated provider that sells cloud computing or data-centre services is in scope. Whether a given hosting service counts as cloud computing, the BACS decides on request (art. 74a para. 2). Also covered are authorities at every level (let. b), banks and insurers (let. e), hospitals on cantonal lists (let. f) and makers of hardware or software used by critical infrastructure, if it has remote maintenance access or is used to control operational systems or ensure public safety (let. u). Attacks with effects in Switzerland count even if the IT is abroad (para. 3). The duty is in use: the BACS received 200 mandatory reports in the first half of 2026, 19.4% from public administration and 18.6% from IT and telecom companies (figures published on 24 August 2026).

What to report, and how fast

• What. An attack that endangers functioning, leads to manipulation or outflow of information (including a breach notified under data protection law), stays undetected for more than 90 days, or involves extortion, threat or coercion (art. 74d, CSV art. 14).
• When. Within 24 hours of discovery (art. 74e), with 14 days to complete the report if information is missing (CSV art. 16).
• Channel. Reports go through the BACS’s online platform, the Cyber Security Hub. In an audit published on 4 November 2026, the Swiss Federal Audit Office (EFK) counts 222 reports from April to December 2025, and about 12 hours of outages in the first quarter of 2025, mainly when the federal access management system (eIAM) failed. Since March 2026 the platform has run at an external provider on two sites in Switzerland, but identity and access management “remains a potential single point of failure”; if the platform is down, reports can be made by telephone or email (report, in German).
• Content. The organisation, the attack’s type, execution and effects, measures taken and next steps (art. 74e para. 2), plus times of detection and attack, attacker details, any extortion, threat or coercion and whether a criminal complaint was filed, severity for availability, integrity and confidentiality, and impact on the organisation’s functioning (CSV art. 15).
• Sanctions. A fine of up to CHF 100,000 applies only to wilfully ignoring a final BACS ruling, issued after a missed report and a further deadline (art. 74g and 74h, in force since 1 October 2025).

What this means for buyers

One incident at a Swiss cloud provider can lead to two 24-hour reports: the provider’s under letter t, and yours if you are covered too, as a commune or a hospital is. CSV art. 17 para. 2 lets organisations outsource reporting to a third party. The contract should say who reports what, and how fast you get the facts. A provider with no Swiss seat is outside letter t, which puts more weight on the contract. If a group has a Swiss company but you contract with a foreign entity, ask which entity reports and how its facts reach you.

What could the new duties for hosting and cloud providers look like?

Everything here is proposal or opinion, not law. Mo. 25.3011, filed by the National Council’s Security Policy Committee on 27 January 2025, asks for legal bases giving hosting and cloud providers “the necessary rights and duties” to combat misuse of their infrastructure for cyberattacks, since unlike internet providers they fall outside the Telecommunications Act. The National Council adopted it on 19 June 2025 without a vote, and the Council of States on 9 December 2025 by 26 votes to 14 (Official Bulletin).

In the Council of States on 9 December 2025, the committee rapporteur, Andrea Gmür-Schönenberger, said some foreign providers legally operating infrastructure in Switzerland do not respond when the BACS asks their abuse desks to stop attacks from it. She floated a duty to name a contact point, and the BACS blocking addressing elements (such as domain names or IP addresses); neither is decided. Federal Councillor Albert Rösti said the measures are limited to technical and operational tasks and “do not concern hosted content”.

Swico, the ICT industry association, said on 10 December 2025 that existing regulation and its Code of Conduct Hosting already work, and that the motion adds bureaucracy, not security.

How does the Swiss Cybersecurity Act relate to the EU Cyber Resilience Act?

The CRA has been in force since 10 December 2024. Since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, then a full notification within 72 hours. The main obligations apply from 11 December 2027.

• Swiss manufacturers selling in the EU are already bound, whatever Swiss law says.
• The triggers differ. The ISG duty concerns attacks on an organisation’s own IT. CRA reporting concerns vulnerabilities and incidents in products a manufacturer sells. A Swiss software vendor could face both; for supplier questions, see our post on CRA reporting.
• Cloud services sit mostly outside the CRA. It covers products with digital elements and the remote data processing they need; other cloud services, SaaS included, fall under NIS2 in the EU for medium-sized and larger providers (CRA recital 12). So the CRA alignment the release describes concerns products, not the duties for hosting and cloud providers.

Timeline: what applies, what is decided, what is planned

Date	Step	Status
1 April 2025	ISG 24-hour reporting duty applies	In force
20 August 2025	Product security bill mandated for consultation	Folded into the CSG
1 October 2025	Fines for ignoring BACS rulings	In force
9 December 2025	Council of States adopts Mo. 25.3011, 26 to 14	Decided
11 September 2026	CRA reporting obligations apply in the EU	In force
25 September 2026	Federal Council mandates the DDPS to draft the CSG	Decided
By June 2027	CSG consultation draft to the Federal Council	Planned
Not set	CSG consultation, dispatch, debate, entry into force	Open as of 1 October 2026

What to do now, and by when

Legal dates are fixed; the other dates are our suggestion.

1. By 30 November 2026: check your own status. Read ISG art. 74b. If unsure, ask the BACS for a ruling.
2. Before you sign or renew a cloud or hosting contract: ask about letter t. Is the provider in scope, who reports for it, and through which channel?
3. In every new contract: incident cooperation. Notice in time for your own 24-hour deadline, with the fields in ISG art. 74e and CSV art. 15, follow-up within the 14-day window, named contacts on both sides, and who files what when both of you must report.
4. In every new contract: vulnerability handling with times. Advisories tracked against your versions, deadlines for planning and applying critical fixes, and a disclosure contact.
5. At the next renewal: authorities and change of law. How the provider handles a BACS request affecting your service, and when it tells you. Renegotiation or termination rights if the CSG adds duties either side cannot meet, and who pays.
6. In the same contract review: list the open-source components. Version, licence and who patches each.
7. Before you depend on a provider: an exit you can use. Data in open formats and a tested exit plan, in case a provider cannot meet new duties.
8. From June 2027, when the draft is due: read it and respond. Check the scope (Swiss seat or Swiss infrastructure), thresholds, deadlines and open source. If you make, import or distribute products with digital elements for the EU market, the CRA main obligations apply from 11 December 2027 regardless.

Why software you control is easier to keep compliant

Nobody knows yet what the CSG will require in detail. The direction is clear: known vulnerabilities handled on a clock, the most important data protected, and hosting providers drawn into incident response. Three properties make those duties easier to meet, whatever the final text says.

• You can see the fixes. An open-source project publishes its patched releases, usually with an advisory, so you or your operator can check which of your versions are affected without waiting for a vendor’s notice.
• You choose where it runs. The same software runs on your premises, with a Swiss provider or in the EU. If a provider cannot meet new duties, the data and the software move with you, and only the contract changes.
• You can change operator without changing software. Open formats and a documented setup turn an exit into a handover of operations, not a new platform.

None of this is automatic. Open source with nobody watching its advisories is not safer than a maintained proprietary product. The advantage is that the work can be seen, assigned and checked.

How Pilae fits

Pilae is a Swiss company. We operate open-source and source-available apps on your premises or on dedicated machines in Pilae Cloud in Switzerland and the EU, and several of the clauses above are already in our contracts:

• Incident cooperation. You are notified of any security incident affecting your data without undue delay, as your data processing agreement specifies, with updates, a final report and help with the facts for each report to your authority (incident assistance).
• Vulnerability handling. Advisories are tracked against your versions, and critical fixes are sent for approval as soon as the upstream fix is released.
• A record and audit rights. Every login, approval and change is recorded and exportable to your SIEM, and you, your auditors and your competent authority have audit rights.
• Roles in writing. A responsibility matrix is annexed to the contract.
• A way out. Every plan includes a written exit plan, with your data back in open formats.

Vulnerabilities in our own services go to security@pilae.com, acknowledged within two business days (disclosure). To go through these clauses against your current contracts, talk to an engineer.

This post is general information, not legal advice. For the texts, see the Federal Council release of 25 September 2026, the ISG and the Cybersecurity Ordinance on Fedlex.