Your industry: Fiduciaries and accounting firms
Tailored to fiduciaries: usually no sectoral supervision, but a duty of confidentiality under Art. 62 DPA for all client data. For audit mandates, professional secrecy under Art. 321 Criminal Code applies on top.
Works with client data: the setup is proven, contract and governance are in place. This is exactly how you should do it.
Depends on the contract, configuration and industry: feasible with a documented risk assessment, not without it.
Not defensible for client data in our risk assessment: no contract, no control or no documented safeguards. Often still the best choice for research, marketing and anonymised content.
Filter the table by traffic-light colour. On a smartphone it scrolls sideways.
| Solution | Client data | Models | Data location | Model quality | Effort | Cost | What to watch |
|---|---|---|---|---|---|---|---|
Azure OpenAI Switzerland (Standard) Microsoft Azure, Switzerland North region | Green | GPT-4o (until April 2027), Embeddings | Processing Switzerland Storage Switzerland | Solid, several generations behind the frontier | Medium, integration by IT or partner | Low, per token, no base fee | A Swiss data location simplifies commissioned processing under Art. 9 DPA: choose the Standard deployment type (not Global or Data Zone), contract with confidentiality and audit rights. For new customers, GPT-4o (until April 2027) is effectively the only option; GPT-4.1 is deprecated. |
Azure OpenAI Switzerland (Provisioned) Microsoft Azure, Switzerland North, reserved capacity | Green | GPT-5.1 (until May 2027) | Processing Switzerland Storage Switzerland | Very good, strongest model with CH guarantee | Medium, integration by IT or partner | From approx. USD 13,000 per month (minimum 50 PTU) | Like the Standard variant, but with regional Provisioned capacity in Switzerland North (not Global or Data Zone Provisioned): GPT-5.1 (until May 2027) costs from approx. USD 13,000 per month (minimum 50 PTU), and a successor in Switzerland is not guaranteed. The most common firm size in the industry is micro, so this is not an option for the vast majority of fiduciary firms. |
Swiss AI platforms e.g. AIgent, Swisscom, Phoenix Technologies (kvant), Infomaniak | Green | Open models such as DeepSeek, Qwen, GLM, Apertus | Processing Switzerland Storage Switzerland | Good to very good, a step behind the frontier | Low, ready-made interface, some with agents | Medium, licence per user, sometimes plus usage | Well suited: the industry association solution TreuhandGPT by TREUHAND|SUISSE (since December 2025, hosted by PeakPrivacy on Swiss infrastructure) is open to more than 2,000 fiduciary firms. Our own platform complements it for automations such as receipt processing, payroll and year-end close. Inform mandators about the use, obtain consent where necessary. |
AI in your industry software e.g. practice, law firm, CRM or portfolio systems | Depends on provider | Usually GPT or Claude in the background | Processing Depends on provider Storage Depends on provider | Good, tailored to the use case | Low, the system is already in use | Low to medium, often as an add-on module | Fiduciary software, such as Abacus, bexio or Sage: clarify in writing which model runs where and add an AI clause to the client agreement. |
Microsoft 365 Copilot Microsoft, with EU Data Boundary | Yellow | GPT models from OpenAI, operated by Microsoft | Processing EU/EFTA Storage Switzerland (Data Location or ADR) | Very good, strong in everyday office work | Low, licence and configuration | Medium, licence per user and month | Defensible with Flex Routing disabled and Anthropic models switched off. Payroll data contains especially sensitive fields such as religious denomination (church tax in withholding tax) and sickness or accident absences (Art. 5(c) DPA): regulate this in the client and provider contracts. Where payroll runs are processed systematically with AI, a data protection impact assessment may become necessary. |
Azure OpenAI Data Zone EU Microsoft Azure, resource in Switzerland North | Yellow | Latest GPT generation, e.g. GPT-5.4 to GPT-6.1 | Processing EU Data Boundary, confirm countries with Microsoft before use Storage Switzerland | Frontier, latest GPT models | Medium, integration by IT or partner | Low, per token | The EU states are listed in Annex 1 DPO, so the level of protection is given. The row stays yellow because of the residual CLOUD Act risk: process payroll data with sensitive fields only pseudonymised; red applies to audit mandates, because professional secrecy (Art. 321 Criminal Code) applies there. The EU Data Boundary can also include EFTA countries: confirm the affected countries with Microsoft before use. |
Claude via AWS Bedrock (EU) Amazon Web Services, EU regions | Yellow | Opus 5 and Sonnet 5 in Ireland or Stockholm, Opus 5.5 and Sonnet 5.5 via EU inference | Processing EU Storage No prompt storage by Bedrock | Frontier, especially strong for text and analysis | Medium to high, AWS account and development needed | Low to medium, per token | Like Data Zone EU: payroll data with sensitive fields only pseudonymised, red for audit mandates; cover AWS as a sub-processor in the contract. |
Gemini via Google Vertex AI (EU) Google Cloud, EU regions | Yellow | Gemini models | Processing EU Storage EU or Switzerland | Frontier, strong with long documents | Medium to high, Google Cloud project and development | Low to medium, per token | Like Data Zone EU; verify the processing location. Red for audit mandates. |
Claude directly from Anthropic Claude API, Team and Enterprise | Red | Claude Fable 5.1, Opus 5.5, Sonnet 5.5 | Processing US or global Storage US | Frontier, newest Claude models first | Low, ready to use | Medium, licence or per token | Legally possible with Data Privacy Framework certification or standard contractual clauses, but processing in the US with little control over the data location: not recommended for mandator data, usable for research. Whether a provider is certified is shown on the public DPF list. |
Claude in Microsoft Foundry or Copilot Microsoft, operated on Anthropic infrastructure | Red | Claude models | Processing Outside the EU Data Boundary Storage Not guaranteed | Frontier, same as Claude direct | Low, switchable at a toggle | Medium, in licence or per token | Unsuitable for mandator data, keep the switch off. |
Copilot with Flex Routing enabled Microsoft 365, setting available since April 2026 | Red | GPT models | Processing At peak load also US, Canada, Australia Storage Switzerland | Very good, same as Copilot | Low, a single setting | Medium, licence per user and month | Disable: at peak load data moves to the US, Canada or Australia. The real problem is the unpredictable data location, which is not defensible for mandator data. |
Private AI accounts ChatGPT, Claude.ai, Gemini with a private or free account | Red | All of them | Processing Unclear, mostly US Storage US | Frontier, which makes it so tempting | None, and that is exactly the problem | Low, free or privately paid | No contract, no control, and copying client data into private accounts can touch the duty of confidentiality under Art. 62 DPA: prohibit by policy, offer an approved alternative. |
Microsoft, AWS and Google are US corporations and are subject to the US CLOUD Act, even with data centres in Switzerland or the EU. This residual risk belongs in every risk assessment.
Hardly any organisation needs just one tool. What has proven itself is the combination of an AI employee for daily work and a secure interface for automations.
For fiduciary firms we recommend the pragmatic setup: daily work in Copilot, payroll and tax data only through the Swiss pipeline. For firms with audit mandates we recommend the strict setup, because professional secrecy under Art. 321 Criminal Code applies there.
Fiduciary firms usually face no sectoral supervision, but the DPA and the duty of confidentiality under Art. 62 DPA apply: anyone who learns secret personal data in the course of their profession and wilfully discloses it risks a fine of up to CHF 250,000 upon complaint, since the revision for all kinds of personal data. For audit mandates, professional secrecy under Art. 321 Criminal Code applies on top, because auditors bound to confidentiality are explicitly named there. Supervised are trustees with a FINMA licence under FinIA and fiduciaries that belong to a self-regulatory organisation as financial intermediaries, plus cantonal licensing duties.
This overview does not replace legal advice. Model availability and regions change constantly; October 2026 edition. Verify details with the provider before use.
Taskstreams builds and operates the pipeline that fits your policy: Switzerland only with Azure OpenAI Switzerland North, or the frontier model in the EU while your client data stays in Switzerland. Contract and governance are included; you receive finished AI employees for your processes, from document review to client reporting, instead of your own infrastructure project.