Your industry: Lawyers and law firms
Tailored to law firms: attorney-client privilege (Art. 13 BGFA, Art. 321 Criminal Code), the FSA guideline on IT outsourcing and cloud, and the cloud expert opinion prepared for the FSA are factored in.
Works with client data: the setup is proven, contract and governance are in place. This is exactly how you should do it.
Depends on the contract, configuration and industry: feasible with a documented risk assessment, not without it.
Not defensible for client data in our risk assessment: no contract, no control or no documented safeguards. Often still the best choice for research, marketing and anonymised content.
Filter the table by traffic-light colour. On a smartphone it scrolls sideways.
| Solution | Client data | Models | Data location | Model quality | Effort | Cost | What to watch |
|---|---|---|---|---|---|---|---|
Azure OpenAI Switzerland (Standard) Microsoft Azure, Switzerland North region | Green | GPT-4o (until April 2027), Embeddings | Processing Switzerland Storage Switzerland | Solid, several generations behind the frontier | Medium, integration by IT or partner | Low, per token, no base fee | The recommended direction for client files with a Swiss data location: choose the Standard deployment type (not Global or Data Zone), contract with confidentiality and audit rights. Additionally apply for Modified Abuse Monitoring, because Microsoft can otherwise store flagged samples that authorised staff may review, and formally notify the provider of its role as an auxiliary person (Art. 13(2) BGFA). Microsoft remains a US corporation: document the residual CLOUD Act risk. For new customers, GPT-4o (until April 2027) is effectively the only option; GPT-4.1 is deprecated. |
Azure OpenAI Switzerland (Provisioned) Microsoft Azure, Switzerland North, reserved capacity | Green | GPT-5.1 (until May 2027) | Processing Switzerland Storage Switzerland | Very good, strongest model with CH guarantee | Medium, integration by IT or partner | From approx. USD 13,000 per month (minimum 50 PTU) | Like the Standard variant, but with regional Provisioned capacity in Switzerland North (not Global or Data Zone Provisioned); for firms with high volume, e.g. due diligence or contract review. GPT-5.1 (until May 2027) costs from approx. USD 13,000 per month (minimum 50 PTU), and a successor in Switzerland is not guaranteed. |
Swiss AI platforms e.g. AIgent, Swisscom, Phoenix Technologies (kvant), Infomaniak | Green | Open models such as DeepSeek, Qwen, GLM, Apertus | Processing Switzerland Storage Switzerland | Good to very good, a step behind the frontier | Low, ready-made interface, some with agents | Medium, licence per user, sometimes plus usage | The cleanest choice for client files, provided provider and models are not US-controlled: check confidentiality and ISO 27001, disable optional US models. The Council of Bars and Law Societies of Europe (CCBE) recommends avoiding providers bound by foreign laws such as the US CLOUD Act. |
AI in your industry software e.g. practice, law firm, CRM or portfolio systems | Depends on provider | Usually GPT or Claude in the background | Processing Depends on provider Storage Depends on provider | Good, tailored to the use case | Low, the system is already in use | Low to medium, often as an add-on module | Law firm software: clarify in writing which model runs where. The vendor counts as an auxiliary person of the lawyer: privilege applies towards it too. |
Microsoft 365 Copilot Microsoft, with EU Data Boundary | Yellow | GPT models from OpenAI, operated by Microsoft | Processing EU/EFTA Storage Switzerland (Data Location or ADR) | Very good, strong in everyday office work | Low, licence and configuration | Medium, licence per user and month | Use is demanding because attorney-client privilege must be secured technically and contractually without gaps. Flex Routing and Anthropic models off, apply for Modified Abuse Monitoring. |
Azure OpenAI Data Zone EU Microsoft Azure, resource in Switzerland North | Yellow | Latest GPT generation, e.g. GPT-5.4 to GPT-6.1 | Processing EU Data Boundary, confirm countries with Microsoft before use Storage Switzerland | Frontier, latest GPT models | Medium, integration by IT or partner | Low, per token | Yellow only for pseudonymised content or with client consent: client files in the EU only after an in-depth risk assessment with a confidentiality commitment. Red for criminal mandates and mandates containing health data, both are especially sensitive (Art. 5(c) DPA). The EU Data Boundary can also include EFTA countries: confirm the affected countries with Microsoft before use. |
Claude via AWS Bedrock (EU) Amazon Web Services, EU regions | Yellow | Opus 5 and Sonnet 5 in Ireland or Stockholm, Opus 5.5 and Sonnet 5.5 via EU inference | Processing EU Storage No prompt storage by Bedrock | Frontier, especially strong for text and analysis | Medium to high, AWS account and development needed | Low to medium, per token | Like Data Zone EU: yellow only pseudonymised or with client consent, red for criminal mandates and mandates containing health data. Contractually regulate and review AWS sub-processors and possible data access. |
Gemini via Google Vertex AI (EU) Google Cloud, EU regions | Yellow | Gemini models | Processing EU Storage EU or Switzerland | Frontier, strong with long documents | Medium to high, Google Cloud project and development | Low to medium, per token | Like Data Zone EU; have the processing location verified in writing. Red for criminal mandates and mandates containing health data. |
Claude directly from Anthropic Claude API, Team and Enterprise | Red | Claude Fable 5.1, Opus 5.5, Sonnet 5.5 | Processing US or global Storage US | Frontier, newest Claude models first | Low, ready to use | Medium, licence or per token | Client files in US processing endanger privilege: unsuitable. Good for research without client reference. |
Claude in Microsoft Foundry or Copilot Microsoft, operated on Anthropic infrastructure | Red | Claude models | Processing Outside the EU Data Boundary Storage Not guaranteed | Frontier, same as Claude direct | Low, switchable at a toggle | Medium, in licence or per token | Processing outside the EU Data Boundary: unsuitable for client files. |
Copilot with Flex Routing enabled Microsoft 365, setting available since April 2026 | Red | GPT models | Processing At peak load also US, Canada, Australia Storage Switzerland | Very good, same as Copilot | Low, a single setting | Medium, licence per user and month | Firms should disable this, otherwise client files cross into third countries at peak load. |
Private AI accounts ChatGPT, Claude.ai, Gemini with a private or free account | Red | All of them | Processing Unclear, mostly US Storage US | Frontier, which makes it so tempting | None, and that is exactly the problem | Low, free or privately paid | Client files in private accounts are criminally relevant (Art. 321 Criminal Code): prohibit and offer an alternative. |
Microsoft, AWS and Google are US corporations and are subject to the US CLOUD Act, even with data centres in Switzerland or the EU. This residual risk belongs in every risk assessment.
Hardly any organisation needs just one tool. What has proven itself is the combination of an AI employee for daily work and a secure interface for automations.
For law firms we recommend the strict setup: client files stay in Switzerland, and a Swiss platform that is not US-controlled is the cleanest building block.
Client files are covered by attorney-client privilege under Art. 13 BGFA, criminally protected by Art. 321 of the Criminal Code. Under the professional rules of the Swiss Bar Association, cloud providers count as auxiliary persons of the lawyer: they must be formally notified that they are themselves bound by professional secrecy, because Art. 13(2) BGFA obliges lawyers to ensure that their auxiliary persons keep the secret. The real risk is disciplinary: in 2025 the Bernese High Court disciplined a lawyer for breaching the duty of care because she had disregarded Art. 13 BGFA; a sanction is possible even without an actual disclosure and can go as far as a ban from practising. The assessment is based on the FSA guideline on IT outsourcing and cloud and on the cloud expert opinion of the University of Zurich prepared for the FSA.
This overview does not replace legal advice. Model availability and regions change constantly; October 2026 edition. Verify details with the provider before use.
Taskstreams builds and operates the pipeline that fits your policy: Switzerland only with Azure OpenAI Switzerland North, or the frontier model in the EU while your client data stays in Switzerland. Contract and governance are included; you receive finished AI employees for your processes, from document review to client reporting, instead of your own infrastructure project.