We approach cybersecurity from an adversarial-economic perspective — investment must match the value of the information at stake. That negotiation belongs where decisions are actually made: between board, legal, and compliance.
From strategic positioning through legally defensible valuation to regulatory practice. Sector- and size-agnostic, from SME to multinational.
We work at the level where security decisions are actually made — between board, legal, and compliance. Need-to-protect, doctrine, and investment logic are not delegated here; they are negotiated.
Independent assessments that hold up before insurers, in due diligence, and in proceedings. We quantify what others merely assert — state of the art, duty of care, loss potential.
We translate directives into operational reality — without buzzword theatre, with verifiable trails. Strong at the Switzerland / EU interface, from cyber to AI regulation.
From NIS-2 via the Cyber Resilience Act to the AI Act, the EU is articulating its most comprehensive cybersecurity expectation to date — and, for the first time, one for the use of AI. Swiss companies are not directly bound — but via EU subsidiaries, EU markets, and supply chains the pressure passes through almost without gap.
The EU regulates cybersecurity along two axes. The NIS-2 Directive obliges organisations: 18 sectors, risk management, supply-chain due diligence, a 24-hour reporting duty — and executive management bears personal responsibility.
The Cyber Resilience Act addresses products — all "products with digital elements" on the EU internal market, from the IoT sensor to standalone software. Security-by-design becomes mandatory, the CE mark will include cybersecurity, and responsibility does not end at the sale.
With the AI Act, the EU regulates the use of AI comprehensively for the first time — risk-based, from prohibited practices via high-risk systems to transparency duties. The regulation reaches beyond the EU: it applies even when a system is operated outside the EU but its output is used within it. Swiss companies are in scope faster than many realise.
The law is only half the equation. Introducing AI creates new attack and leakage surfaces: uncontrolled AI use by employees, trade secrets in third-party models, systems open to manipulation. And wherever personal data is involved, the revDSG and GDPR apply in full — technology neutrality is no shield from supervision.
Switzerland is not an EU Member State — NIS-2, the CRA, and the AI Act do not apply directly. It is nevertheless an illusion to think Swiss companies are unaffected. The effect travels through three channels, and it is real.
An establishment in the EU is directly subject to local EU law — with all reporting duties and fine ceilings.
Anyone offering digital services or AI systems from Switzerland into the EU often falls directly within scope — the AI Act applies as soon as the output is used in the EU.
EU customers are required to vet their suppliers. EU duties are thus passed "downstream" — through contracts rather than statutes.
In parallel, Switzerland is tightening its own framework. The Information Security Act (ISG) has been in force since January 2024; since 1 April 2025, a 24-hour reporting duty applies to operators of critical infrastructure vis-à-vis the Federal Office for Cybersecurity (BACS). Breaches can be fined up to CHF 100,000. An expansion of scope towards the EU logic is foreseeable.
The regulatory wave does not start in 2027 — it has been in motion since 2024. The dates below are the pillars. Preparation begins several quarters earlier.
No sales pitch.
Fifteen minutes of clarity about what you actually need to protect.
Tell us briefly about your situation. We respond within 24 hours with an honest assessment — no obligation, no mailing list.
Your enquiry was opened in your email program — please send it from there. If nothing appeared, write directly to contact@clypeus.ch.