Know Your AgentDEVerify evidence
Menu

Know Your Agent in Switzerland: verifying AI agents

Know Your Agent (KYA) means verifying whether an AI agent was authorized for a specific action, with evidence that third parties can recompute independently. In Switzerland, this ties in with the Code of Obligations, the Data Protection Act and the new e-ID.

, Founder, Innopulse Consulting GmbH
Published

Key points

  • Know Your Agent verifies whether an AI agent was authorized for an action, with recomputable evidence.
  • Agency under Articles 32 et seq. of the Code of Obligations forms the legal background.
  • The Data Protection Act requires purpose limitation, proportionality and data security when using agents too.
  • The e-ID with swiyu can in future prove an agent's principal.

What Know Your Agent means in Switzerland

Swiss companies use AI agents for procurement, customer service, accounting and administrative processes. As soon as an agent orders, pays or files an application, the same question arises as with any representation: was it allowed to? Know Your Agent answers this question with verifiable evidence instead of a log entry.

knowyouragent.ch is a neutral verifier based in Zug. Verification runs entirely in the browser, without an account and without evidence leaving the device. Swiss Standard German is the site's first language, English its second.

Agency under the Code of Obligations

The Code of Obligations governs agency in Articles 32 et seq. The scope of the authorization is decisive; if it was communicated to a third party, its scope toward that party follows the communication (Article 33 paragraph 3). A transaction without authorization binds the principal only after ratification (Article 38), and the unauthorized agent is liable under Article 39.

Whether these rules apply to AI agents directly or by analogy is open in legal writing. In practice: a mandate with clear limits that the agent presents makes the limits visible to both sides. More on this in the article Proving authority.

Data protection under the Data Protection Act

The revised Data Protection Act has applied since 1 September 2023. Important for agents are the principles of proportionality and purpose limitation (Article 6), data protection by design and by default (Article 7), data security (Article 8) and processing by processors (Article 9). If an agent makes automated individual decisions with legal effect, information obligations apply (Article 21).

KYA itself processes no evidence on a server. Verification takes place locally, and details in evidence can be limited to what is necessary with selective disclosure.

Identity: the e-ID and swiyu

On 28 September 2025, voters approved the federal act on electronic proof of identity. The e-ID is voluntary and free of charge; people keep it in the swiyu wallet app and present only the details needed. Technically, the federal trust infrastructure relies on SD-JWT VC and OID4VP.

For agents, the e-ID is the natural proof of the principal's origin. A mandate can be bound to a person whose identity is proven by the government. KYA already verifies mandates in the SD-JWT VC format; a dedicated profile for the e-ID as proof of origin is planned.

Regulation and supervision

Switzerland has no AI law of its own. In February 2025, the Federal Council decided to ratify the Council of Europe Framework Convention on Artificial Intelligence and to adapt existing law sector by sector wherever possible. In the financial sector, FINMA set out expectations for governance and risk management in the use of artificial intelligence in its Guidance 08/2024.

Swiss companies with customers in the EU are also affected by European requirements. The article EU AI Act and AI agents: what applies to agents puts this in context.

Industries in Switzerland

  • Banks and insurers: payments, securities orders and claims by agents need proven authority. More on financial services.
  • Retail: online shops receive orders from shopping agents and must tell legitimate agents from bots. More on retail.
  • Public administration: applications and notifications that agents submit on behalf of people require a clear attribution. More on public administration.

Terms in the Swiss context

Swiss usage speaks of power of authorization and agency; KYA uses the term mandate for the machine-readable form. Both essentially mean the same: the defined limits within which someone may act for another.

Frequently asked questions

What does Know Your Agent mean in Switzerland?

Verifying whether an AI agent was authorized for an action, with independently recomputable evidence. In Switzerland, it ties in with agency under the Code of Obligations, the Data Protection Act and, in future, the e-ID.

Are there rules specifically for AI agents in Switzerland?

No, there is no AI law of its own. The general rules apply, for example those of the Code of Obligations and the Data Protection Act. The Federal Council plans sector-specific adjustments.

Can I use KYA free of charge as a Swiss company?

Yes. Verification on knowyouragent.ch is free, needs no account and runs entirely in the browser. The engine is also available as a package under Apache 2.0.

Does KYA support the Swiss e-ID?

KYA verifies evidence in the SD-JWT VC format that the e-ID also uses. A profile for the e-ID as proof of the principal's origin is planned.

General information, not legal advice. The statutes and the circumstances of each case are decisive.

Sources

  1. Obligationenrecht (OR), Art. 32 ff.: https://www.fedlex.admin.ch/eli/cc/27/317_321_377/de#art_32
  2. Bundesgesetz über den Datenschutz (DSG): https://www.fedlex.admin.ch/eli/cc/2022/491/de
  3. E-ID: offizielle Informationen des Bundes: https://www.eid.admin.ch/de
  4. Europarat: Rahmenkonvention über künstliche Intelligenz: https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence