In short: Switzerland is to get a standalone Federal Act on Cybersecurity (CySA). On 25 September 2026, the Federal Council instructed the Federal Department of Defence, Civil Protection and Sport (DDPS) to prepare a consultation draft by June 2027. The act is to bring together binding security requirements for software and hardware, duties for hosting and cloud providers, and the existing reporting obligation for critical infrastructure.
Key facts
- Decision: Federal Council meeting of 25 September 2026
- Mandate: the DDPS is to prepare a consultation draft for a new, standalone federal act by June 2027
- Content: implementation of three parliamentary motions: cyber resilience of products containing digital elements (Mo. 24.3810), protection of the most important digital data (Mo. 23.3002), and the role of hosting and cloud providers in cybersecurity (Mo. 25.3011)
- Model: the product rules are based on the EU Cyber Resilience Act (CRA)
- Reporting obligation: the obligation to report cyberattacks on critical infrastructure, in force since April 2025, is to move from the Information Security Act (ISA) into the CySA
- Status: no draft law exists yet; the consultation will follow later
- Source: Federal Council media release of 25 September 2026
Three projects in one act
The National Cyber Security Centre (NCSC) had been handling the three parliamentary mandates as separate projects. They were originally to be implemented as amendments to the Information Security Act. They are now to be combined in an act of their own.
Secure products: Manufacturers, importers and distributors of software and hardware products are to meet binding requirements. Market surveillance rules and a ban on selling unsafe products are also planned. The rules are based on the EU CRA. According to the Federal Council, the aim is to keep the administrative burden on companies low; internationally active firms that already comply with the CRA should face no additional effort. Open-source software is also mentioned as a topic.
Important data and cloud: Specific duties are planned for protecting particularly important digital data and for hosting and cloud providers, including duties to cooperate and to defend against cyber threats.
Reporting obligation: The duty for operators of critical infrastructure to report cyberattacks will be transferred to the CySA. The ISA will continue to govern information security within the federal administration. Sector-specific legislation such as the Telecommunications Act remains in place; the CySA is to supplement it.
What this means for Swiss SMEs
For most SMEs nothing changes for now: the act does not yet exist, and details are only expected with the consultation draft. Three groups should follow the file closely:
- Software and hardware vendors selling products in Switzerland. Companies already supplying the EU should know the CRA timeline, as the CySA is modelled on it.
- Hosting, cloud and IT service providers, for whom new cooperation and defence duties are planned.
- Operators of critical infrastructure, for whom the reporting obligation continues to apply. Our page on reporting obligations after a cyberattack summarises the current rules.
Regardless of regulation, now is a good time to take stock: the cyber risk check highlights gaps. Whether a policy includes legal advice or crisis support depends on the contract; see Cyber insurance for SMEs, costs and our comparison.