New Cybersecurity Act in Switzerland: what matters now

At its meeting of 25 September 2026, the Federal Council instructed the DDPS to draft, by June 2027, a consultation proposal for a new, standalone Cybersecurity Act. The text of the act itself is therefore not yet available, but its direction, the areas affected and part of the operational practice can already be derived today from current law and official communications. Those responsible for governance, risk and compliance can use the time until the consultation for concrete preparatory work.

What did the Federal Council decide on 25 September 2026?

The Federal Council instructed the DDPS to submit a consultation draft for a new Cybersecurity Act by June 2027; this emerges from a media release dated 24 September 2026.

The act is intended to implement three parliamentary motions in a single piece of legislation. Originally, separate amendments to the Information Security Act were planned for this purpose, but the three initiatives concern complementary regulatory levels: products, data and digital infrastructure.

The Federal Office for Cyber Security is already working on the underlying legislative projects: the cyber resilience of products with digital elements, the protection of particularly important digital data, and the role of hosting and cloud providers in cyber security.

Which three topics does the Cybersecurity Act bundle?

The Cybersecurity Act is intended to set binding requirements for manufacturers, importers and distributors of software and hardware products, to regulate the protection of particularly important digital data, and to define obligations for hosting and cloud providers.

For products, the plan provides for a foundation for market surveillance and a sales ban for insecure products. The rule is modelled on the European Cyber Resilience Act and is intended to keep the administrative burden on companies low.

The Federal Council does not intend to touch sector-specific regulations such as the Telecommunications Act, the Electricity Supply Ordinance or the Ordinance on Telecommunications Installations. The Cybersecurity Act is meant to supplement these regulations with cross-cutting obligations, as reported by Netzwoche.

What happens to the existing reporting obligation for critical infrastructure?

The reporting obligation for cyber attacks on critical infrastructure, in force since 1 April 2025, is to be transferred from the Information Security Act into the new Cybersecurity Act; the Information Security Act will in future govern only the information security of federal authorities.

Operators of critical infrastructure must report cyber attacks to the NCSC within 24 hours of detection. If not all details can be provided in the initial report, a further 14 days are available to complete it.

Since 1 October 2025, violations of the reporting obligation for critical infrastructure can result in fines of up to CHF 100,000; however, the NCSC must first contact operators who are in default, as SwissCybersecurity.net reported on 30 September 2025.

Six months after its introduction, the NCSC counted a total of 164 reports in a review dated 29 September 2025, with the financial sector most affected.

In parallel, on 6 May 2026 the Federal Council instructed the DDPS to prepare a separate revision of the Information Security Act; the consultation on this is planned for mid-2027. A working group led by SEPOS is preparing it with the involvement of the Federal Chancellery, the departments, and representatives of other federal authorities and the cantons.

What preparatory work can already be done now?

Even without the text of the act, companies can already check whether they are affected, document their existing reporting practice, and clarify internal responsibility for the three regulatory areas.

Companies that have already structured their own ISMS obligation under the Information Security Act within the existing deadlines can use the same systematic approach for the new areas of the Cybersecurity Act. This concerns in particular the allocation of responsibilities between the CISO, compliance and executive management.

• Check whether the company itself falls under one of the nine sectors of critical infrastructure: authorities, energy, waste disposal, finance, health, information and communication, food, public safety, and transport, as described in Article 74b paragraph 1 of the Information Security Act.
• Document reporting channels and internal escalation for the 24-hour deadline, regardless of the future text of the act.
• Prepare an inventory of which products with digital elements, which data, and which hosting or cloud services could in future fall under the Cybersecurity Act.

What is the next concrete step?

Risk owners should prepare an internal overview of the affected products, data and cloud services by the time the consultation draft is published in June 2027, and compare it directly with the draft once the text of the act is available.

A first step is to compile the existing reporting channels and deadlines from practice since 1 April 2025, supplemented by a list of the products, data categories and service providers that could become relevant in the three regulatory areas of the Cybersecurity Act. This overview can be maintained independently of the text of the act and compared with the obligations available in 2027.