Switzerland
Swiss companies work under Swiss law, not EU regulation - but many sell to EU banks, insurers and essential entities whose contracts carry DORA and NIS2 requirements. Kellwick provides independent ISO 27001 and ISO 9001 internal audits, supplier assurance and security governance support, and helps Swiss firms separate what Swiss law requires from what an EU customer's contract asks for.
Buyers
Local context
Context for scoping, not legal advice. Whether a law applies to you depends on your entity type, sector and size; where a formal legal position is needed we work alongside your counsel.
Switzerland is not in the EU or EEA. DORA and NIS2 reach Swiss companies indirectly: through the contract terms EU financial entities must impose on ICT providers, through EU customers' supply-chain requirements, or through EU subsidiaries.
Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours under the Information Security Act.
FINMA Circular 2023/1 sets operational risk and resilience expectations, including ICT and cyber risk, for supervised banks. Suppliers to them meet these through outsourcing and contract requirements.
Last verified 16 October 2026 against BACS - reporting obligation and FINMA - Circular 2023/1.
Services
Delivery
Sectors
Questions
Not as a Swiss company. Your customer is, and DORA requires it to include specific terms in its contracts with ICT providers. Those terms bind you contractually. We map them to the controls you already run and close the gaps.
We give governance and audit context, not legal advice. Where a formal position on Swiss law is needed, we work alongside your legal counsel.
The standards, the sites and the deadline are enough to start. A specialist replies within one business day and confirms whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.