Legal | Tax | Compliance
Legal | Tax | Compliance
Artificial intelligence is transforming how companies operate, make decisions and interact with people. But as AI becomes embedded in business processes, a fundamental question emerges: Who is responsible when an algorithm causes harm? Responsible Business Conduct (RBC) provides an important framework for addressing this challenge.
Artificial intelligence is transforming how companies operate, make decisions and interact with people. But as AI becomes embedded in business processes, a fundamental question emerges: Who is responsible when an algorithm causes harm?
The answer is increasingly clear: AI does not operate in a legal vacuum. Companies remain responsible for how they develop, procure, deploy and oversee AI systems, including their impacts on human rights.
Responsible Business Conduct (RBC) provides an important framework for addressing this challenge. Building on the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct and the UN Guiding Principles on Business and Human Rights (UNGPs), it connects technological innovation with corporate accountability, human rights due diligence and effective governance.
For boards of directors, general counsel and compliance officers, the challenge is no longer simply to establish AI principles. It is to translate those principles into enforceable policies, operational controls and demonstrable accountability.
This article examines the intersection of AI, corporate governance and human rights, with particular attention to the European Union and Switzerland, and proposes a practical legal and compliance roadmap.
AI creates significant opportunities for companies, from improving productivity and operational efficiency to supporting innovation, healthcare and sustainability. At the same time, AI systems can generate or amplify adverse impacts on individuals, workers, consumers and society.
These scenarios demonstrate that AI-related risks extend beyond cybersecurity, intellectual property and data protection. They can directly affect internationally recognised human rights.
Under the UNGPs, companies have a responsibility to respect human rights, including by conducting human rights due diligence to identify, prevent, mitigate and account for adverse impacts. The OECD Guidelines reinforce this responsibility across business activities and relationships, including technology-related impacts. The OECD’s 2023 update explicitly strengthened the Guidelines’ treatment of science, technology and innovation.
These frameworks do not require companies to guarantee that no adverse impact will ever occur. They expect risk-based processes proportionate to the circumstances, involvement and potential impacts.
The key shift is from assessing whether AI is technically reliable to determining whether its use is responsible, lawful and consistent with human rights.
AI governance should not be treated as an isolated IT function. Its potential legal, operational, reputational and societal consequences make it a matter of enterprise-wide corporate governance.
In Switzerland, Article 716a of the Swiss Code of Obligations establishes non-transferable responsibilities of the board, including ultimate direction, organisation, financial control and ultimate supervision. Although it does not specifically mention AI, these duties provide an important legal foundation for AI oversight. Where AI materially affects business operations, regulatory compliance or risk exposure, directors should ensure adequate governance and control mechanisms.
In the EU, the AI Act adds specific regulatory obligations for providers and deployers of certain AI systems, including risk management, human oversight, documentation and monitoring. The precise obligations depend on the company’s role, the AI system’s classification and the applicable provisions.
| Governance dimension | Key legal and compliance question |
| Strategy and risk appetite | Which AI applications are acceptable, restricted or prohibited? |
| Accountability | Who approves, supervises and challenges AI systems? |
| Policies and controls | Are legal, ethical and human rights requirements operationalised? |
| Monitoring and assurance | Can the company demonstrate operation within defined parameters? |
| Transparency and remedy | Can affected individuals raise concerns, challenge outcomes and obtain remedies? |
A common weakness is the absence of clear ownership. AI projects may be initiated by business units, implemented by technology teams and reviewed by legal or compliance only shortly before deployment.
Companies should establish a cross-functional governance model involving legal, compliance, risk, IT, cybersecurity, data protection, procurement, HR and relevant business functions. Larger organisations may benefit from an AI governance committee; smaller companies can adapt existing risk and compliance structures.
Good AI governance is not about establishing another committee. It is about ensuring that the right people make informed decisions, at the right time, with clear accountability.
In February 2026 the OECD published its Due Diligence Guidance for Responsible AI, connecting responsible business conduct with AI risk management (OECD Due Diligence Guidance for Responsible AI | OECD) and adapting its six-step due diligence framework to AI development, procurement and use.
Traditional AI assessments often focus on accuracy, robustness, security and regulatory classification. A human rights impact assessment (HRIA) asks different questions. For example, AI-supported employee evaluations should be assessed for impacts on privacy, equal treatment, working conditions and access to employment.
Assessments should consider severity, scope, irremediability and likelihood of adverse impacts. Companies should distinguish between impacts they cause, contribute to or are directly linked to through business relationships; this matters for prevention, mitigation and remediation under the UNGPs.
Meaningful stakeholder engagement may involve employees, workers’ representatives, customers, affected communities or civil society organisations. Integrate AI-specific human rights questions into existing compliance, enterprise risk and human rights due diligence processes.
Responsible AI is shaped by binding obligations and international standards. The UNGPs, OECD Guidelines and OECD AI Principles are not, in themselves, generally binding corporate legislation, but they inform expectations, contractual obligations and regulatory approaches.
Regulation (EU) 2024/1689 establishes a horizontal, risk-based framework. Its application dates and transitional provisions must be checked against the latest consolidated text and amendments.
| Date | Key development |
| 2 February 2025 | Prohibited AI practices and AI literacy provisions begin applying |
| 2 August 2025 | General-purpose AI obligations and governance provisions begin applying |
| 2 August 2026 | Most remaining applicable rules, including important transparency obligations, take effect |
| 2 December 2027 | High-risk rules for stand-alone systems apply under the amended timetable |
| 2 August 2028 | High-risk rules for AI embeded in specified regulated products apply under the amended timetable |
High-risk requirements include risk management, data governance, technical documentation, record-keeping, human oversight, accuracy, robustness and cybersecurity. Obligations differ among providers, deployers, importers and distributors. Certain deployers must conduct fundamental rights impact assessments under Article 27, subject to its scope and exceptions.
The AI Act can also affect non-EU companies, including Swiss businesses, where its territorial conditions are met. AI Act compliance does not automatically establish compliance with human rights due diligence expectations: the approaches are complementary.
Switzerland does not have a comprehensive horizontal AI statute equivalent to the EU AI Act. The Federal Council has pursued implementation of the Council of Europe Framework Convention on AI and Human Rights, Democracy and the Rule of Law through legislative, voluntary and sector-specific measures. Consultation on legislative measures is envisaged for spring 2027.
Swiss companies operating internationally should coordinate domestic obligations, EU legislation with extraterritorial reach and international expectations.
Many companies procure third-party AI solutions, integrate external tools or use cloud-based services. They may control use without full visibility into development. Risks include training data, intellectual property, privacy, data-annotation labour, cybersecurity, model limitations and subcontractors.
OECD risk-based due diligence extends to business relationships, but responsibility depends on the company’s involvement in an adverse impact; it is not an automatic guarantee of every supplier’s conduct.
| Contractual topic | Recommended safeguard |
| Transparency | Information on purpose, limitations, relevant data sources and dependencies |
| Compliance | Appropriate warranties on applicable AI, privacy, IP and sector-specific law |
| Human rights | Commitments to relevant labour and human rights standards |
| Audit and assurance | Risk-proportionate documentation, testing and independent assurance |
| Incident management | Notification and cooperation on significant AI incidents |
| Change management | Notification of material model, functionality and risk changes |
| Remediation and exit | Corrective action, suspension, termination and transition rights |
Safeguards should reflect the supplier’s role, application risk and the company’s leverage. Outsourcing AI technology does not eliminate the company’s own legal and compliance obligations.
Responsible AI should be integrated into existing data protection, cybersecurity, third-party risk, internal control, human rights and regulatory compliance processes.
| Governance layer | Primary responsibilities |
| Board of directors | Oversight, risk appetite and accountability |
| Executive management / AI committee | Policies, decisions, escalation and resources |
| Legal & compliance | Regulatory obligations, human rights and contracts |
| Risk & data protection | Impact assessments, privacy and risk controls |
| IT & cybersecurity | Technical validation, monitoring and resilience |
| HR & procurement | Employee safeguards and supplier due diligence |
| Business units / AI owners | Implementation, human oversight and ongoing monitoring |
Three principles are critical: assign individual accountability for every material AI application; govern the entire lifecycle from procurement to retirement; and preserve evidence of risk assessments, approvals, testing, incidents and corrective actions.
| Priority | Action | Suggested owner |
| 1 | Inventory AI systems, including third-party tools and shadow AI | IT / Business |
| 2 | Assess EU AI Act roles, Swiss law and sector rules | Legal / Compliance |
| 3 | Classify use cases by legal and human rights risk | Risk / Compliance |
| 4 | Adopt an AI policy, approval process and accountability map | Management / Legal |
| 5 | Assess sensitive and high-impact uses | Legal / Risk / HR |
| 6 | Introduce supplier due diligence and AI clauses | Procurement / Legal |
| 7 | Establish human oversight, complaints and remediation | Business / Compliance |
| 8 | Implement monitoring, training, assurance and board reporting | Risk / Internal Audit |
The debate about AI governance is sometimes framed as a choice between innovation and regulation. However, well-designed governance can enable innovation by creating clarity, building trust and allowing organisations to deploy AI with greater confidence.
The OECD’s 2026 guidance reinforces the integration of responsible AI into mainstream corporate governance and responsible business conduct. AI governance belongs at board and management level; human rights belong in AI risk management; and companies should move from principles to operational controls.
The companies that succeed will not necessarily be those that adopt AI the fastest, but those that combine technological ambition with responsible governance and meaningful accountability to build trust!
Our ESG and AI Legal Teams can support you in laying the foundation for responsible and sustainable AI Governance.
