AI Innovation Built on Trust: What Software Development Companies Need to Know

81.4% of Swiss software companies used AI in software development in 2025, up from 46.8% in 2024 (Swiss Software Industry Survey 2025, University of Bern for Swico). The study is blunt about what is happening with AI governance: employees retain a lot of freedom in selecting tools, especially AI tools, because most companies remain in an experimental phase without strict usage guidelines. Switzerland leads at individual level too — 37.8% of the working-age population used generative AI in Q1 2026, against 17.8% globally (Microsoft AI Diffusion Report).

The case for moving forward with AI is clear: AI-accelerated innovation could add CHF 15 billion annually to the Swiss economy by 2034 (Computerworld.ch). At the same time Raiffeisen study (August 2026) finds only 9% of Swiss companies use AI systematically while 54% run pilots. This gap is not technological: in EY Switzerland's 2026 survey the top barriers to scaling are data quality and silos (20%), security and data protection (19%) and skills (18%); only 14% scale systematically, and 51% call Swiss or EU data processing business-critical. For a software company these are not IT concerns — they are the conditions for your customers’ purchase decisions.

Visibility instead of sanctioning: Governing AI with flexibility while staying compliant

Shadow IT is not new, but shadow AI poses different kind of challenges, and it is growing for three reasons (CIO, November 2025): democratization — generative AI's low entry barrier turns every employee into a potential developer; organizational pressure — business units clearly incentivised to raise productivity, but not in parallel to improve governance; and cultural reinforcement — engineering cultures value speed over process. The difference matters. Classic shadow IT put company data somewhere it should not be — a containment problem. Shadow AI does that too, but its output also flows back into the work: into code, customer emails and decisions, with no record of where it came from. The risk is no longer only what leaves the company, but what enters it unchecked.

Swiss software firms are structurally exposed: 52.5% let employees choose their own AI tools, against 36.9% for classical IT tools (SSIS 2025). AI governance is looser than the IT governance those same firms already run competently. Organisations with high levels of shadow AI carry USD 670,000 in additional average breach cost, and 63% of breached organisations had no AI governance policy (IBM, 2025). Prohibition is not the answer, and the market has concluded this: outright AI bans fell from 28% to 7% in one year (Cisco, 2026). A ban does not stop the usage, it only hides it. Visibility lowers the risk without slowing down the people creating the value.

The guiding principle is proportionality: the depth of review should match the sensitivity of the data and process involved. Applying the same level of scrutiny across the board is how governance starts eating the efficiency gain it was meant to protect. Where you want to experiment on sensitive client data, sandboxes running on synthetic data can serve as a pragmatic answer.

When AI moves into your product: Governance by design

Most software suppliers already offer AI features or AI solutions, or plan to. In practice this usually means integrating large language models — such as Claude, GPT or Mistral — into the products. That changes what you have to manage. Data no longer flows only through your own systems — it passes through the model, through APIs, and through whatever tools your AI agents call, and every hop is a processing step you are accountable for. The cybersecurity picture shifts with it, and entirely new risk categories appear: hallucinated output, and limited visibility into how the system reached a result at all.

The exposure is measurable. 45% of AI-generated code contains security vulnerabilities where no explicit security guidance is given — a figure that has not improved since 2025, across 150+ models tested (Veracode, Spring 2026). Faster generation without a matching shift in review and testing moves defects downstream, where they cost more.

Regulated industries change the risk profile, not the principles

Many software providers sell into finance, healthcare or the public sector, which means inheriting the sector-specific requirements their clients must meet. Beyond the AI-specific ones, cloud guidance is often the binding constraint on an AI product sold into a regulated industry, because it determines where processing may occur at all. Data sovereignty demands are also becoming a more common concern.

Meeting the legal and regulatory requirements is the baseline. Following the relevant industry guidelines as well is what gets a vendor through procurement in these sectors.

The bottom line

The regulatory case for acting is real, and the economics point the same way. Explainability, traceable data flows and a lawful basis for training data are inexpensive to specify at the outset and expensive to retrofit. Cataloguing twenty AI tools is manageable; cataloguing several hundred is a different project.

Governance that works is light where risk is low and more thorough where risk is real. It runs on visibility rather than prohibition, and is ingrained in engineering processes rather than assembled when a prospective client asks how you govern AI. For a Swiss software company the case is commercial as much as legal: enterprise customers pass their own regulators' questions on to you as procurement requirements, and smaller customers, who rarely audit, still notice a breach. Firms that can respond promptly, and with evidence, shorten a sales cycle that others spend months working through. That is the return on trust by design.

Where this gets difficult is rarely the principle. It is the specific case: whether your architecture qualifies under a client's secrecy obligations, whether a given control satisfies a regulator, whether the sector guidance your customer follows applies to you as their vendor. Those questions are worth answering before a procurement questionnaire forces them.