Switzerland: Fines for non-compliance with cyber-attack reporting obligations under amended Information Security Act takes effect

On 1 October 2025, the enforcement of fines under the amended Information Security Act begins. Since 1 April 2025, operators including cloud computing providers, search engines, digital security and trust services, and data centres in Switzerland have been required to report cyber-attacks within 24 hours of discovery via the Federal Office for Cyber Security (BACS) platform. During the initial six-month period, reporting was mandatory but not subject to penalties. With the introduction of fines, operators that fail to report incidents affecting infrastructure functionality, causing data leaks or manipulation, or involving threats or coercion will now be subject to enforcement measures.