Cecilia Garcia Podoley

A Press Release Is Not Governance

Cecilia Garcia Podoley, an ethics, compliance and AI governance leader, explained why the AI Act reaches Swiss organisations.

Four Reasons to Care
The EU is Switzerland's main trading partner. The Act applies wherever effects are felt. European clients will require compliance. And Switzerland has a reputation for quality to protect. Swiss law already covers AI through data protection, liability and sector guidance.

On Self-Regulation
Voluntary pledges without penalties, audits or enforcement are "a press release, it's not governance."

The Brussels Effect
The EU AI Act has served as a reference for other jurisdictions, as GDPR did: Swiss companies that thought data protection did not concern them had to scramble once Switzerland followed suit. Switzerland has also signed the Council of Europe AI convention, focused on human rights, democracy and the rule of law.

Why Self-Regulation Fails
She listed three reasons. Information is asymmetric: providers know what is in their systems, the public does not. There are no consequences when things go wrong. And "if it goes wrong, it can go very wrong."

Code Your Values
Every company already has a stated mission and values. "This is your value, then code it" into the AI. Build around clear, agreed red lines rather than micromanaging what a model can and cannot do.

Three Practical Steps
Map AI use, including shadow AI and plug-ins. Name someone responsible for AI governance, since it often falls between compliance, IT and legal. And invest in AI literacy, which the AI Act requires.

"Regulation doesn't kill innovation. It shows the red lines." Map shadow AI, name an owner, and invest in AI literacy.

Ethics and compliance used to be about looking backwards: investigating what went wrong, fixing the damage. AI doesn't give you that luxury. By the time something goes wrong, it's gone wrong at scale. Thirty years in legal, ethics and compliance across industries and jurisdictions, same lesson every time: good frameworks are the ones people actually use. Ethics and compliance aren't optional add-ons anymore: they're the difference between leading with integrity and gambling with your reputation, your licence to operate, and your people's trust. AI safety and governance are the infrastructure that lets organisations adopt powerful tools without harming people, breaking the law, or destroying trust. Regulatory frameworks are converging worldwide, and most boards aren't ready. I turn that complexity into decisions directors can actually make.