On 24 September 2026, around 250 people from politics, administration, business and academia met in Bern for Switzerland's National Cybersecurity Conference. Federal Councillor Martin Pfister opened it and called for joint action under the National Cyber Strategy and the Security Policy Strategy. The theme was handling AI developments and geopolitical tension through collaboration. The federal press release announces no new measures. For a policy publication, that absence is the story.
What the conference did and did not say
The federal press release lists speakers including NCSC director Florian Schütz and Maya Bundt, who chairs the National Cyber Strategy Steering Committee. It states that the strategy's success depends largely on joint effort across sectors. Next year the NCSC will co-organise the event with the Cyber Defence Campus, replacing the Swiss Security Network (SSN) as partner. The next edition is set for 21 September 2027 at the Kursaal in Bern.
There is a fair case that a conference of this kind should not announce new rules. Coordination events build the informal trust between operators and the federal centre that incident response depends on. Swiss cyber policy has also leaned on voluntary cooperation more than most of its neighbours. That is a feature of a country with a small, networked security community, and it is a reasonable instinct.
The rule that actually binds
The binding part of Swiss policy was set elsewhere. Under the Information Security Act amendment and the Cybersecurity Ordinance, operators of critical infrastructure must report cyberattacks to the NCSC within 24 hours of discovery. The federal page lists energy and drinking water suppliers, transport companies and cantonal and communal administrations among the covered operators. They then have 14 days to complete the report. The obligation has applied since 1 April 2025.
The strongest argument for this rule is straightforward. Attackers move across sectors quickly, and a fast report lets the centre warn other operators before the same technique spreads. A regulator that learns about incidents only when they reach the press cannot do that. The 24-hour clock mirrors the logic of the EU's NIS framework, which BleepingComputer's coverage of the rule says Switzerland describes as being in line with the EU approach.
How the enforcement is designed
The federal government deliberately delayed penalties. Its September 2025 release on the first six months says operators who fail to report may be fined up to CHF 100,000, with the sanctions in force from 1 October 2025. It also describes a graduated process. If the NCSC has evidence that a report was not submitted, it must first contact the operator. A criminal complaint is possible only if the operator does not respond to that contact and the order that follows.
That sequence is the right design for a rule of this kind. It treats the reporting duty as an obligation to cooperate and not as a trap for operators who are busy responding to an attack. A fine ceiling of CHF 100,000 is also modest next to the penalties in many other digital regimes. For a large operator it is a nudge, and for a small municipality it is a real sum, which is why the contact-first process matters.
Early volumes, and what we cannot yet see
The same federal release reports that the NCSC received 164 reports in the first six months of the obligation. Early figures were small. In the first month the centre recorded 25 notifications under the new duty, and its director said he expected the number to increase. By comparison, almost 63,000 cyber-related incidents of all kinds were reported to the NCSC in 2024. Most of those were voluntary reports from the public, driven by fraudulent calls in the name of authorities. They are a different population from mandatory critical-infrastructure reports.
Two gaps stand out. First, the sources we reviewed give no public figures on how many operators have been contacted for missing reports, or whether any fine has been imposed. Second, they give no measure of whether 24-hour reports have led to faster warnings to other operators. Without those numbers, nobody outside the NCSC can tell whether the regime is working or merely generating paperwork.
What proportionate policy looks like from here
The pro-innovation position on cybersecurity regulation is not that the state should stay out. It is that obligations should be narrow, clear and measurable, and that regulators should show they deliver security. Switzerland has a narrowly scoped reporting duty and a graduated penalty process. It has not yet published much evidence on outcomes.
The conference theme of AI and geopolitics raises the stakes. If AI tools make attacks faster and cheaper, a 24-hour window becomes harder for defenders to meet and more valuable to regulators. That is an argument for investing in the reporting infrastructure, such as the Cyber Security Hub form, simple templates and clear guidance for small operators, before it is an argument for tougher penalties. Adding obligations now, before the existing one has been evaluated, would be premature.
There is a practical suggestion. When the NCSC and the Cyber Defence Campus meet in September 2027, the useful deliverable would be a short public evaluation. It should cover the number of mandatory reports, the share filed within 24 hours, the number of contact-and-order procedures, the number of fines, and examples of warnings issued because of early reports. That would turn a networking event into accountability for a rule that has been in force for over two years.
Switzerland's restraint is defensible. A government that declines to announce new measures while the last ones are bedding in is behaving more carefully than most. The test of that approach is whether the data eventually shows it was justified.