What does this mean for Swiss companies?

For Swiss SMEs subject to the revised Data Protection Act (nDSG), three points matter most: where data is processed (data residency), whether subcontractors are involved (Sub-Processor List), and whether the data processing agreement aligns with your own compliance requirements. monday.com states GDPR compliance on its website – this covers many requirements that overlap with the Swiss nDSG, but it does not replace your own review. If you plan to use AI features on data requiring special protection in your company (e.g. personal data of customers or employees), it's worth reviewing the current Sub-Processor List and monday.com's data processing agreement rather than relying on general statements alone.

Certifications and governance behind the scenes

monday.com references several certifications that also apply to AI processing: ISO/IEC 27001, SOC 2 Type II, and ISO/IEC 27701. For healthcare organizations, monday AI can also be used in a HIPAA-compliant way, provided a Business Associate Agreement (BAA) has been signed.

monday.com also describes internal quality assurance processes: new AI features are tested before going live, an internal red team actively tries to find vulnerabilities and ways to circumvent safeguards, and features continue to be monitored after rollout. Technically, this is preceded by a gateway layer that includes rate limits, token limits, and moderation and security checks.

Where monday AI has clear limits

Not everything technically possible is intended for monday AI. According to the official terms of use, monday AI may not be used to develop competing AI models or services, to engage in unlawful or harmful activities, to misrepresent AI-generated content as human-created, or to make fully automated decisions with significant impact on individuals without appropriate safeguards and transparency. Also excluded: personalized financial, legal, or medical advice that would normally require a licensed professional. You currently cannot bring your own AI model or your own API key into monday AI.

Can you opt out of this data use?

monday.com states it may temporarily access content for a limited period (up to 60 days) to monitor and improve AI features – for example to detect harmful or unlawful activity. This data is not shared with third parties and is not used for training. Anyone who does not want this temporary access can request an opt-out by emailing ai-support@monday.com or contacting their account representative. This request can only be submitted by Admins, and processing takes up to 5 business days according to monday.com. If multiple accounts are linked to the same email address, the request must specify which account the opt-out should apply to.

Our recommendation from practice

As a monday.com Platinum Partner, we at Blinno regularly see companies activate AI features without first clarifying which boards and data are actually affected. Our recommendation: before introducing AI, review and clean up the account's permission structure, check the data residency setting, and – if sensitive personal data is involved – go through the opt-out process and the Sub-Processor List in advance. This ensures AI features operate within your compliance requirements from day one, instead of having to correct this afterward.

Conclusion

monday.com documents its AI data processing transparently: no training on customer data, Zero Data Retention with model providers, existing permissions remain authoritative, and encryption follows industry standards. For Swiss companies, however, this does not replace your own review of data residency and the Sub-Processor List, especially when personal data requiring special protection is involved. If you're unsure how to introduce monday AI in your company in a privacy-compliant way, we're happy to support you with setup and permission structure.