A Zurich-based startup has developed an AI-powered diagnostic tool that analyzes retinal images to detect early signs of diabetic retinopathy. The algorithm performs comparably to specialist ophthalmologists in clinical validation studies. The founders want to deploy the tool in Swiss primary care settings, allowing general practitioners to screen patients who might otherwise wait months for specialist appointments. Under the MepV (in force since 26 May 2021), the founders expect the product to require conformity assessment as a Class IIa device before market placement. The founders estimate 18–24 months to CE marking, assuming they can find a Notified Body with capacity. They ask whether Switzerland offers a faster pathway.
The answer is nuanced. Switzerland has developed mechanisms that permit earlier market access for certain digital health products under defined conditions. But these mechanisms operate within constraints that may disappoint founders expecting the permissive sandboxes advertised in other jurisdictions.
1. The Sandbox Concept in Swiss Context
The regulatory sandbox originated in financial services, where the UK Financial Conduct Authority pioneered the concept in 2016. The core idea is straightforward: allow innovators to test products with real customers under regulatory supervision, with certain requirements temporarily relaxed, while maintaining essential consumer protections. If the test succeeds, the product graduates to full regulatory compliance. If it fails, only the customers in the test are affected.
Applying this concept to healthcare raises distinct challenges. Financial losses can be compensated; patient harm may be irreversible. The sandbox must balance innovation incentives against patient safety in ways that financial sandboxes need not. Different jurisdictions have struck this balance differently, ranging from Singapore's relatively permissive Ministry of Health sandbox to the EU's more cautious approach under the Medical Device Regulation.1Ministry of Health (Singapore), Licensing Experimentation and Adaptation Programme (LEAP); Art. 59 Regulation (EU) 2017/745 (MDR) [2017] OJ L117/1.
Switzerland sits close to the EU end of that range. The Federal Council has expressed support for innovation-friendly regulation, and Swissmedic has developed guidance facilitating digital health market access. But Switzerland lacks a formal, statutory sandbox regime comparable to Singapore's. What exists instead is a combination of existing regulatory flexibilities, enhanced guidance, and informal engagement pathways that together create sandbox-like effects without the sandbox label.
The contrast with Switzerland's own financial regulation is instructive. The Bankengesetz framework provides formal statutory carve-outs, notably Art. 6(2) BankV (sandbox exemption for public deposits up to CHF 1 million) and Art. 1b BankG (fintech license for deposits up to CHF 100 million), where Parliament and the Federal Council decided that financial innovation warranted regulatory relaxation.2Art. 6(2) Bankenverordnung (BankV) vom 30. April 2014 (SR 952.02) (sandbox); Art. 1b Bankengesetz (BankG) vom 8. November 1934 (SR 952.0) (fintech license); FINMA Circular 2008/3 (Public Deposits with Non-Banks). No equivalent exists for digital health, where patient harm, unlike a financial loss, may be irreversible.
Parliament carved out formal sandboxes for fintech. Digital health has no such carve-out.
2. Which Rules Apply to Digital Health Products?
Digital health products in Switzerland face a regulatory framework that depends on how the product is classified. The Medizinprodukteverordnung (MepV), adopted 1 July 2020 and substantively effective from 26 May 2021 to align with EU MDR application, governs medical devices including software as a medical device (SaMD).3Medizinprodukteverordnung (MepV) vom 1. Juli 2020 (SR 812.213), with key provisions effective 26 May 2021. Products that do not qualify as medical devices (wellness apps, fitness trackers, administrative health software) fall outside Swissmedic's jurisdiction entirely. The classification boundary, as discussed in earlier analysis, turns on intended purpose: software that diagnoses, treats, or monitors disease is typically a medical device; software that merely records or displays health information may not be.4See the analysis of how software is classified as a medical device in Switzerland and the EU.
For products that are medical devices, Swiss law requires conformity assessment before market placement. Since mutual recognition under the Swiss-EU MRA ceased for medical devices in May 2021, market access has worked differently in each direction: Switzerland unilaterally recognizes EU CE marking for Swiss market access (Art. 13(1) and Art. 25(4) MepV), but Swiss manufacturers seeking EU market access face third-country requirements under the MDR, including an EU authorized representative and conformity assessment through EU-recognized Notified Bodies.
Notified Body capacity remains a structural bottleneck that shapes the practical timeline for any device sandbox or fast-track pathway. Approximately 50 Notified Bodies have been designated under the MDR, compared with approximately 80 under the predecessor MDD, and among those designated, few have built assessment expertise for AI-enabled SaMD.5European Commission, 'Notified Bodies: NANDO Database'; Team-NB, Designated Notified Bodies under MDR/IVDR: Statistics (2024): approximately 50 Notified Bodies designated under MDR by end of 2024, compared with ~80 under MDD. The resulting backlogs mean that companies with complete technical documentation may face 12–18 months or longer for Notified Body engagement depending on device class, Notified Body choice, and technical complexity, extending typical development timelines to 24–36 months in practice. Regulatory flexibility in Switzerland cannot shorten the EU Notified Body queue that most Swiss digital health companies must eventually pass through, so any assessment of Swiss sandbox alternatives has to allow for it.
The Heilmittelgesetz (Therapeutic Products Act) and its implementing ordinances govern pharmaceuticals and certain combination products.6Bundesgesetz über Arzneimittel und Medizinprodukte (Heilmittelgesetz, HMG) vom 15. Dezember 2000 (SR 812.21). Digital therapeutics that incorporate drug delivery or that are regulated as drug-device combinations face additional requirements. The Federal Office of Public Health (BAG) oversees health insurance coverage and reimbursement, a separate regulatory track that determines whether approved products can actually reach patients through the funded healthcare system.
Digital health innovators therefore deal with several authorities at once. A single product may require a completed conformity assessment, BAG reimbursement approval, cantonal health authority notification for telemedicine services, and compliance with federal data protection requirements under the Datenschutzgesetz. No single "sandbox" covers all these domains. The jurisdictional overlaps (which authority has primacy, whether engagement must proceed sequentially or can run in parallel, and how cybersecurity expectations interact with data protection obligations) create interdependencies that multiply as product complexity increases.
The revised Datenschutzgesetz (DSG), effective 1 September 2023, sets its own requirements.7Bundesgesetz über den Datenschutz (Datenschutzgesetz, DSG) vom 25. September 2020 (SR 235.1), effective 1 September 2023. Health data constitutes sensitive personal data under Art. 5(c) DSG, and cross-border transfers face restrictions under Art. 16–17 DSG regardless of product regulatory status. Where products process data across EU and Swiss jurisdictions, the GDPR and the DSG diverge in places, and no sandbox arrangement in either jurisdiction can override those differences.8See the analysis of data protection in clinical trials, which covers the processing of health data under both the GDPR and the DSG.
A product deployed under any sandbox-like arrangement remains subject to full data protection requirements; there is no DSG sandbox.
This division of authority, with each regulator confined to its own domain and no sandbox spanning them, still leaves room for flexibility. Within each domain, mechanisms exist that permit earlier market access, regulatory dialogue, or controlled deployment under conditions that differ from full conformity assessment. The following section examines these mechanisms and assesses what they actually offer.
3. What Does Switzerland Actually Offer?
Within these rules, Switzerland has developed several mechanisms that help a product reach the market earlier. None is a formal sandbox, but together they open routes that differ from the models advertised elsewhere.
At the federal level, Swissmedic offers pre-submission engagement that can clarify classification, clinical evidence requirements, and conformity assessment pathway uncertainties, though the scope of such engagement varies, particularly for AI-enabled devices where MDCG guidance is still evolving.9Swissmedic, Information Sheet on Medical Device Software (BW630_30_007, Version 3.0, 10 April 2024). Art. 9b HMG permits temporary authorization for use of non-authorized medicinal products in individual cases, applicable to pharmaceuticals rather than devices but relevant for drug-device combinations.10Art. 9b HMG. For medical devices specifically, Art. 22 MepV (mirroring Art. 59 MDR) permits Swissmedic to authorize market placement without completed conformity assessment where public health or patient safety interests justify it, the closest Swiss analogue to a formal device sandbox, though designed for exceptional circumstances rather than routine innovation facilitation.11Art. 22 MepV (Ausnahmen: Bewilligung des Inverkehrbringens ohne durchgeführtes Konformitätsbewertungsverfahren im Interesse der öffentlichen Gesundheit oder der Patientensicherheit); Art. 59 MDR (n 1) (derogation from the conformity assessment procedures).
The clinical investigation framework (the Verordnung über klinische Versuche mit Medizinprodukten, KlinV-Mep, mirroring Art. 62 ff. MDR, together with the general Verordnung über klinische Versuche, KlinV) permits real-world device deployment with patients under ethical oversight and informed consent, without prior conformity assessment.12Verordnung über klinische Versuche mit Medizinprodukten (KlinV-Mep) vom 1. Juli 2020 (SR 810.306); Art. 62 ff. MDR (n 1); Verordnung über klinische Versuche (KlinV) vom 20. September 2013 (SR 810.305). The relationship between clinical investigation deployment and subsequent commercial market placement, however, raises questions that the pathway's formal structure does not fully resolve.
On the reimbursement side, Germany's Digitale Gesundheitsanwendungen (DiGA) framework, permitting provisional directory listing based on plausibility, with permanent listing contingent on demonstrating positive healthcare effect within twelve to twenty-four months, has influenced Swiss policy discussions.13Digitale-Versorgung-Gesetz (DVG) vom 9. Dezember 2019 (BGBl I S 2562); Digitale Gesundheitsanwendungen-Verordnung (DiGAV) vom 8. April 2020 (BGBl I S 768). Switzerland has not adopted a formal equivalent, though cantonal pilot programs exploring coverage models for digital therapeutics have emerged with varying scope.14Bundesrat, Gesundheitspolitische Strategie 2020–2030 (Gesundheit2030) (6 December 2019); BAG, Strategie eHealth Schweiz 2.0 (2018). Several cantons have established innovation programs under their respective Gesundheitsgesetze that provide sandbox-like environments (telemedicine pilots, digital triage trials, clinical validation partnerships), though these operate within federal regulatory constraints and cannot substitute for conformity assessment.
4. How Does Switzerland Compare?
The variation across jurisdictions is substantial. Singapore's regulatory authorities operate formal sandbox programs with defined entry and exit criteria.15Ministry of Health (Singapore), LEAP (n 1) (standing healthcare-services sandbox with defined entry and exit conditions); Cyber Security Agency of Singapore, MOH, HSA, and Synapxe, Cybersecurity Labelling Scheme for Medical Devices (CLS(MD)) (CSA Singapore), which operated a time-limited sandbox phase from October 2023 to July 2024. The UK's MHRA launched its "AI Airlock" sandbox in May 2024 to explore evidence collection. Germany's DiGA framework creates a fast-track reimbursement pathway with provisional listing.13Digitale-Versorgung-Gesetz (DVG) vom 9. Dezember 2019 (BGBl I S 2562); Digitale Gesundheitsanwendungen-Verordnung (DiGAV) vom 8. April 2020 (BGBl I S 768). In the United States, the FDA's five-year Pre-Certification pilot ended without becoming operational. The agency's Predetermined Change Control Plan (PCCP) mechanism, set out in final guidance in December 2024, contemplates pre-authorization of specific planned modifications for AI-enabled devices, though its practical scope remains subject to FDA interpretation.16FDA, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions (Final Guidance, December 2024). The comparative matrix below situates Switzerland's guidance-based approach against these statutory and programmatic alternatives.
Switzerland's approach is more conservative than Singapore's or the UK's, but that does not settle the comparison. The variables that determine which jurisdiction's framework best serves a particular company (speed to first patient exposure, alignment with the EU conformity assessment pathway the company will eventually need, capacity to accommodate genuinely novel product categories, and clarity of post-sandbox obligations) do not all favor the same jurisdiction. A framework that favors one of these variables may impose costs on the others, and the weighting depends on commercial strategy, development stage, and risk tolerance, which no comparison of the jurisdictions can settle on its own.
5. Strategic Considerations for Digital Health Companies Entering Switzerland
The open questions depend on one another: classification of the product shapes the evidence-generation route, the evidence route shapes the market-access pathway, and EU and Swiss requirements bear on that pathway at the same time.
The strategic questions begin with classification, but the classification question is not purely technical. The same underlying technology may support positioning as a wellness tool (minimal regulatory burden, no medical claims, no reimbursement) or as a Class IIa medical device (conformity assessment, diagnostic claims, reimbursement eligibility) depending on intended purpose and marketing claims. Swissmedic's pre-submission engagement pathways can clarify classification and evidence requirements, but the utility of regulatory dialogue depends on development stage and whether the company's questions are ones the regulator can answer without constraining later pivots.
The product's technical design raises questions of its own. Swissmedic applies evolving cybersecurity expectations that no sandbox arrangement can defer, referencing MDCG 2019-16. The EU Cyber Resilience Act (Regulation (EU) 2024/2847) will impose reporting obligations from September 2026 and full compliance from December 2027, with conformity assessment stringency varying by product category, but Art. 2(2) Cyber Resilience Act excludes products covered by the MDR or the IVDR, so in digital health it reaches products outside those regimes, such as wellness software.17Medical Device Coordination Group, MDCG 2019-16 Rev.1, Guidance on Cybersecurity for Medical Devices (July 2020); Regulation (EU) 2024/2847 (Cyber Resilience Act) [2024] OJ L 2024/2847; Swissmedic Information Sheet (n 9), IT security requirements. Whether a product's design will satisfy these requirements as of 2025, and adapt as they tighten, depends on engineering choices that also bear on regulatory classification, in ways that may not be apparent until both analyses are underway.
The BAG reimbursement pathway presents similar interdependencies: coverage decisions depend on clinical evidence, but the type of evidence required depends on how the product is positioned, which in turn depends on regulatory classification. Cantonal innovation programs and hospital pilot partnerships may accelerate clinical validation, or may not be available for products in particular categories or at particular development stages.
CE marking remains the gateway to the EU market, and Swissmedic accepts CE marking for Swiss market access, but a development program must account for both sets of requirements from the outset. The EU AI Act (Regulation (EU) 2024/1689) adds a further set of requirements: an AI-enabled medical device that requires third-party conformity assessment under the MDR is high-risk AI under Art. 6(1) AI Act, because the MDR is listed in Annex I AI Act, and that is expected to trigger the Chapter III AI Act requirements alongside the MDR obligations, though the precise interaction between the two regimes remains subject to Commission guidance.18Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act) [2024] OJ L 2024/1689; Annex I, Section A lists medical devices (MDR) and IVDR as high-risk product legislation. Switzerland has no equivalent AI legislation, and the AI Act's own regulatory sandbox provision (Art. 57 ff. AI Act) creates EU-territory mechanisms from which Swiss-based companies are excluded unless they have EU establishments. The European Health Data Space (Regulation (EU) 2025/327), with phased implementation from 2027, will add interoperability and data governance requirements that bear on how a product is designed.19Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space (EHDS), OJ L 2025/327.
No statutory sandbox existed as of October 2025, and whether a more permissive framework will emerge is open. For companies with longer development timelines, the question is whether market entry strategy should assume the rules in force at the time of filing or anticipate liberalization, and the answer depends on risk tolerance, competitive dynamics, and how the company would respond if anticipated liberalization does not materialize or takes a different form than expected. The phased EU deadlines discussed above are collated on GAWEL Legal's regulatory tracker.
The retinal imaging startup that opened this analysis faces questions that do not resolve themselves through general guidance. The product likely requires conformity assessment as a medical device, but the classification analysis requires examination of the specific intended purpose and claims. Regulatory engagement can clarify requirements, but its answers will be specific to this product's design and clinical positioning. Cantonal pilot programs may accelerate evidence generation, but availability depends on the product category and program capacity at the time of application. The 18–24 month timeline the founders estimated looks optimistic rather than conservative when measured against the Notified Body queue described above, and how far it will stretch depends on classification, Notified Body choice, and clinical positioning.