Scenario sources and scope
The Monday queue is a fictional training scenario. The sources below show which Swiss and EU data protection and AI rules its situations touch. They are general information, not legal advice; a qualified professional should confirm how they apply to your organisation. Sales and consumer law on refunds for damaged goods and US law are outside scope.
European Union · Regulation (EU) 2024/1689 (AI Act), Article 50(1)
Providers must design AI systems that interact directly with people so that those people are informed they are dealing with an AI system, unless this is obvious in the context. In this story the AI answers routine order questions directly on some routes, so this duty may apply there. A qualified professional should confirm who the provider is and how the duty applies.
Applies from 2 August 2026 · Source checked: 26 September 2026 · Legal review pending
Read the text: Regulation (EU) 2024/1689 (AI Act), Article 50(1)European Union · GDPR, Articles 5, 6, 9, 13 and 35
Assess the data use for this deployment, including whether a data protection impact assessment is required. Human review cannot replace a lawful basis.
Applies from 25 May 2018 · Source checked: 26 September 2026 · Legal review pending
Read the text: GDPR, Articles 5, 6, 9, 13 and 35European Union · GDPR, Articles 5(1)(c), 25 and 32
Limit retrieval to authorised data and purpose.
Applies from 25 May 2018 · Source checked: 26 September 2026 · Legal review pending
Read the text: GDPR, Articles 5(1)(c), 25 and 32European Union · GDPR, Articles 12, 17 and 22
Handle the deletion request through a working rights route and respond without undue delay. Decisions based solely on automated processing need a separate check under Article 22.
Applies from 25 May 2018 · Source checked: 26 September 2026 · Legal review pending
Read the text: GDPR, Articles 12, 17 and 22Switzerland · Federal Act on Data Protection (FADP), Articles 6, 19 and 22
Assess the Swiss data protection principles, the duty to inform and whether a data protection impact assessment is required. Do not import a GDPR checklist as the entire Swiss analysis.
Applies from 1 September 2023 · Source checked: 26 September 2026 · Legal review pending
Read the text: Federal Act on Data Protection (FADP), Articles 6, 19 and 22Switzerland · Federal Act on Data Protection (FADP), Articles 6 to 8
Limit personal data to what is necessary and protect the retrieval path.
Applies from 1 September 2023 · Source checked: 26 September 2026 · Legal review pending
Read the text: Federal Act on Data Protection (FADP), Articles 6 to 8Switzerland · Federal Act on Data Protection (FADP), Articles 19, 21, 25 and 32
Inform people when collecting their data, answer access requests and handle requests to delete data. Decisions based solely on automated processing need a separate check under Article 21; a review is meaningful only if the reviewer can change the outcome.
Applies from 1 September 2023 · Source checked: 26 September 2026 · Legal review pending
Read the text: Federal Act on Data Protection (FADP), Articles 19, 21, 25 and 32Voluntary framework · NIST AI Risk Management Framework: Govern, Map, Measure, Manage
Assign owners, test outcomes and manage failures. The NIST framework is voluntary here.
No application date · Source checked: 26 September 2026 · Voluntary guidance
Read the text: NIST AI Risk Management Framework: Govern, Map, Measure, ManageFictional company · Fictional authority, workload and source policy
The exact staffing and routing rules are company policy in this exercise.
No application date · Source checked: 16 September 2026 · Authored for this exercise