AI Form Builders — What They Do, and What They Do With Your Data

Every form product now has an AI badge, and the badge means at least four different things. One of them touches nothing but your own words at design time. Another sends every answer your respondents write to a third-party model. They look identical in a feature list, they are priced the same way, and the difference decides whether the feature is a convenience or a disclosure you have not documented.

Four Different Features Wearing One Label

The first three are the ones most products actually ship, and they are genuinely useful: a blank form builder is intimidating, and a prompt gets you to a first draft in twenty seconds. The last two are the ones that need a paragraph in your record of processing and a named sub-processor in your DPA. Vendors rarely draw the line for you, because the badge sells better undivided.

Where the Prompt Goes — and What Happens to It There

Almost no form vendor runs its own models. Your prompt travels to an inference provider, and the properties that matter are the ones nobody puts on the pricing page:

1. Which provider, and where. The form tool may be European while its model provider is not. This is a disclosure abroad in its own right, with its own Art. 16/17 nFADP basis to document — see which form data can legally leave Switzerland.
2. Whether the prompt is stored. Many providers retain prompts for a period for abuse monitoring — commonly 30 days — even when they do not train on them. «Not used for training» and «not stored» are different promises; get both.
3. Whether it is used for training. Read whose commitment it is: the form vendor's, the gateway's, or the model provider's underneath. A chain is only as good as its weakest written promise.
4. Whether a human ever reads it. Abuse review and quality sampling are legitimate processes that put a person in front of your text. Ask.
5. Whether the provider is in your DPA. If it is not named as a sub-processor, either the feature is not being used the way you think, or the paperwork is wrong. See do you need a data processing agreement for your form tool.

How to Read a «We Don't Train on Your Data» Claim

The sentence is now standard, which means it has stopped carrying information. Four things separate a commitment from a slogan:

• Is it in the contract or on the website? A marketing page can be edited on a Tuesday. A DPA cannot.
• Does it cover the whole chain? Vendor → gateway → model provider. Each link needs its own written position, and the weakest one governs.
• Does it apply to your tier? Free and consumer tiers have historically had different training terms from paid and enterprise ones. If the AI feature is on the free plan, read the free plan's terms rather than the enterprise page.
• What is the retention figure? «We don't train» plus «we keep prompts for abuse review» plus no stated period is not a privacy posture, it is an unbounded log.

There is also a structural answer that beats all four: use a model whose operator has no commercial interest in your text, running on infrastructure in your own jurisdiction, on open weights rather than a proprietary frontier model. That is a smaller model with slightly less flair on creative tasks — and for turning «staff feedback form with four rating questions and one free text» into a draft, the difference is invisible.

The Regulatory Layer — Narrower and Sharper Than the Marketing

Automated individual decisions

Art. 21 nFADP requires the controller to inform the data subject of a decision taken exclusively by automated processing that has a legal effect or significantly affects them, and to give them the right to state their position and to have the decision reviewed by a natural person. Art. 22 GDPR is the stricter EU sibling. Neither is triggered by an AI that drafts your form. Both are squarely triggered by an AI that ranks scholarship applicants, filters job applications, or scores an insurance questionnaire. If your AI feature touches answers and feeds a decision, this is the provision to read first.

The EU AI Act, as it actually stands

The timeline moved in 2026 and the movement was uneven, which is exactly why generic advice is unreliable right now. Under the Digital Omnibus on AI agreed in May 2026, the Annex III high-risk obligations were deferred from 2 August 2026 to 2 December 2027, and the Annex I product-related ones from 2027 to 2028. Most of the Art. 50 transparency obligations were not deferred and still apply from 2 August 2026.

For a Swiss company: the AI Act binds you when you place a system on the EU market or when its output is used in the EU, so an EU subsidiary or EU respondents can pull you in. Switzerland has no equivalent statute of its own — the nFADP, sector law and the transparency principle carry the weight domestically.

The Trap Nobody Warns About: Minimisation by Autocomplete

This is the practical risk of AI form generation, and it has nothing to do with where the prompt went. Ask a model for a patient intake form and it will helpfully produce date of birth, insurance number, emergency contact, allergies, current medication and a free-text medical history — because that is what the corpus says such forms contain. Every one of those fields is defensible in a clinic and indefensible in the physiotherapy studio that just wanted to schedule appointments.

A generated form is a plausible average of everything similar that has ever been published. Proportionality under Art. 6 nFADP is not an average; it is a judgement about your purpose. The discipline is simple and it takes two minutes: read the generated draft and delete every field you cannot justify out loud. Generation should be a starting point that saves typing, never an authority on what to ask.

How Schweizerform Does It

Building AI into a zero-knowledge product forces the honest answer, because the architecture removes the option of cheating. We cannot read submissions — so we cannot send them anywhere, whatever a roadmap might want.

• Inference runs in Switzerland. We use Infomaniak's Swiss-hosted AI services with an open-weight model. Infomaniak's published position, as we checked it in July 2026, is that prompts and data stay in Switzerland, requests are not stored or logged, and nothing is used to train third-party models. That is their commitment and you should read it yourself — but it is why they are the provider.
• We never store your prompt. Our usage ledger records the model, token counts, latency, whether the call succeeded, and the length of the prompt in characters. Not its text. The audit log likewise records counts, never content.
• Respondent answers cannot reach a model, structurally. Submissions are encrypted in the respondent's browser under your form's key. The server holds ciphertext. There is no server-side path from a submission to an inference request, and adding one would mean abandoning the encryption model — which we would have to announce, not slip in.
• Translation covers the form, not the responses. What is sent is the question and label text you authored, which was already server-side plaintext because the form is public. Answers are never part of it.
• Injection containment is built in. Your description is framed to the model as data that must never be followed as instructions; the model has no tools; and the generated structure is validated against a fixed catalogue of allowed question types before a form is created. An invalid generation gets one repair attempt and then fails visibly rather than producing something odd.
• Finite on every plan, and switchable off. AI form generation is quota-limited monthly on all plans — including Business, which has a number rather than «unlimited» — with per-user rate limiting, a credit charged exactly once per generation, and a kill switch that disables the feature entirely at the platform level.

The honest limitations: a Swiss-hosted open-weight model is not the largest model on the market, and for elaborate creative writing you would notice. For generating a well-structured form from a plain description in German, French, Italian or English, you do not. And every generated draft still needs the two-minute field review described above — our generator averages the corpus exactly like everyone else's.

Seven Questions for Any AI Form Vendor

The interesting question was never whether a model wrote your form. It is whether a model read your respondents' answers — and nobody puts that on the pricing page.

Bottom Line

AI in a form builder is mostly a drafting convenience, and a good one. It becomes a data protection question at exactly two points: when a model reads what respondents wrote, and when a model's output influences a decision about a person. Everything else — the badge, the sparkle icon, the launch post — is user interface.

So evaluate it in the boring way. Establish whether respondent data ever leaves the encryption boundary. Get the inference provider's name, country and retention period in writing. Check the DPA. And review every generated form for fields you did not actually need, because the fastest way to breach data minimisation in 2026 is to accept an autocomplete without reading it.