AI Form Builders Compared

«AI form builder» is a badge worn by four quite different features, and lumping them together is how buyers end up surprised. Three of them — generating a form from a prompt, translating a form, suggesting fields — operate at design time, on text you wrote, before anybody has answered anything. Two of them — conversational forms that improvise the next question, and analysis of submitted answers — operate at run time, on data your respondents provide. The distinction is not a nuance. It is the whole procurement question.

So one question sorts this entire category: does respondent data ever reach a model? For a marketing lead-capture form the honest answer is that it barely matters. For a patient intake form, an HR grievance channel or a client onboarding questionnaire, it decides whether an inference provider — usually American — becomes a recipient of special-category data, and whether you now have a sub-processor you never listed. This page takes Typeform, Jotform, Fillout and ourselves through that line, then through model provider and jurisdiction, training commitments, and price.

The Sorting Question: Does Respondent Data Ever Reach a Model?

Sort every AI feature you are offered into these two buckets before you evaluate anything else about it.

• Design time — your own text. Prompt-to-form generation, translating a form into other languages, field and wording suggestions, template search. The only content leaving your organisation is the text you authored, which is already visible to the platform. Low stakes, real time savings.
• Run time — your respondents' data. Conversational or «formless» interfaces where a model reads each answer to decide what to ask next; AI agents that chat, call or message respondents; sentiment and theme analysis over free-text responses; AI scoring or ranking of applicants. Here the model provider sees what people submitted.

Both are legitimate products. But only the second changes your data protection analysis: it adds a recipient, usually in a third country, to a processing operation whose data subjects are not your staff and have not been told. The blog-side treatment of this, including what our own AI features do and do not touch, is in AI form builders and your data.

The Four Products

Typeform — AI throughout, and Formless as the run-time product

Typeform has pushed AI further into the respondent experience than anyone else in this comparison. Its Formless product is explicitly a two-way conversation: the form asks a question, reacts to the answer, and can answer questions the respondent asks back, with natural-language analysis afterwards turning the conversation into structured data. Typeform's own announcements describe Formless as built on OpenAI models — GPT-3.5 Turbo and GPT-4. Design-time AI features sit alongside it, and Typeform also markets optimisation suggestions derived from patterns across the forms on its platform.

That is a genuinely impressive product and it is unambiguously run-time: by design, respondent answers are what the model reads. Combine that with Typeform's hosting picture — main servers on AWS in Virginia, EU data centre on higher custom tiers — and a Swiss organisation running a sensitive intake on Formless has two cross-border questions rather than one. Our per-feature view of the platform is in the Typeform comparison.

Jotform — AI Agents that talk to your respondents

Jotform's AI story is the broadest in the category. Alongside prompt-to-form generation, AI Agents converse with respondents in real time — via chatbot, voice, phone, WhatsApp, Messenger, Instagram and SMS. Jotform names its providers, which is more than most: OpenAI's GPT-4 as the standard model, and Google's Gemini models via Vertex AI for HIPAA-enabled accounts, chosen specifically because Google offers a Business Associate Agreement. That is an unusually candid piece of documentation and it tells you something important — the model provider is a sub-processor whose contractual posture determines what regulated data you may put through it.

On training, Jotform states that your form and form-field content is used to train your own personal AI Agents while names and other personal data are not used for that purpose, and that data collected through AI Agents is not used to improve Jotform's services or for other purposes. Read those two sentences together and note what they scope: they are about Jotform's use, not about eliminating the model provider from the path. Detail on the platform generally is in the Jotform comparison.

Fillout — AI as the way you build, not the way people answer

Fillout has made AI conversation the primary interface for creating forms: you describe what you need and iterate in natural language rather than dragging fields. Positioned that way it is largely a design-time product, which is the safer half of this category — the text going to a model is text you wrote. If you are evaluating Fillout, the question to ask is whether any respondent-facing AI features are enabled on your plan, because the design-time/run-time line is what determines your sub-processor picture, not the marketing category.

Schweizerform — AI at design time only, by construction

We use AI for two things: generating a form from a prompt, and translating a form's own text into EN, DE, FR and IT. Both operate on owner-authored form-definition text, which is already stored in plain text on our server so the form can render. Inference runs on Infomaniak AI Services, processed in Switzerland — the same provider as our hosting, storage and mail — on an open-weight model. Prompt text is never persisted: the usage ledger records the prompt's length, token counts, latency and whether the call succeeded, not its content.

The part that is not a policy is this: respondent answers cannot reach a model on our platform, because we do not have them in readable form. Submissions are encrypted in the respondent's browser and the server holds ciphertext. There is no conversational form, no AI answer analysis and no AI scoring — not because we disapprove, but because a zero-knowledge architecture makes them impossible to build. That is the trade, stated plainly. The mechanism is in zero-knowledge architecture explained.

Head-to-Head

The third column is the one to read first, and the fourth is the one procurement forgets. An AI feature adds a model provider to your processing chain; that provider is a sub-processor, and it belongs in your record of processing and in your Art. 16 nDSG transfer analysis exactly like a hosting provider does.

Model Provider and Jurisdiction — the Sub-Processor Nobody Lists

When a form platform adds AI, it rarely builds the model. It calls one. That call is a disclosure to a third party, and if the provider is American it is a disclosure abroad under Art. 16 nDSG requiring a transfer mechanism — adequacy under Annex 1 DSV, standard data protection clauses, or an Art. 17 exception. The Federal Council recognised the United States as adequate for firms certified under the Swiss–U.S. Data Privacy Framework, with the ordinance amendment in force from 15 September 2024, so the mechanism frequently exists. What does not follow automatically is that anyone wrote it down.

Jotform's disclosure is the useful worked example here, and we credit it: naming GPT-4 as standard and Gemini via Vertex AI for HIPAA accounts tells a buyer exactly which entity sees what, and why the swap exists — because one of them signs a BAA. That is the level of specificity to demand from every vendor in this category, including us. Our answer: Infomaniak, in Switzerland, on an open-weight model, and only ever with form-definition text. The full picture of who is Swiss-hosted is in form and survey tools hosted in Switzerland.

Training-Data Commitments — Read What They Scope

Almost every vendor now says something reassuring about training, and most of those statements are true. The skill is in reading what they cover. «We do not use your data to train our models» typically means the platform does not — it says nothing about what the model provider's terms permit, unless the platform also states which API tier it uses. «Your content trains only your own assistant» means content is being used for training, in a scoped way. «We do not sell your data» is a different promise again and one nobody was worried about.

1. Which of your data — form definitions, respondent answers, uploaded files, or all three?
2. Used by whom — the platform, the model provider, or both?
3. Retained for how long at the model provider, and can that retention be switched off?
4. Is the commitment in the contract you sign, or on a marketing page that changes without notice?
5. What happens to the commitment when the platform swaps model providers, which several have done?

For completeness, our own position stated the same way: our provider Infomaniak publishes a no-training, no-logging, stays-in-Switzerland commitment, and we cite that as their published commitment, checked in July 2026 — not as an audit finding of ours. The only content we send is form-definition text, and prompt text is not persisted on our side.

Minimisation by Autocomplete — the Risk Nobody Markets

There is a second, quieter problem with AI form generation that has nothing to do with sub-processors. Ask a model for «a patient intake form» and it will produce a plausible average of every patient intake form it has ever seen: date of birth, insurance number, emergency contact, a free-text medical history, sometimes an ID number. Each of those fields is normal in some practice. Whether it is proportionate in yours is a judgement under Art. 6 nDSG, and an average is not a judgement.

The result is a quiet expansion of collection: fields nobody decided to ask for, now stored, secured, retained, exported and eventually deleted. Treat a generated form as a first draft whose main job is to be cut down — delete every field you cannot name a purpose for, before publishing. This matters most in exactly the verticals where AI generation is most tempting: health, HR and applications. Pair this with collecting health data in forms, whose central advice — ask for the accommodation, not the condition — is the fastest way to shorten a generated form.

The Legal Layer: Automated Decisions and the AI Act

Two frameworks get invoked in this category and both are usually misapplied. Art. 21 nDSG and Art. 22 GDPR concern automated individual decisions with legal or similarly significant effects — they are triggered by AI scoring or ranking people, not by AI drafting a questionnaire. If your AI feature sorts applicants, flags claims or prioritises leads by predicted value, you are in that territory and owe information and, in the Swiss case, the right to be heard by a human. If it wrote your field labels, you are not.

The EU AI Act matters mainly through its transparency duties: people should know when they are interacting with an AI system rather than a person, which is precisely the situation a conversational form or a voice agent creates. The timeline has moved — under the Digital Omnibus on AI, provisionally agreed on 7 May 2026, the Annex III high-risk obligations shift from 2 August 2026 to 2 December 2027 (Annex I from 2027 to 2028), while most Art. 50 transparency obligations still apply from 2 August 2026. Treat those dates as live: they have already moved once. Switzerland has no equivalent statute, but Swiss companies serving EU users are in scope.

Pricing and Credits

AI features are metered almost everywhere, usually as credits, generations or agent conversations, and usually gated by plan tier. Two things are worth checking before you build a workflow on them: whether the meter counts creations or respondent interactions — a conversational form consumes budget every time somebody answers, which scales with your traffic rather than with your team — and what happens when the allowance runs out mid-month, which is a very different failure for a live respondent-facing agent than for a form builder.

Our own model is deliberately boring: AI form generation is metered as a monthly allowance on every plan, the allowance is a finite number on Business too rather than «unlimited», and there is a platform kill switch for the AI features. Because our AI is design-time only, the meter tracks how many forms you create, never how many people answer them. Plan limits are on the pricing page.

Which One Fits Which Job

Choose Typeform or Jotform when

• You want a conversational experience and the data is ordinary business data: marketing qualification, product feedback, event interest, customer support triage
• The respondent-facing AI is the point — the completion rate or the qualification quality is what you are buying
• You can name the model provider in your record of processing and document the transfer basis, and you have told respondents they are talking to an AI

Choose Fillout when

• You want the build experience to be conversational but the respondent experience to be a normal form
• Speed of creation is the bottleneck rather than respondent engagement
• You verify, on your plan, that no respondent-facing AI feature is silently enabled

Choose Schweizerform when

• The submissions are sensitive and «which model provider saw this» must never become a question you have to answer
• You want AI to save the setup time — a form from a prompt, published in four languages — without touching the data it collects
• Swiss processing of the AI calls matters, not only Swiss storage of the data
• You are in a regulated setting where the honest answer to «can your vendor's AI read patient answers» has to be no, structurally

The Bottom Line

Typeform and Jotform have built the more ambitious AI products, and for a lead form or a customer-feedback conversation they will outperform us on engagement. We are not competing on that, and we will not pretend to. What we did was draw the line at design time and make it structural: AI writes and translates your questions, in Switzerland; nothing on this platform can read an answer, including us and including a model.

If you take one thing from this page, make it the sorting question. Ask each vendor, in writing, whether respondent content reaches a model provider, which one, and where. The answer tells you more about a platform than every AI feature list on its website combined.