Guide · 8 min read

Requirements specification and software development contract in Switzerland: the template for an SME

Katia Ryze, an AI-generated character. Article prepared with AI and reviewed by the Ryze Systems team·6 October 2026

A good requirements specification for an SME fits into eight sections and a few pages. A good contract settles four points before the first day of work: who owns the source code, what you get back if the provider stops, where the data is hosted, and who answers for its protection. In Switzerland, paying for a development does not automatically make you the holder of the rights to the code: it has to be written down.

This guide covers Swiss law only. It gives the general framework and points to the legal texts. It does not replace legal advice: have your contract read by a lawyer before you sign. If your contract is governed by the law of another country, different rules apply.

The requirements specification template in eight sections

Write it in your own words, not in those of an IT specialist. The aim is for three different providers to understand the same thing.

1. The problem. What costs time or money today, with a real example from last week.
2. The users. Who will use it, how many people, in the office or in the field, on which device.
3. The expected actions. One sentence per action: “the technician closes a job from their phone”, “the accepted quote becomes an invoice without re-entry”.
4. The data. What already exists (files, current tool), what has to be migrated, what is personal or sensitive.
5. The tools to connect. Accounting, email, calendar, telephony. Name them with their version.
6. The rules. Who sees what, who approves what, the special cases you already know.
7. What is out of scope. The most useful section for avoiding misunderstandings about the price.
8. The success criteria. How you will know, at delivery, that it conforms: three to five simple tests you will run yourself.

Add your desired schedule and your budget if you have one. Hiding the budget does not lower prices; it only brings in quotes that cannot be compared. To read those quotes, see custom software cost in Switzerland.

Who owns the source code?

The Swiss Copyright Act (CopA) says three simple things. Computer programs are protected works (Art. 2 para. 3). The author is the natural person who created the work (Art. 6). Copyright can be assigned, but the transfer of one right does not include the others, and receiving a copy of the work does not give you the copyright (Art. 16).

The practical consequence: receiving the files is not enough. Without a clause, you may have software that works and no right to have it modified by someone else. Art. 17 CopA does provide that the employer exercises the rights to software created by its employee, but that rule concerns the employment relationship, not the one between a client and an external provider.

What the clause must say

1. Which rights you receive: a full assignment, or a licence, and in that case with which limits.
2. On what: the code written for you, and separately the components reused by the provider or the open-source software, with their licence.
3. When: at each milestone payment rather than only at the end.
4. In what form: complete source code in a repository you have access to, with the documentation to install it.

A useful detail: the person entitled to use a piece of software may make a backup copy of it, and the contract cannot forbid this (Art. 24 para. 2 CopA).

The contract points to check

On price: with a fixed price, the contractor carries out the work for the agreed sum (Art. 373 of the Swiss Code of Obligations). As long as the work is not finished, the client may withdraw from the contract by paying for the work done and fully indemnifying the contractor (Art. 377). A mandate, on the other hand, can be revoked at any time, with compensation if the revocation comes at an inopportune time (Art. 404). How your contract is classified depends on what it promises: one more reason to have it reviewed.

What happens if the provider stops?

This is the question people ask too late. The law does not hand you the code the day your provider closes. What protects you is what you already hold. Ask for four things, from the start and at every stage:

1. read access to the code repository, in your name;
2. the installation documentation, tested by someone other than its author;
3. hosting and domain name accounts opened in your name, or transferable without the provider’s consent;
4. a regular export of your data in a readable format.

With these four items, changing provider is a choice. Without them, it is a rebuild. We develop this point in proprietary infrastructure vs AI agency.

Hosting and Swiss data protection: what the contract must provide for

If the software contains data about customers or employees, the Swiss Federal Act on Data Protection (FADP) applies. Three articles directly concern your contract.

1. Art. 9, processing by a processor. You may entrust processing to a provider if a contract provides for it. You must make sure the provider can guarantee data security, and the provider may not sub-contract in turn without your prior authorisation.
2. Art. 7 and 8, design and security. Data protection must be planned from the design stage, with technical and organisational measures appropriate to the risk.
3. Art. 16, abroad. Personal data may be disclosed abroad only if the state concerned offers adequate protection, or if safeguards such as standard clauses are in place.

The list of recognised states is in Annex 1 of the Data Protection Ordinance, as the Federal Data Protection and Information Commissioner (FDPIC) explains. So have the hosting country and the list of sub-processors written into the contract. This guide covers the Swiss rules only. For the other Swiss obligations, see the Swiss data protection act and CRM: what SMEs need to know.