Apertus, One Year On

On 2 September 2025, EPFL, ETH Zurich and the Swiss National Supercomputing Centre released Apertus, Switzerland's first large-scale language model. The name is Latin for "open", and it was chosen carefully. Plenty of companies had released model weights by then. Very few had released everything else: the training data pipeline, the code, the recipes, the intermediate checkpoints and a detailed account of how each decision was made.

The launch drew two kinds of reaction. One celebrated a rare example of a public institution building foundational AI in the open. The other compared Apertus's benchmark scores with the latest commercial models and found it wanting. Both reactions missed what makes the project interesting. Fourteen months later, with a major update shipped and real deployments in production, it is possible to judge it on its own terms.

What Apertus is

Apertus comes in two sizes, 8 billion and 70 billion parameters. The original release was pretrained on around 15 trillion tokens covering well over a thousand languages, with roughly 40 percent of the data in languages other than English. That multilingual emphasis is deliberate: the model is meant to serve a country with four national languages and a world where most AI systems are tuned overwhelmingly for English. Swiss German and Romansh are explicitly in scope.

It was trained on the Alps supercomputer at CSCS in Lugano, which runs on more than ten thousand Nvidia Grace Hopper chips, and released under the Apache 2.0 licence, one of the most permissive available. Anyone can download it, run it, modify it and build commercial products on it.

The defining feature, though, is not the size or the licence. It is the data.

Built to be auditable

Apertus was trained only on publicly available data, and the team went further than most in respecting the wishes of the people who published it. Websites that had opted out of AI crawling through their robots.txt files as of January 2025 were excluded not just from new crawls but retroactively from older crawls going back years. Training data was filtered to remove personal information, toxic content and material flagged as non-permissive. The training itself used a technique designed to limit the model's tendency to memorise and reproduce passages verbatim, which matters both for copyright and for privacy.

The developers also publish a filter for model outputs that reflects data protection deletion requests they have received, and they advise operators to apply it periodically. It is an imperfect mechanism, since information learned during training cannot simply be erased from the weights, but it is a serious attempt to take data protection law seriously at the model level, something almost no other developer has tried.

All of this is documented. The project publishes the scripts needed to reconstruct the training data, the training and evaluation code and the checkpoints, and its technical report was accepted at ACL 2026, one of the leading venues in the field. In February 2026, an independent assessment by Trinity College Dublin's AI Accountability Lab rated the transparency of Apertus's training data summary among the best in the industry.

For anyone who needs to explain an AI system to a regulator, a works council, a data protection authority or a court, this is the difference between "the vendor says it's fine" and "here is exactly what it was trained on, and how".

From release to infrastructure

The first months after launch were about ecosystem rather than capability. Apertus was available from the start through Swisscom's sovereign AI platform, through Hugging Face downloads and through the Public AI inference service hosted in Swiss jurisdiction. Over 2026 it spread considerably further:

• Government use. In March 2026, the Canton of Ticino put an in-house translation system for official documents into production, built on a version of Apertus fine-tuned by the Swiss company Artificialy. It is the first public-sector deployment of the model.
• Smaller models. In June 2026, the project released Apertus 1.1 Mini, a collection of distilled and quantised models for offline and resource-constrained use.
• Mainstream consumer access. Since September 2026, Proton has offered Apertus 1.5 as a selectable model in its Lumo assistant, including on the free plan. Infomaniak, Public AI and a growing list of Swiss and European hosts offer it by API, and it is also available through the major international cloud platforms for those who want it there.
• Business engagement. A Swiss AI SME Circle has connected companies with the project's engineers. The recurring themes, according to the project, have been demand for data sovereignty, practical integration paths and independence from hyperscalers.

Apertus 1.5

On 24 July 2026 the team released Apertus 1.5, a continued-pretraining update to both model sizes. It brought four substantial changes: a context window four times larger, at 262,144 tokens; an optional reasoning ("thinking") mode; native image understanding, with experimental audio input; and markedly better instruction-following and tool use. The technical paper followed on arXiv in October. Crucially, the update preserved the full-openness commitment: the additional training data and methods are documented to the same standard as the original.

The longer context and better tool use matter most in practice. They make Apertus considerably more useful for document analysis and retrieval-based applications, which is where most organisational AI work actually happens.

What Apertus is not

It would be a disservice to the project to oversell it. Apertus is not competitive with frontier commercial systems on mathematics, advanced coding or complex reasoning, and its developers have never claimed it was. Even among open-weight models, the strongest releases of late 2026 are many times larger and score well above it on general benchmarks.

Some of the early criticism was overstated or misplaced: comparing a 70-billion-parameter, fully documented public research model with trillion-parameter commercial systems trained on undisclosed data is not a like-for-like test. But the underlying tension is real. Strict data practices mean less training data. Public funding means smaller compute budgets than the largest labs. Openness about every decision means competitors can learn from your work without reciprocating. Apertus has chosen a set of constraints that make it more trustworthy and, almost inevitably, less capable than models that accept none of them.

Why it matters anyway

The case for Apertus does not rest on its benchmark position. It rests on three things that are hard to find elsewhere.

It is a reference point. Apertus demonstrates that a large model can be trained with full transparency and serious respect for data rights, and documents exactly what that costs. That is valuable to regulators, to researchers and to every developer who claims compliance is impossible.

It is genuinely sovereign. Swiss-built, Swiss-trained, Swiss-hosted where desired, permissively licensed and fully documented. For Swiss public institutions, hospitals, banks and law firms, it is one of very few options where every layer of the stack can be accounted for.

It is good enough for a lot of real work. Translation, summarisation, drafting, classification and retrieval over documents do not require frontier reasoning. A well-tuned 70-billion-parameter model with a long context window handles them well, and the 8-billion version runs on a laptop. The Ticino deployment is a small but telling proof.

The test ahead

Apertus 2.0 is in training, planned for 2027 and described as roughly an order of magnitude larger, built to the same standard of transparency. Its first training phase is scheduled to complete in December 2026. That release will answer the question hanging over the project: whether a fully open, publicly funded model can keep pace closely enough with the commercial frontier to remain relevant as the default sovereign option, or whether it settles into a valuable but specialised niche.

Either outcome would be defensible. But the project's ambition is the first, and Switzerland, with its research institutions, its supercomputing capacity and its regulated industries hungry for trustworthy AI, is better placed than most to pull it off.