# Regulate AI or build AI: What Swiss SMEs learn from Jensen Huang

> Author: Chris Jon Graf (AI Strategist & CEO)
> Updated: 2026-10-27
> URL: https://ai-outsourcing.ch/insights/regulate-ai-or-build-ai-what-swiss-smes-learn-from-jensen-huang

## Summary

Swiss SMEs should use the EU AI Act deadlines to build AI capability instead of waiting for regulatory clarity. Jensen Huang's 'You can't regulate what doesn't exist' is not anti-regulation; it is a prioritisation: build applications first, regulate precisely. This is the core lesson.

## What Merz asked and how Huang answered

At the Invest in Germany Summit in Berlin, Chancellor Friedrich Merz asked NVIDIA CEO Jensen Huang how Europe should regulate AI. Merz framed the dilemma precisely: no regulation is not the right answer, too strict regulation also not. Huang responded with three pillars, not only the sentence that has been quoted since. For a deeper European view on innovation versus regulation, the [Swiss AI Podcast](https://www.ki-podcast.ch/eu-ai-act-innovation-vs-regulierung-europa) is a useful companion.

### Three pillars, not just a soundbite

1. Safety technology must come first: 'Safety is not hopes and dreams. Safety is technology and engineering.'
2. Companies need best practices and deep methodology before rules can work.
3. Regulate applications, not the base technology: 'Regulating the internet is hard, but regulating internet applications is not so hard.'

## What this means for Swiss SMEs

For Swiss SMEs the message is clear: regulation is the tail, not the dog. The greatest competitive risk is not a compliance fine; it is falling behind because competitors build AI capability while you wait for regulatory clarity. This argument aligns with the broader European discussion on speed and open source, covered in the [Swiss AI Podcast](https://www.ki-podcast.ch/europa-ki-strategie-eu-ai-act-accenture).

## EU AI Act deadlines: time to build, not wait

The high-risk obligations of the EU AI Act apply to most SME use cases only from December 2027 or August 2028. That period is for building, not waiting. The relevant milestones at a glance:

| | |
| --- | --- |
| **2 February 2025** | Prohibitions and AI literacy obligations apply |
| **2 August 2025** | General purpose AI model obligations apply |
| **27 July 2026** | AI Omnibus in force: SME relief extended to companies up to 750 employees or 150 million euro revenue |
| **2 August 2026** | EU AI Act fully applicable |
| **2 December 2026** | Prohibition of nudify and CSAM apps |
| **2 December 2027** | High-risk obligations Annex III, including biometrics, education, employment |
| **2 August 2028** | High-risk obligations Annex I, product-related |

## Why compliance burdens are manageable for AI users

For an SME that uses AI rather than builds models, the obligations are limited: they concern the application, meaning data, transparency and human oversight, not the model itself. Shadow AI, when channeled rather than only banned, creates the data foundation for clean governance.

## Building AI does not mean training your own models

In most SMEs, building means orchestrating productive use cases, connecting data sources and automating processes. You do not need to develop the technology yourself; you can rent the capability. With AI outsourcing, a partner carries orchestration and governance, so you stay immediately operational and independent of any single vendor. Regulation becomes a by-product of a functioning system, not a precondition.

> **The first step**
>
> Use the time until December 2027 for controlled productivity applications. Start with an internal assessment and a few pilot processes that you can outsource without model risk. Compliance maturity comes from application, not from waiting.

## Conclusion: regulation is the tail, not the dog

Huang's answer to Merz is not a case against rules. It is a priority decision: build the application first, then regulate precisely. Swiss SMEs should adopt exactly that order. Those who start now with manageable, governed AI projects will not face compliance panic in 2027; they will have a competitive head start.

## FAQ

### Do Swiss SMEs have to comply with the EU AI Act at all?

Yes, if they place AI systems on the EU market or operate them there. Purely internal use in Switzerland is not directly covered, but exports, EU business and customer requirements make the Act practically relevant. Sound AI governance is also a quality discipline.

### What does high risk mean for typical SME use cases?

Most office and process applications such as email classification, document analysis or chatbots are not high risk. High risk includes AI in biometrics, education or employment under Annex III, mostly relevant from December 2027.

### Should we wait with AI projects until the rules are clear?

No. The deadlines leave room to build. Waiting costs competitive ground. Better to start controlled pilot projects with governance and outsourcing, then compliance obligations are no shock.

### How can an SME keep AI compliance practical?

By regulating applications rather than models: document data sources, ensure transparency towards users and define human oversight. An external AI partner can carry orchestration and governance.

## Sources

- [Merz fragt Jensen Huang nach KI-Regulierung (LinkedIn-Quelle Alvin Foo)](https://www.linkedin.com/posts/alvinfsc_german-chancellor-merz-asks-jensen-huang-activity-7518143963715751936-YtVh)
- [Transcript: Merz x Jensen Huang — AI Safety, Regulation & Germany's Industrial Future](https://singjupost.com/transcript-merz-x-jensen-huang-ai-safety-regulation-germanys-industrial-future/)
- [EU AI Act — Shaping Europe's digital future (Europäische Kommission)](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- [AI Act Anwendungs-Zeitplan (EUR-Lex, Europäische Kommission)](https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html)