Regulate AI or build AI: What Swiss SMEs learn from Jensen Huang
In short
Swiss SMEs should use the EU AI Act deadlines to build AI capability instead of waiting for regulatory clarity. Jensen Huang's 'You can't regulate what doesn't exist' is not anti-regulation; it is a prioritisation: build applications first, regulate precisely. This is the core lesson.
What Merz asked and how Huang answered
At the Invest in Germany Summit in Berlin, Chancellor Friedrich Merz asked NVIDIA CEO Jensen Huang how Europe should regulate AI. Merz framed the dilemma precisely: no regulation is not the right answer, too strict regulation also not. Huang responded with three pillars, not only the sentence that has been quoted since. For a deeper European view on innovation versus regulation, the Swiss AI Podcast is a useful companion.
Three pillars, not just a soundbite
- Safety technology must come first: 'Safety is not hopes and dreams. Safety is technology and engineering.'
- Companies need best practices and deep methodology before rules can work.
- Regulate applications, not the base technology: 'Regulating the internet is hard, but regulating internet applications is not so hard.'
What this means for Swiss SMEs
For Swiss SMEs the message is clear: regulation is the tail, not the dog. The greatest competitive risk is not a compliance fine; it is falling behind because competitors build AI capability while you wait for regulatory clarity. This argument aligns with the broader European discussion on speed and open source, covered in the Swiss AI Podcast.
EU AI Act deadlines: time to build, not wait
The high-risk obligations of the EU AI Act apply to most SME use cases only from December 2027 or August 2028. That period is for building, not waiting. The relevant milestones at a glance:
- 2 February 2025
- Prohibitions and AI literacy obligations apply
- 2 August 2025
- General purpose AI model obligations apply
- 27 July 2026
- AI Omnibus in force: SME relief extended to companies up to 750 employees or 150 million euro revenue
- 2 August 2026
- EU AI Act fully applicable
- 2 December 2026
- Prohibition of nudify and CSAM apps
- 2 December 2027
- High-risk obligations Annex III, including biometrics, education, employment
- 2 August 2028
- High-risk obligations Annex I, product-related
Why compliance burdens are manageable for AI users
For an SME that uses AI rather than builds models, the obligations are limited: they concern the application, meaning data, transparency and human oversight, not the model itself. Shadow AI, when channeled rather than only banned, creates the data foundation for clean governance.
Building AI does not mean training your own models
In most SMEs, building means orchestrating productive use cases, connecting data sources and automating processes. You do not need to develop the technology yourself; you can rent the capability. With AI outsourcing, a partner carries orchestration and governance, so you stay immediately operational and independent of any single vendor. Regulation becomes a by-product of a functioning system, not a precondition.
The first step
Use the time until December 2027 for controlled productivity applications. Start with an internal assessment and a few pilot processes that you can outsource without model risk. Compliance maturity comes from application, not from waiting.
Conclusion: regulation is the tail, not the dog
Huang's answer to Merz is not a case against rules. It is a priority decision: build the application first, then regulate precisely. Swiss SMEs should adopt exactly that order. Those who start now with manageable, governed AI projects will not face compliance panic in 2027; they will have a competitive head start.
Frequently asked questions
- Do Swiss SMEs have to comply with the EU AI Act at all?
- Yes, if they place AI systems on the EU market or operate them there. Purely internal use in Switzerland is not directly covered, but exports, EU business and customer requirements make the Act practically relevant. Sound AI governance is also a quality discipline.
- What does high risk mean for typical SME use cases?
- Most office and process applications such as email classification, document analysis or chatbots are not high risk. High risk includes AI in biometrics, education or employment under Annex III, mostly relevant from December 2027.
- Should we wait with AI projects until the rules are clear?
- No. The deadlines leave room to build. Waiting costs competitive ground. Better to start controlled pilot projects with governance and outsourcing, then compliance obligations are no shock.
- How can an SME keep AI compliance practical?
- By regulating applications rather than models: document data sources, ensure transparency towards users and define human oversight. An external AI partner can carry orchestration and governance.
Sources
Chris Jon Graf · AI Strategist & CEO
For over 15 years, Chris Jon Graf has built productive Swiss software platforms and advised executive teams on the strategic deployment of artificial intelligence. Would you like to evaluate this topic for your company?