AI strategy for SMEs: the questions to answer first

Where an AI strategy really begins

Whoever starts by choosing a tool has already decided their AI strategy without noticing. An AI strategy sets out what you use AI for, on which foundation, and what that costs over the years. For a Swiss SME, it comes down to a handful of decisions for senior management: where AI creates value, how tightly you bind yourself to a provider, which data is sensitive, and who takes over the operation.

In brief

• Sort your data by confidentiality first, then the tools. Every data class needs its own degree of sovereignty, that is, of control over model, operation and data, from public text to case files.
• For data covered by professional secrecy?Professional and official secrecyThe criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act., the Financial Market Supervisory Authority FINMA or official secrecy, rules prescribe some of these decisions. The weighing falls away, and you implement the requirement.
• The article poses nine questions for senior management, for example on value, on the most sensitive data and on cost over ten years. Half a day is enough for the answers, and you do not need a ready-made framework.
• The nine answers together form a profile of your company. That profile shows where a convenient standard service is enough and where the effort of sovereign operation pays off.

Most papers called an “AI strategy” are tool lists: Microsoft Copilot here, a chatbot there. That order is backwards, because then the tool dictates the strategy. In our foundational article on sovereign AI↗Sovereign AI · Part 1What sovereign AI actually means for Swiss companiesIf you sell discretion, you have a problem the moment a client asks where your data goes when you use AI. Sovereign AI answers that question, and the degree of control can be set like a dial.Read article, we described sovereignty as a mixing desk. Each dial stands for an area in which you can keep control: model, operation and data. You set the dials according to how confidential your data is. Where those dials should sit follows from a few questions about your business.

This is the second part of our series on sovereign AI. The first named the dials, this one shows how you determine their position for your company.

Nine questions for senior management

Take an hour with senior management and work through the following questions in order. Together they set where your dials sit.

Without a concrete project, every further question stays theoretical. Start with the work that takes too long today or does not get done, for example writing quotes, answering support requests or searching through old documents. Only once it is clear what AI should work on can you say which data it touches and how sovereign it needs to run.

Work through the question concretely, data type by data type. For most companies, the answer turns out smaller than expected. Product copy, website content and internal notes are uncritical. Sensitive data includes HR files, client data, contracts, and health or case data. Sovereign operation pays off for this small part, and only for it. The large remainder may run comfortably and cheaply on a standard service.

This question often takes the pressure off. If mail, documents and identity have long sat with Microsoft and are meant to stay there, there is little reason not to set up AI there too. Breaking out of your own ecosystem for a single use case rarely justifies the effort. The real question then becomes what this path costs over ten years, and how easily you could leave it again later.

As long as AI helps draft an email faster, an outage is harmless. If it sits inside a core process your operation depends on, it becomes expensive. A provider that discontinues a model, doubles the price, or quietly swaps it for a weaker one then leaves you in a difficult position. Open weights?Open weightModels whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in., that is, freely available model files, and open software end that dependence. The model keeps running on your infrastructure even if the provider retires it or raises the price.

For a trust office, a law firm or a medical practice, confidentiality is the product. If the same client data ends up with a US corporation via an AI service, the story no longer holds together, and a client who asks notices immediately.

You remain sovereign with a partner too. What matters is that the contract records who operates which part, and that you could switch if it came to that. A small SME without its own IT sensibly hands the model, hosting and maintenance to a Swiss partner. A company with a strong team of its own runs more of it itself.

Name one person who is responsible. Without one, even a good pilot project comes to a standstill after the first few weeks. Employees also need a protected test space where a failed prompt?PromptThe input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost., that is, an instruction to the AI, has no consequences. The EU AI Act↗Law & Regulation · Part 5EU AI Act Switzerland: role first, then dutiesMost Swiss companies owe the EU AI Act almost nothing. The provider role gets expensive, that is, whoever ships an AI tool under its own name. Whoever lands in it usually notices too late.Read article requires adequate AI competence in the team anyway. The right training also helps AI deliver real benefit.

An AI system costs more to run than to acquire. Over the years, what counts are the price per token?TokenThe smallest billing unit of a language model; a word is roughly one to three tokens. Providers charge per million tokens, separately for input and output. (the unit of text that providers bill by), the utilisation of the system, and the cost of leaving a provider again. Our article on LLM cost↗Buying inference · Part 1What LLMs really cost: the price per token is misleadingComparing price lists is time wasted: token consumption, cache hit rate and quantisation decide what you actually pay.Read article works through how misleading the raw model price can be.

For some data, the answer is not a matter of weighing options. Whoever is bound by lawyer, doctor or banking secrecy↗Law & Regulation · Part 3Professional secrecy and AI: what may go to the cloud'That does not work for us' is often the answer to AI in law firms and medical practices. The criminal-law article on professional secrecy (Art. 321 of the Swiss Criminal Code) is drawn more narrowly, and most of daily work falls outside it entirely.Read article or falls under FINMA requirements already has some dials set by the rules. These cases belong at the start of the strategy: whoever discovers them only after choosing a tool has to plan the architecture again.

What your answers add up to

Lay the answers side by side, and a profile emerges. A trade business lands on the left for most dials (convenient standard service), and that is enough for it. A law firm with case data lands on the right (sovereign operation). Most SMEs sit in between, and at a different point depending on the data class: the newsletter on the left, the HR file on the right. This profile is your strategy. It tells you where you may stay convenient and where the effort pays off, before you spend a single franc on a tool.

The three following articles in this series then cover, one by one, the layers on which you implement these dials: the infrastructure with model and operation, the platform for daily use, and the integration into your line-of-business applications.

What this means for your company

The questions above can be discussed in a single session; the answers need a sober look at your own data and processes. That is exactly what the AI positioning assessment is for: a structured meeting where we work through the questions with you and turn the answers into a prioritised path. At the end you hold a self-contained result you can keep working with, even without us.

How does AI adoption start at your company: with a tool list or with questions?

Most papers called an AI strategy are tool lists. Microsoft Copilot here, a chatbot there. That order is backwards, because whoever starts with the tool has already decided the strategy without noticing, often for years.

Nine questions belong before that: value, most sensitive data, existing lock-in, importance in the core business, brand promise, operation, people, cost over time, regulatory duty. You decide eight of these. The ninth is decided by the rules, if you are bound by professional secrecy, the Financial Market Supervisory Authority FINMA or an official secrecy obligation.

Our conclusion: laid side by side, the answers form a profile, and that profile is the strategy. It tells you where you may stay convenient and where the effort pays off. Half a day with senior management is enough for that.

The article spells out all nine questions, three worked profiles from a trade business to a law firm, and a worksheet for the strategy session. Link in the comments.

#AIStrategy #SME #Switzerland #DataSovereignty