What belongs in an AI strategy?

Less technology than most people think. An AI strategy sets out what you use AI for, on which foundation, and what that costs over the years. For an SME, it comes down to a handful of decisions in the end: where AI creates value, how tightly you bind yourself to a provider, which data is sensitive, who carries the operation, and who drives it inside the company.

How does an SME develop an AI strategy?

With a few honest questions to senior management, before choosing a tool: the concrete value, the most sensitive data classes, the existing provider lock-in, the importance of AI in the core business, the brand promise, the operation, the people and competence in the company, the cost over time, and the regulatory duties. The answers to these are the strategy.

Should we build our AI strategy on Microsoft?

If mail, documents and identity already sit with Microsoft and are meant to stay there, little speaks against setting up AI there too. It then becomes less a question of whether than of the cost over ten years, and how easily you could leave that path again later.

What is a sovereign AI strategy?

A strategy that sets out, per data class, how much control you want to keep over the model, the operation and the data. Not everything needs to be sovereign; it is often enough for a small, sensitive part of the data. The rest may stay convenient and cheap.

Does a small company even need an AI strategy?

Yes, but a lean one. A handful of consciously made decisions is enough to stop you binding yourself for years through the choice of a tool, without noticing. One page suffices: the nine questions answered in this article.

AI strategy for SMEs: the questions to answer first

Most AI strategies are tool lists. Nine questions that determine the sovereign path for Swiss SMEs, without a ready-made framework.

Where an AI strategy really begins

Whoever starts by choosing a tool has already decided their AI strategy without noticing. An AI strategy sets out what you use AI for, on which foundation, and what that costs over the years. For a Swiss SME, it comes down to a handful of decisions that only senior management can make: where AI creates value, how tightly you bind yourself, which data is sensitive, and who carries the operation.

In brief

Sort your data first, then the tools. Every data class needs its own degree of sovereignty, from public text to case files.
For regulated data (professional secrecy, FINMA, official secrecy), the rules already make some of these decisions for you. That relieves more than it restricts.
Take half a day for the answers, not a quarter. There are only a few questions, and none of them needs a framework.
The result is not a document but a profile: it tells you where you may stay convenient and where the effort pays off.

Most papers called an “AI strategy” are tool lists: Copilot here, a chatbot there. That order is backwards, because then the tool dictates the strategy. In our foundational article on sovereign AI, we described sovereignty as a mixing desk, with dials you set according to how confidential your data is. Where those dials should sit follows from a few questions about your business, not from a vendor’s brochure.

This is the second part of our series on sovereign AI. The first named the dials, this one shows how you determine their position for your company.

Nine questions for senior management

Take an hour with senior management and work through the following questions in order. Together they determine where your dials sit.

01 Value and use case

Where exactly should AI save you time or bring in money?

Without a concrete project, every further question stays theoretical. Start with the work that takes too long today or does not get done: quotes, support requests, searching through old documents. Only once it is clear what AI should work on can you say which data it touches and how sovereign it needs to run.

02 Most sensitive data

Which of your data would you not trust to a US service?

Work through the question concretely, data type by data type. For most companies, the answer turns out smaller than expected. Product copy, website content and internal notes are uncritical. Sensitive are HR files, client data, contracts, and health or case data. Sovereign operation pays off for this small part, and only for it; the large remainder may run comfortably and cheaply on a standard service.

03 Existing lock-in

Are you already committed to a large provider, and do you want to stay that way?

This question often takes the pressure off. If mail, documents and identity have long sat with Microsoft and are meant to stay there, little speaks against setting up AI there too. Breaking out of your own ecosystem for a single use case rarely justifies the effort. The real question then becomes what this path costs over ten years, and how easily you could leave it again later.

04 Importance in the core business

Will AI become a tool you rely on daily, or will it stay a sideline?

As long as AI helps draft an email faster, an outage is bearable. If it sits inside a core process your operation depends on, the calculation changes. A provider that discontinues a model, doubles the price, or quietly swaps it for a weaker one then hits you in a sensitive spot. Open weights and open software take away that power: the model keeps running on your infrastructure even if the provider retires it or raises the price.

05 Brand promise

Do you sell your clients discretion, and does your technology keep that promise?

For a trust office, a law firm or a medical practice, confidentiality is the product. If the same client data ends up with a US corporation via an AI service, the story no longer holds together, and a client who asks notices immediately.

06 Operation

Do you want to carry operation and maintenance yourself, or should a partner take it on?

You remain sovereign with a partner too. What matters is that the contract records who operates which part, and that you could switch if it came to that. A small SME without its own IT sensibly hands the model, hosting and maintenance to a Swiss partner; a company with a strong team keeps more in house. Both can be sovereign.

07 People and competence

Who inside the company drives this forward, and may the team experiment?

Name one responsible person, not the whole senior management team. Without one, even a good pilot project fades out after the first few weeks. Employees also need a protected test space where a failed prompt has no consequences. The EU AI Act requires adequate AI competence in the team anyway; the right training is also the lever that turns AI into a noticeable benefit.

08 Cost over time

Do you think in a one-off project budget, or in running costs over years?

An AI system costs more to run than to acquire. Over the years, what counts is the token price, utilisation, and the cost of leaving a provider again. How misleading the raw model price can be, we work through in our article on LLM cost.

09 Regulatory duty

Is your data subject to professional secrecy, FINMA, or an official secrecy obligation?

For some data, the answer is not a matter of weighing options. Whoever is bound by lawyer, doctor or banking secrecy or falls under FINMA requirements already has some dials set by the rules. These cases belong at the start of the strategy: whoever discovers them only after choosing a tool has to rebuild the architecture from scratch.

What your answers add up to

Lay the answers side by side, and a profile emerges. A trade business lands on the left for most dials; a convenient standard service is enough. A law firm with case data lands on the right. Most SMEs sit in between, and at a different point depending on the data class: the newsletter on the left, the HR file on the right. This profile is your strategy. It tells you where you may stay convenient and where the effort pays off, before you spend a single franc on a tool.

The three following articles in this series then take on, one by one, the layers on which you implement these dials: the infrastructure with model and operation, the platform for daily use, and the integration into your line-of-business applications.

What this means for your company

The questions above can be discussed in a single session; the answers need a sober look at your own data and processes. That is exactly what the AI positioning assessment is for: a structured meeting where we work through the questions with you and turn the answers into a prioritised path. At the end you hold a self-contained result you can keep working with, even without us.

What technically follows from these answers is covered by the further parts of the series: the infrastructure, the platform and the integration layer.