The case for taking AI Act classification seriously
Most DACH SMEs we speak with underestimate how broadly the AI Act reaches. They assume it's a problem for OpenAI-scale providers or for narrowly defined high-risk domains. The reality is more uncomfortable: if your HR team uses an AI-assisted CV screen, if your customer support runs on a chatbot, if your marketing team generates content with a large language model — you are a deployer under the Act, and AI Act classification applies to you.
The framework we use
Before going into implementation, it's worth fixing the vocabulary. A surprising amount of the practical confusion around ai act risk classification comes from people using the same words to mean different things. Here are the definitions we work with internally at Innopulse:
Ai act classification — in the context of ai act risk classification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
High-risk ai — in the context of ai act risk classification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Article 6 ai act — in the context of ai act risk classification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Ai risk assessment — in the context of ai act risk classification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Operationalising this for an SME
The move from reading about ai act risk classification to actually implementing it is where most SMEs stall. In our experience, the blockage is rarely capability — it's sequencing. Attempting to do everything in parallel burns out the small team that's responsible; attempting to do it in the wrong order means early work has to be redone.
Where teams typically go wrong
The first is scope creep disguised as ambition. A project scoped to address ai act risk classification gradually expands to address everything adjacent. By month three, the original deliverable is two quarters away and the team has lost focus. The fix is ruthless: write down what's out of scope as explicitly as what's in.
How we approach this at Innopulse
On ai act risk classification specifically, our internal practice has evolved considerably. The early version was manual, error-prone, and didn't scale past three products. The current version is partly automated, documented in runbooks, and survives the addition of new products without degradation.
What this means for the DACH landscape
Stepping back from the immediate operational picture, ai act risk classification points at some broader shifts in how Swiss and DACH firms are going to operate over the next 24–36 months.
What to do next
If you're reading this because you have an active project around ai act risk classification, here are the next steps we'd suggest — based on where most SMEs we work with are starting from.
Either way: pick your first step, put a calendar date on it, and start.