Many SMEs know the AI Act affects them, but not where to start. The good news: for most companies the effort is manageable as long as they do not provide high-risk systems. This plan describes how an SME can reach a sound position in four weeks, based on the AI Act as amended by the Digital Omnibus of July 2026. It does not replace legal advice in individual cases, but it ensures the questions are known and the obvious obligations are met.
Week 1: inventory
The goal of the first week is a complete list of AI systems in the company. This includes purchased tools such as chat assistants, writing and translation tools, AI features in existing software — CRM, accounting, HR —, in-house developments and AI features in products the company sells. The most common gap is tools introduced by individual employees themselves. A short survey across all teams finds them. For each system, record purpose, user group, data processed and vendor.
Week 2: roles and risk classes
For each system, determine the role: is the company the provider, because it offers the system under its own name, or the deployer, because it uses a third-party system? Then the risk class: does the system fall under the prohibited practices, under Annex III and thus potentially the high-risk obligations, under the transparency obligations, or is it minimally regulated? Most SMEs get a clear picture: many systems with minimal obligations, some with transparency obligations, rarely a high-risk candidate — most often in HR. The check is described in our high-risk classification checklist.
Week 3: AI literacy and transparency
Two obligations already apply and affect almost every company. For AI literacy under Art. 4, role-based measures are planned and carried out: basics for all users, depth for business owners and engineering, decision knowledge for leadership, complemented by a short usage policy. Since the Omnibus, no specific level per person must be guaranteed, but action must be proportionate and documented; details in our article on Article 4. For transparency under Art. 50, every point with AI interaction or published AI content gets notices and a rule for editorial responsibility; see our article on transparency obligations.
Week 4: contracts, documentation, roadmap
In the final week, contracts with AI vendors are reviewed: are inputs used for training, where is data processed, what documentation does the vendor provide, and does it support your own obligations? The results of the first three weeks are summarised in a short document: inventory, roles, risk classes, measures, owners. For systems that could fall under the high-risk obligations from December 2027, a roadmap with next steps is drawn up. And it is decided who maintains the inventory when new systems are added.
What the plan does not do
A 30-day plan creates an overview and meets the obligations relevant to most SMEs today. It does not make a high-risk system compliant; that requires risk management, technical documentation, conformity assessment and architectural work taking months. Nor does it replace a data protection review: where AI processes personal data, the Swiss FADP and the GDPR apply in parallel, for example on processing agreements, disclosure abroad and data protection impact assessments.
Typical stumbling blocks
- The inventory is limited to officially introduced tools and misses individual teams’ shadow AI.
- A software house overlooks that its own modifications to a third-party model make it the provider.
- Training is delivered but not documented.
- The chatbot notice is missing on individual channels, such as phone or email replies.
- The result is produced once and never maintained.
Support
For classifying individual systems we built AI Risk Check. To implement the plan with guidance, our AI Act gap assessment is the right format; the steps with verifiable criteria are also in our AI Act conformity checklist. The bigger picture is in our AI Act 2026 guide.