SME self-assessment of “responsible AI”: lessons from an operational Swiss engine

Why this note

This text is the public version of a contribution addressed to the federal offices preparing Switzerland's framework for artificial intelligence. It is voluntary, unsolicited, and commits no one but its author — who declares his interest up front: AI-Karma develops and commercially operates the self-assessment engine described here.

Its thesis fits in three sentences. Swiss SMEs are already exposed to the transparency obligations of the European AI Act, with no compliance function and no reference framework to situate themselves. An operational self-assessment engine has, since 2026, produced operating lessons — drawn from demonstrations and from exchanges with SMEs and referral partners, without collecting the answers, by design. Those lessons can serve the legally non-binding instruments the Confederation is studying.

The context, seen from an SME

The regulatory calendar has materialised: the prohibited practices of the European regulation (art. 5) have applied since 2 February 2025, and the transparency obligations (art. 50) since 2 August 2026 — a deadline maintained by the “Digital Omnibus AI”, which kept it while postponing the high-risk regime of Annex III, now expected on 2 December 2027. Through its territorial scope (art. 2), the regulation reaches Swiss SMEs that serve clients in the European Union or plug into European value chains.

On the Swiss side, the Federal Council set the course on 12 February 2025: ratification of the Council of Europe Framework Convention on AI, signed by Switzerland on 27 March 2025; a preliminary implementation draft entrusted to the FDJP for the end of 2026; and a plan of legally non-binding measures — self-declaration, sectoral agreements, standards — entrusted to DETEC for the same deadline.

Between the two, SMEs are on their own: too small for a compliance function, specialised advice often beyond budget, contradictory information. It is that gap our work documents.

The engine, in brief

The KarmaScore measures an organisation's “responsible AI” maturity across 24 indicators in four dimensions — technological, compliance, environmental, societal — rated on a scale from 0 (non-existent) to 4 (systematic). Sectoral weightings are capped at 40 % per axis, and the overall score out of 100 decomposes exactly: every point is attributable to a specific indicator, a property verified by a reproducible automated test. The full method is published (/methodologie).

An AI Act classifier covers territorial applicability (art. 2), the requalification of roles (art. 25), prohibited practices (art. 5), high risk (Annex III and the derogation of art. 6(3)) and transparency (art. 50), with legal versioning: each assessment cites the state of the law at its date (/aiact).

Declared limits: the cross-company comparison still rests on a synthetic panel, and the associated label is in an alpha version, with documented governance, the essentials of which are publicly restated on ai-karma.ch/methodologie, and which states what it does not attest. This transparency about the limits is part of the method.

Five lessons from the field

First lesson: an SME's first question is not “how do I comply”, but “am I concerned, and in what role”. The point most systematically overlooked is the requalification of art. 25 — an SME that customises or rebrands a third-party AI system can legally become a provider without knowing it. Any instrument aimed at SMEs should begin with that positioning, before any list of obligations.

Second lesson: transparency is the most actionable entry point. The obligations of art. 50 are understood in a few minutes and implemented without outside advice. A Swiss non-binding instrument starting with transparency would obtain visible results quickly — and would establish the habit of self-assessment.

Third lesson: a score is credible only if it is fully explainable. If a company cannot trace every point of its score back to a specific answer, self-assessment becomes a black box — and the black box produces “compliance washing”. Exact explainability is an architectural requirement, not a refinement.

Fourth lesson: sectoral differentiation is indispensable, but must be bounded. The risks of a healthcare practice and of an online retailer do not have the same structure; uncapped, however, sectoral weightings become a route to score optimisation. Our cap of 40 % per axis is a debatable choice — the existence of a cap is not.

Fifth lesson: a self-declaration is worth something only dated and versioned. Without a public, versioned reference framework and without a statement of the applicable state of the law, two attestations are not comparable and the instrument devalues over time.

What this suggests for a Swiss non-binding instrument

If the Confederation retains self-declaration or labelling among its non-binding measures, the field suggests five operating criteria: a public and versioned reference framework; exact explainability of the result; a free and light entry point, under two hours for an SME; alignment with the principles of the Council of Europe Convention — transparency, human oversight, non-discrimination, accountability; and a national benchmark.

That last criterion names the missing link: there is today no public benchmark of the AI maturity of Swiss SMEs — the available surveys measure adoption and perception, not maturity against verifiable indicators. Without field measurement, a national instrument will calibrate itself blind.

Open proposal: a reference panel of 30 SMEs

We propose to assemble a panel of 30 sectorally diversified Swiss SMEs, assessed according to a published protocol, with public reporting of anonymised results. That panel would produce the first Swiss benchmark of SME maturity in “responsible AI” — an empirical basis directly useful to the work of the FDJP and DETEC, at modest cost.

AI-Karma is willing to co-design this panel with a federal office or a partner it designates, to publish the method and to share the results. As the engine is public, a demonstration takes thirty minutes (/contact).

Frequently asked questions