What is a 'small mid-cap enterprise' (SMC) under the EU AI Act?

It is a new size tier introduced into the AI Act by the Digital Omnibus, Regulation (EU) 2026/1744, which inserted a definition at Article 3(14b). An SMC is an enterprise that is not an SME, employs fewer than 750 people, and has an annual turnover not exceeding €150 million or an annual balance sheet total not exceeding €129 million, as defined in the Annex to Commission Recommendation (EU) 2025/1099. It covers companies that outgrew SME status but still face similar administrative burden.

Do the AI Act's SME concessions help a small company that just uses ChatGPT or an AI chatbot?

Mostly no. Four of the six concessions — simplified quality management, simplified technical documentation, proportionate implementation, and reduced conformity assessment fees — are attached to the machinery for high-risk AI systems, which applies to providers of those systems; sandbox priority helps any company developing AI, but none of these helps a company that merely deploys someone else's AI. A small company that deploys a general chatbot or uses AI for marketing content is usually subject to the Article 50 transparency duties and the Article 4 AI literacy duty instead, and neither of those has a size-based concession.

Are fines lower for SMEs and small mid-caps under the EU AI Act?

For SMEs, yes, across the board: Article 99(6) caps each fine at whichever is lower of the fixed sum or the percentage of turnover, reversing the usual 'whichever is higher' rule. For SMCs the relief is narrower. The new Article 99(6a) inserted by the Digital Omnibus applies that lower-of cap only to the fines in Article 99(4) and (5). It does not cover Article 99(3), the €35 million or 7% tier for prohibited AI practices — so on that tier an SMC faces the same ceiling as a large company.

Is there an SME exemption in the EU AI Act? What small companies actually get

Q: Is there an SME exemption in the EU AI Act?

No. The EU AI Act contains no exemption based on company size. Obligations attach to what your AI system does and what role you play — provider or deployer — not to how many people you employ. What the Act does contain is a set of proportionality measures: a simplified quality management system under Article 63, a simplified technical documentation form under Article 11(1), proportionate implementation under Article 17(2), priority access to regulatory sandboxes, reduced conformity assessment fees under Article 62, and a lower fine cap under Article 99(6).

"We're a small company — does this even apply to us?" is the most common question small and mid-sized businesses ask about the EU AI Act, and it has a short answer that nobody likes: yes, it applies, and there is no size exemption.

But that is not the whole story. The Act does contain real accommodations for smaller companies, and the Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — added a new size tier and widened several of them. The catch is that most of these concessions help a narrower set of companies than the headlines suggest. Here is what actually exists, and who it actually helps.

This is an information service to help you plan, not legal advice. For the obligations tied to your own AI use, see which apply to your company.

First: why there is no exemption

The AI Act's obligations attach to two things — what the AI system does (its risk tier) and what role you play in relation to it (provider or deployer). Neither test mentions headcount or turnover. A five-person startup that builds a CV-screening tool is a provider of a high-risk AI system under Annex III; a 50,000-person bank that merely buys the same tool is a deployer with a lighter set of duties. Size is not the variable.

So the accurate framing is not "are we exempt?" but "which tier are we in, and in which role?" If you have not settled that, start there — which obligations apply to your company walks the test.

Are you an SME, an SMC, or neither?

The Digital Omnibus inserted two definitions into Article 3 of the AI Act — point (14a) for SMEs and point (14b) for SMCs — each pointing at an existing Commission Recommendation. The thresholds:

Tier	Staff	Turnover	Balance sheet total	Source
SME (micro, small or medium)	fewer than 250	≤ €50 million	or ≤ €43 million	Recommendation 2003/361/EC
SMC (small mid-cap)	fewer than 750	≤ €150 million	or ≤ €129 million	Recommendation (EU) 2025/1099
Large	750+ staff — or fewer, but above both the €150m turnover and €129m balance-sheet ceilings	—	—	neither applies

An SMC is defined negatively: it is an enterprise that is not an SME but still sits under the 750-employee and €150 million / €129 million ceilings. The Commission's stated reason, in recital 6 of the Omnibus, is that companies "outgrowing" SME status "face challenges similar to SMEs in relation to administrative burden" — the tier exists to stop a growing company hitting large-enterprise rules the day it crosses the SME line.

One trap worth flagging: both definitions count partner and linked enterprises. If a larger group holds 25% or more of your capital or voting rights, its headcount and turnover may be aggregated with yours, and you may not qualify on your own numbers. Check the Annex to the relevant Recommendation before assuming you are in.

The six concessions, and who gets them

Concession	Article	SME	SMC	What it actually does
Simplified quality management system	63(1)	✅	❌	Comply with certain Article 17 QMS elements "in a simplified manner" — but only if you have no partner or linked enterprises
Simplified technical documentation form	11(1)	✅	✅	Provide Annex IV documentation on a Commission form that "notified bodies shall accept"
Proportionate QMS implementation	17(2)	✅	✅	Implementation must be "proportionate to the size of the provider's organisation"
Priority access to regulatory sandboxes	62(1), 57(3a)	✅	✅ (Union-level)	Priority access to national sandboxes; the Omnibus also empowers the AI Office to set up a Union-level sandbox, which must give priority access to SMEs and SMCs once established
Reduced conformity assessment fees	62(2)	✅	❌	Member States must reduce fees proportionately to your size and market size
Lower-of fine cap	99(6) / 99(6a)	✅ (all tiers)	⚠️ (partial)	See the fines section below

Two of these were widened by the Omnibus in ways worth noting. Article 63(1) previously offered the simplified QMS route to microenterprises only; it now reads "SMEs, including start-ups" — a substantial widening, and the Commission remains obliged to "develop guidelines on the elements of the quality management system which may be complied with in a simplified manner" — a duty that predates the Omnibus and is still undelivered, with no date set. Article 17(2) was rewritten to make proportionality explicit for SMEs and SMCs, while keeping a hard floor: providers "shall, in any event, respect the degree of rigour and the level of protection required."

The catch most guides miss

Read that table again and notice where the concessions sit: Articles 11, 17, 62 and 63 are all high-risk machinery. Technical documentation, quality management systems, conformity assessment, notified bodies — these are obligations on providers of high-risk AI systems.

Which means: if you are a small company that deploys ordinary AI — a customer-service chatbot, an AI writing assistant, a meeting summariser — almost none of these concessions touch you, because you were never in the high-risk provider regime to begin with. Your actual duties are far more likely to be:

Article 50 transparency — telling people they are talking to an AI, and marking AI-generated content. Live since 2 August 2026. No size concession. See the Article 50 transparency obligations.
Article 4 AI literacy — taking measures to support AI literacy among staff who operate AI on your behalf; since the Omnibus, explicitly an obligation of effort, not a guarantee of any particular level. Applies to providers and deployers, at any size. No size concession.

That is the honest shape of it. The AI Act's small-business accommodations are real, but they are concentrated in the part of the Act that most small businesses never enter. Being an SME makes high-risk compliance lighter; it does not make transparency or literacy duties go away.

There is one piece of good news on timing: the high-risk obligations these concessions relate to were deferred by the Digital Omnibus to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products. If you are a small provider heading into that regime, you have runway — see has the high-risk deadline been delayed?.

Fines: SMEs and SMCs are not treated the same

This is the sharpest distinction in the whole picture, and it is easy to miss.

The general rule in Article 99 is that each fine is "up to €X or Y% of total worldwide annual turnover, whichever is higher." For a large company the percentage is the real ceiling.

SMEs get that rule reversed in full. Article 99(6): "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower." Note the scope — paragraphs 3, 4 and 5. All three tiers.
SMCs get a narrower version. The Omnibus inserted Article 99(6a): "In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower."

Paragraph 3 is missing from the SMC rule. That is the €35 million or 7% of worldwide turnover tier for breaching the Article 5 prohibitions — the most expensive tier in the Act. So an SMC that breaches a prohibition faces the standard "whichever is higher" ceiling, exactly as a large enterprise would, while an SME in the same position would be capped at the lower figure.

Separately, the Omnibus rewrote Article 99(1) so that Member States "shall take into account the interests of SMEs, including start-ups, and SMCs, and their economic viability when imposing penalties" — a general proportionality duty on national authorities, now covering SMCs too.

For the full fine structure across all tiers, see EU AI Act penalties: how much are the fines?.

What a small company should actually do

Settle your tier and role before anything else. The concessions are worthless until you know whether you are a high-risk provider, and most companies are not. Answer three questions about your AI use and get the list that applies to you.
Check the transparency and literacy duties first. They are live now, they have no size relief, and they are the obligations a small company is most likely to be caught by.
Confirm your size classification properly, including partner and linked enterprises. If a parent or investor holds 25% or more, run the aggregation before you rely on SME status — Article 63(1) in particular is unavailable to any company with partner or linked enterprises at all.
If you are an SMC, do not assume you inherited every SME benefit. You did not get the Article 63 simplified QMS route, you did not get reduced conformity assessment fees, and you did not get the lower-of fine cap on the prohibitions tier.
Watch for two Commission deliverables that will change how much these concessions are worth in practice: the Article 63(1) guidelines on simplified QMS elements, and the Article 11(1) simplified technical documentation form. Neither exists yet, and neither has a published deadline.

Because those deliverables — and the size rules themselves — are still moving, join the waitlist and we will tell you when something that affects your company changes.

The official text is Regulation (EU) 2024/1689; the amending act is Regulation (EU) 2026/1744 (the Digital Omnibus on AI). This article is an information service to help you orient — it is not legal advice, and you should confirm your own size classification and obligations against the official sources before acting.