AI Act for SMEs: Every Obligation, Exemption and Deadline (2026)
The EU AI Act for SMEs and startups is not a lighter version of the regulation — it is the same law with specific proportionality adjustments that change what the worst-case exposure looks like. The obligations that apply do not disappear because a company is small: Article 50 transparency duties apply from 2 August 2026 to every provider and deployer in scope regardless of headcount, and the prohibited practices have been enforceable against everyone since February 2025. What SME status changes is the fine calculation, the documentation burden for high-risk systems, and access to support tools. This guide maps every obligation, every exemption, and every upcoming change in plain terms.
AI Act for SMEs: who qualifies as an SME or startup
The AI Act adopts the standard EU definition of SME: an enterprise with fewer than 250 employees and annual turnover not exceeding €50 million (or an annual balance sheet not exceeding €43 million). Start-ups are a subset of this — newly established enterprises that have not yet distributed profits and are not a subsidiary or branch of a large undertaking. These definitions determine which proportionality provisions apply to you by default under the current regulation.
The small mid-cap extension: a major Omnibus change
One of the most practically significant changes in the Digital Omnibus is the extension of SME protections to a new category: small mid-cap companies (SMCs). Under the Omnibus (pending adoption), SMC status covers companies with up to 750 employees and annual turnover up to €150 million (or balance sheet up to €129 million) — sitting between the existing SME definition and large enterprise.
This matters because there are thousands of European AI companies that exceed the 249-employee SME threshold but are nothing like the large corporations the AI Act’s heaviest obligations were designed for. The original regulation treated a 400-person AI startup identically to a company with 50,000 employees. The Omnibus corrects that. Once adopted, SMCs gain access to simplified technical documentation, proportionate quality management system requirements, reduced fine caps, and priority access to AI regulatory sandboxes — the same benefits SMEs already hold.
Anti-avoidance note. The Omnibus text includes anti-avoidance provisions: companies that deliberately structure their operations to remain below the SMC or SME threshold — while functioning economically as a larger entity — are not eligible for the simplified pathway. Implementing guidance on this is expected in Q4 2026.
What applies to all SMEs from day one — no size exemption
Several AI Act obligations apply regardless of company size. If you are a small operator who thinks “the AI Act doesn’t affect startups,” these are the ones that already do or will.
Article 5 — Prohibited practices (in force since 2 February 2025)
The list of AI practices banned under Article 5 applies to every organisation equally — there is no SME carve-out. Social scoring systems, subliminal manipulation, untargeted facial-image scraping, real-time remote biometric identification in public spaces, emotion recognition in workplaces and educational institutions, and exploitation of vulnerability all carry Tier 1 fines of up to €35M or 7% of worldwide turnover. The prohibitions have been enforceable since February 2025. If your AI system touches any of these areas, size does not provide relief.
Article 4 — AI literacy (in force since 2 February 2025, softened by Omnibus)
The duty to ensure AI literacy in your organisation has applied since 2 February 2025. The original text required providers and deployers to “ensure a sufficient level” of AI literacy among staff operating AI on their behalf. The Digital Omnibus rewrites this to “take measures to support the development of” AI literacy — a materially softer formulation, closer to an obligation of means than a strict result requirement. The Commission and Member States are also required under the Omnibus to provide shared AI literacy resources and course repositories to support smaller operators — the Commission’s AI Act Service Desk is already live as the starting point for SME queries. In practice, for a small team: document what you have done to make the people operating your AI aware of how it works, its limits, and the risks it carries. That evidence satisfies the obligation.
Article 50 — Transparency obligations (2 August 2026)
This is the most important point for SMEs and startups in 2026: Article 50 applies to all providers and deployers in scope, regardless of company size. There is no SME exemption. If you provide a chatbot that interacts with people, you must disclose that it is an AI from 2 August 2026. If you generate AI images, audio or video, you must mark them in a machine-readable format. If you create deepfakes, you must label them. A three-person startup deploying a customer-facing AI assistant has the same Article 50 duties as a corporation with 10,000 employees. The only relief is the fine calculation — which for SMEs is capped at the lower amount, not the higher (see below). For the full breakdown of what Article 50 requires, see our complete guide to Article 50 transparency obligations and the detailed guide to chatbot and AI-interaction disclosure.
The SME fine inversion: Article 99(6)
This is the single most important provision in the entire regulation for small operators, and the one most often omitted from SME-focused summaries. For SMEs and start-ups, the fine for each tier in Article 99 is capped at the lower of the fixed amount or the percentage of worldwide annual turnover — not the higher, as it is for large undertakings.
| Tier | Violation | Large company cap | SME cap (€2M turnover) |
|---|---|---|---|
| Art. 99(3) | Prohibited practices | €35M or 7% — whichever higher | €140,000 (7% of €2M — lower than €35M) |
| Art. 99(4) | Operator obligations incl. Art. 50 | €15M or 3% — whichever higher | €60,000 (3% of €2M — lower than €15M) |
| Art. 99(5) | Incorrect info to authorities | €7.5M or 1% — whichever higher | €20,000 (1% of €2M — lower than €7.5M) |
The inversion does not make the fine symbolic — for a startup with €2M in revenue, a €60,000 Tier 2 fine is still a serious event. But it is the difference between a survivable penalty and an existential one. And once the Omnibus is adopted, the same inversion will apply to small mid-cap companies — an SMC with €80M in turnover facing a Tier 2 violation pays 3% of €80M (€2.4M), not €15M. For a full breakdown of the penalty structure and how fines are calculated, see our complete Article 99 penalties guide.
High-risk obligations for SMEs
If your AI system is classified as high-risk under Annex III or Annex I, the full suite of high-risk obligations applies — risk management, data governance, technical documentation, logging, human oversight, conformity assessment, CE marking and EU database registration. The AI Act does not exempt SMEs from high-risk obligations; it adjusts how they comply.
For SMEs, the adjustments under the existing regulation include simplified technical documentation requirements and proportionate quality management system standards. The Omnibus extends these to small mid-cap companies and obliges the Commission to issue specific guidance for operators of sector-regulated high-risk systems, which will include compliance pathways tailored to smaller operators. On timing: the high-risk obligations for Annex III stand-alone systems are deferred to 2 December 2027 and for Annex I product-embedded systems to 2 August 2028, pending Omnibus adoption. Until the Omnibus is published in the Official Journal, the original 2 August 2026 date remains the legal text.
One obligation the Omnibus preserved. There was significant pressure during negotiations to remove the EU database registration requirement for AI systems that providers deem exempt from high-risk classification. The Omnibus does not do this — even for systems a provider considers not high-risk, registration in the EU database is required, with the exemption motivated. Transparency toward authorities is preserved regardless of size.
Regulatory sandboxes: the SME opportunity
AI regulatory sandboxes allow providers — particularly SMEs and startups — to develop, train, test and validate AI systems in a controlled environment before market launch, under the direct supervision of competent authorities. The original AI Act required Member States to establish at least one national sandbox by 2 August 2026. The Omnibus defers this to 2 August 2027. It also introduces a new EU-level sandbox, with priority access explicitly granted to SMEs (including start-ups) and, under the Omnibus, small mid-cap companies. Benefits of participating in a sandbox include regulatory guidance specific to your system, the ability to process certain sensitive personal data for bias detection and testing, and a compliance track record that reduces enforcement risk. If you are an SME building a high-risk AI system, sandbox participation is one of the most valuable tools the regulation offers — watch for national sandbox launches across Member States in the second half of 2026 and into 2027.
What SMEs and startups should do before 2 August 2026
- Classify every AI system you deploy or provide. SME status does not determine your obligations — the risk tier of each AI system does. Run every use case through the four-tier classification (prohibited / high-risk / transparency / minimal) now. Our EU AI Act overview maps the classification framework.
- Implement Article 50 transparency. It applies regardless of your size, and 2 August 2026 is your deadline. Chatbot disclosure, content marking and deepfake labelling are the three obligations most likely to affect a startup — and none has an SME exemption. If you have AI-generated content going live after 2 August, it needs to be marked.
- Check your Article 5 exposure. If your product touches emotion recognition, real-time biometric ID, social scoring or manipulation — these have been live since February 2025. Size is no defence.
- Document your AI literacy measures. You do not need a formal programme — you need evidence that you have done something. A team meeting agenda, an internal note, an online course certificate. The Omnibus softens the standard; demonstrating you made an effort satisfies it.
- Understand your fine exposure. The SME inversion in Art. 99(6) is automatic if you meet the definition. Know what 1%, 3% and 7% of your previous year’s worldwide turnover actually amount to — the numbers are less scary than the fixed amounts, and that knowledge helps you calibrate compliance spend proportionately.
- If you are approaching the SME ceiling, track the Omnibus adoption. If your headcount is near 249 or your turnover near €50M, the small mid-cap extension could preserve your simplified pathway once the Omnibus is published. Track the Official Journal.
Frequently asked questions
Does the AI Act apply to startups?
Yes. The AI Act applies to any provider or deployer of AI systems placed on the EU market or whose outputs are used in the EU, regardless of company size or age. SMEs and startups receive proportionality adjustments — primarily the fine inversion rule and simplified high-risk documentation — but not exemptions from the core obligations.
Is there an SME exemption from Article 50?
No. Article 50 transparency obligations apply to all providers and deployers in scope from 2 August 2026, regardless of company size. The chatbot disclosure duty, content-marking obligation, and deepfake-labelling duty apply to a two-person startup just as they do to a large enterprise. The fine if you breach them is capped proportionately, but the obligation is the same.
What is a small mid-cap company under the AI Act?
Under the Digital Omnibus (pending adoption), a small mid-cap company has up to 750 employees and annual turnover up to €150 million (or balance sheet up to €129 million). Once adopted, SMCs gain the same simplified technical documentation, proportionate QMS requirements, fine cap inversion, and priority sandbox access that SMEs already hold under the regulation.
When will the EU AI regulatory sandbox be available?
Member States are required to establish national sandboxes by 2 August 2027 (deferred from 2 August 2026 by the Omnibus, pending adoption). An EU-level sandbox is also being created under the Omnibus, with priority access for SMEs and SMCs. Watch for announcements from national competent authorities and the AI Office in late 2026 and into 2027.
Does the AI Act apply to non-EU startups selling into the EU?
Yes. The AI Act has extraterritorial scope: it applies to any provider whose AI system is placed on the EU market or whose outputs are used in the EU, regardless of where the company is incorporated. A US or UK startup with fewer than 250 employees qualifies as an SME for AI Act purposes and gets the same proportionality protections — but the obligations still apply.
Key takeaways
- The EU AI Act for SMEs does not remove obligations — it adjusts the fine calculation and documentation burden. Article 50 transparency and the Article 5 prohibitions apply to all operators regardless of size.
- The fine inversion in Article 99(6) is the most valuable SME protection: each fine is capped at the lower of the fixed amount or the turnover percentage, reducing existential exposure to manageable proportions.
- The Digital Omnibus extends SME protections to small mid-cap companies (up to 750 employees / €150M turnover) — a significant relief for Europe’s mid-sized AI sector, pending OJ publication.
- AI regulatory sandboxes give SMEs and startups supervised test environments with priority access; the new EU-level sandbox adds a central option above the national ones.
- 2 August 2026 is the deadline that matters most for every SME with a chatbot, generative AI, or AI-assisted content output — Article 50 applies fully, and the clock is running.
