The EU AI Act for small and medium-sized companies. What you must do and what does not apply

The EU AI Act does not exempt small and medium-sized companies from obligations - their scope depends on how the company uses artificial intelligence, not on its headcount. In return, the regulation gives SMEs a lower cap on fines, support from Member States and, since the Digital Omnibus, some new simplifications.

Below you can check whether your company is an SME under the AI Act, what already applies to it, what it usually does not have to do and where to start.

Which companies are SMEs under the AI Act?

Since 27 July 2026 the AI Act has its own definition of an SME (Article 3(14a)), which refers to Commission Recommendation 2003/361/EC. What counts is headcount and turnover or balance sheet total:

• micro enterprise - fewer than 10 people and turnover or balance sheet total up to EUR 2 million;
• small enterprise - fewer than 50 people and turnover or balance sheet total up to EUR 10 million;
• medium-sized enterprise - fewer than 250 people and turnover up to EUR 50 million or balance sheet total up to EUR 43 million.

The Digital Omnibus also added the SMC category, small mid-cap enterprises (Article 3(14b)): companies that are no longer SMEs but employ fewer than 750 people and have a turnover of up to EUR 150 million or a balance sheet total of up to EUR 129 million. Ownership links are taken into account when counting, so a company within a large group is usually not an SME.

What applies to a small company today?

Most small and medium-sized companies do not build AI, they use it. Under Article 3(4) they are deployers, which means a specific set of obligations:

Company size changes none of these obligations. It only changes how extensive the measures need to be, because Article 4 requires matching them to the context and to the people who use AI.

What does a small company usually not have to do?

The heaviest AI Act obligations fall on providers of high-risk systems: conformity assessment, a quality management system, technical documentation, registration in the EU database. A company that does not build such a system does not have these obligations.

The AI Act also does not require any company to hold a training certificate. The European Commission has said plainly that an internal record of actions is enough, as we explain in is an AI Act training certificate required. Nor does the regulation create a mandatory role like the data protection officer.

Watch out for one exception: if a small company uses AI to assess candidates or employees, it may be using a high-risk system. Details are on our page on high-risk AI systems.

What relief does the AI Act give SMEs?

The most important relief concerns fines. For a large company, the cap is the higher of two values: the fixed amount or the percentage of annual turnover. For SMEs, including start-ups, it is the other way round: the lower of the two (Article 99(6)).

A model example: a medium-sized company with a turnover of EUR 20 million. For a prohibited practice its cap is 7 percent of turnover, EUR 1.4 million, rather than EUR 35 million. For breaching other obligations it is 3 percent, EUR 600,000, rather than EUR 15 million. These are ceilings, not the amount of the fine, which the authority sets taking into account, among other things, the interests and economic viability of SMEs.

After the Digital Omnibus, SMCs get similar but narrower relief: the lower cap applies to fines under Article 99(4) and (5), not to prohibited practices (Article 99(6a)).

What support does the regulation provide?

Article 62 requires Member States to take specific measures for SMEs: priority access to regulatory sandboxes, training tailored to their needs, communication channels for questions and help with taking part in standardisation. Fees for conformity assessment are to reflect their means.

The amended Article 4(2) says the Commission and the Member States support companies in building AI literacy, in particular SMEs. Companies that build high-risk systems may also meet some quality management system requirements in a simplified way (Article 63). Before the Digital Omnibus this relief applied only to micro enterprises; it now covers all SMEs.

Where should a small company start?

A small company follows the same path as a large one, just shorter. One responsible person, a one-page list of tools, a review against the prohibitions, training matched to what people actually use, short rules and a record of what was done are enough.

We set out the whole path in the EU AI Act in your company step by step, and an overview of obligations by situation is on our EU AI Act for companies page.

On your own or with a tool?

In a company of a few people, a spreadsheet and a short document are usually enough. A tool starts to make sense when there are more people and more AI tools, and someone has to keep track of who completed the training and who confirmed the rules.

With AI TrustCERT a small company can buy training licences individually, and from 10 people the AI Governance platform with the register, policies and reports comes included. To begin, the free AI Ready Check is enough.

Summary

The EU AI Act applies to small and medium-sized companies just as it does to large ones, if they use AI. The Article 4 obligation and the Article 5 prohibitions have applied since February 2025, the Article 50 transparency obligations since August 2026. Obligations for high-risk systems start later and only affect companies that use such systems.

The difference lies elsewhere: SMEs have a lower cap on fines, a right to support from the state and simplifications that the Digital Omnibus partly extended to SMCs. For most small companies, preparation means sorting out a few things rather than a large implementation project.

This article describes general rules and does not replace a legal assessment of a specific company's situation.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.