The regulation was deliberately designed with smaller companies in mind. That doesn’t mean you’re exempt — it means your compliance path is different, and in real ways easier. Here is what the relief actually is, and what it isn’t.
Image AI-generated. All text human-written.
Most small companies assume the EU AI Act is aimed at Big Tech — that a regulation with these fine ceilings cannot really mean them, and that someone will say so when it matters. The text says otherwise, in both directions. SMEs and start-ups appear throughout the Regulation, with a dedicated set of relief provisions built in because the drafters knew an enterprise-calibrated framework would crush smaller companies. And the amendment that entered into force in July 2026 added more relief, not less. The provisions are real and material. What they do is calibrate your obligations — never cancel them. Understanding that difference is the whole game.
First — who qualifies
EU law defines the category in three bands: microenterprises (fewer than 10 staff, turnover or balance sheet below €2 million), small enterprises (under 50 staff, below €10 million), and medium-sized enterprises (under 250 staff, turnover below €50 million or balance sheet below €43 million). The Act treats start-ups as SMEs throughout, even though EU law has no single start-up definition. One caveat that catches funded companies: the thresholds are assessed with partner and linked enterprises counted — significant ownership by a large enterprise can take you outside the SME definition, and with it outside several of the reliefs below. Check before you rely.
What the Act does for you
Priority, free access to regulatory sandboxes. Article 62 gives SMEs and start-ups with a registered office or branch in the Union priority access to the national AI regulatory sandboxes — supervised environments for developing, training and testing systems with legal certainty, where providers following the sandbox plan in good faith and the authority’s guidance do not face administrative fines for infringements during the period. Access is free of charge for SMEs. A sandbox is not a way around compliance; it is compliance with regulatory support instead of regulatory risk.
Proportionate conformity assessment fees. Where third-party assessment by a notified body applies, the fees must be reduced proportionately to SME size — directly cutting one of the largest cost items for the systems that need it.
Simplified documentation and QMS. Two separate reliefs, often confused. Under Article 63, microenterprises may meet certain quality-management elements of Article 17 in a simplified manner — on condition they have no partner or linked enterprises. And under Article 11 as amended, SMEs and start-ups are entitled to provide the technical documentation for high-risk systems in a simplified form — a change the amending Regulation made law in July 2026. The obligations’ substance stands; the paperwork scales down.
The fine inversion — now wider. Article 99(6) inverts the penalty rule for SMEs and start-ups: each fine is capped at the fixed euro amount or the percentage of turnover, whichever is lower — across every tier. A microenterprise with €1.5 million turnover facing the Article 99(4) tier is therefore capped at €45,000, not €15 million. Ceilings, not verdicts — but the exposure is calibrated to your size. And the amendment extended the same inversion, under Article 99(6a), to small mid-cap enterprises: companies that outgrew the SME definition no longer fall off a cliff.
Support infrastructure. Member States must run awareness and training activities tailored to SMEs and provide dedicated channels for implementation queries, and standardised templates and a single information platform are required at EU level — the build-out varies by country, but the entitlement is in the text.
What it still requires from you
The reliefs change costs, paperwork and exposure — not classification, and not duties. If your system is high-risk — and many SME-built systems are, particularly in HR tech, fintech, EdTech, health and legal tech — the core architecture applies in full: risk management, data governance, documentation (in your simplified form), logging, oversight, conformity assessment, registration. Being a start-up changes the cost of the process, never the risk classification of the system. And the clocks are the same clocks everyone faces: the AI literacy duty and the prohibitions have applied since February 2025, the Article 50 transparency duties and national enforcement powers since 2 August 2026 — both live for a three-person company today — while the heavy high-risk programme arrives on 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI in regulated products. The most expensive SME mistake is reading “relief provisions exist” as “this doesn’t really apply to us.” The reliefs exist precisely because it applies to you — the EU wanted compliance achievable, not optional.
The practical starting point
Four steps, same as any operator, sized for a small team. Map your AI — built, bought and API-integrated, anywhere it drives consequential decisions. Determine your role per system — provider, deployer, importer, distributor — because duties follow roles. Classify each system — prohibited, high-risk, transparency-tier or minimal — with a written rationale, since the classification decides which reliefs and which clocks are yours. Then gap-assess: the distance between what exists and what your tier requires is your roadmap, and for most SMEs it is weeks of disciplined work, not a consulting season. ExecLevel AI builds exactly that record — classification, duty mapping and evidence, traced to the Official Journal text, priced for companies your size, with the prices published.
Find out which reliefs — and which clocks — apply to your company: a free assessment conversation at www.execlevelai.eu
Disclaimer: This article is for general informational purposes only and does not constitute legal or compliance advice. EU AI Act requirements may vary depending on your organisation, AI system, and use case. For advice on EU AI Act compliance, visit www.exclevelai.eu