What does the AI Act give a small mid-cap?

What changed for small mid-caps on 27 July 2026

Until the Digital Omnibus, the AI Act knew two sizes of company: SMEs and everyone else. A software house with 600 staff faced the same fine ceilings and the same documentation burden as a multinational, because it had grown out of the SME definition and there was nowhere else to go. Regulation (EU) 2026/1744 created a middle category, the small mid-cap or SMC, and that is the category this page covers for anyone asking what a small mid-cap gets under the AI Act.

The relief is real but narrow. The Commission's own announcement says that "some measures previously reserved for SMEs are extended to small mid-cap companies (SMCs)", and the word "some" carries the weight. Read across the consolidated text as at 27 July 2026, SMCs gain a lower fine cap in two penalty tiers, a simplified route to Annex IV technical documentation, an express mention in the quality management proportionality clause, and a set of softer commitments on sandboxes, guidance and codes of conduct. Several SME measures were left untouched and stay SME only.

The Digital Omnibus guide covers the amending regulation as a whole. This page is the SMC cut through it.

Who counts as a small mid-cap under the AI Act

The AI Act does not set its own thresholds. Article 3(14b) reads: "'small mid-cap enterprise' or 'SMC' means a small mid-cap enterprise as defined in point (2) of the Annex to Recommendation (EU) 2025/1099". Article 3(14a) does the same for SMEs, pointing to Article 2 of the Annex to Recommendation 2003/361/EC. Art 3(14a), Art 3(14b)

Point 2 of the Annex to the Commission Recommendation of 21 May 2025 on the definition of small mid-cap enterprises says: "The category of small mid-cap enterprises is made up of enterprises which are not small and medium-sized enterprises in accordance with Recommendation 2003/361/EC, employ fewer than 750 persons and have an annual turnover not exceeding EUR 150 million or an annual balance sheet total not exceeding EUR 129 million."

Four things follow from that sentence and the rest of the Annex.

The two categories never overlap. An SMC is by definition not an SME, so a company is one, the other or neither. The Commission's SME definition sets the line below: fewer than 250 staff and either turnover up to €50 million or a balance sheet total up to €43 million. Recital 9 of the Recommendation states the aim that there be "no overlap between the two definitions".

Headcount is the hard test, the money is a pair. Fewer than 750 persons is required in every case. The financial ceilings are alternatives, and recital 11 says an enterprise should be excluded "only if both its turnover and its balance sheet exceed the ceilings". A company over €150 million turnover can still be an SMC if its balance sheet total is €129 million or less.

Group figures count. Points 3 and 6 of the Annex add the data of partner enterprises (25% or more of capital or voting rights) in proportion to the holding, and 100% of the data of linked enterprises. Point 3.3 excludes an enterprise where 25% or more of capital or voting rights is controlled by public bodies, subject to the investor exceptions in point 3.4. A 500 person subsidiary of a large group is not an SMC on its own numbers.

Status is sticky. Point 4.2 provides that crossing a ceiling "will not result in the loss or acquisition of the status of small mid-cap enterprise unless those ceilings are exceeded over two consecutive accounting periods". The figures are those of the latest approved accounting period, turnover is taken excluding VAT and other indirect taxes (point 4.1), and headcount is measured in annual work units (point 5.1).

The fine cap in Article 99(6a), and the tier it leaves out

Article 99 sets three tiers. Article 99(3) puts Article 5 prohibited practices at up to €35,000,000 or 7% of total worldwide annual turnover for the preceding financial year, "whichever is higher". Article 99(4) puts the listed operator and notified body obligations, including provider obligations under Article 16, deployer obligations under Article 26 and Article 50 transparency, at €15,000,000 or 3%. Article 99(5) puts supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities at €7,500,000 or 1%. The full structure is in the penalties guide.

Two paragraphs then reverse the higher-of rule for smaller operators, and they differ in reach:

• Article 99(6): "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower."
• Article 99(6a): "In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower."

Paragraph 3 is missing from 99(6a). An SMC that breaches an Article 5 prohibition is capped exactly as a large company is. The page on prohibited AI practices covers what falls in that tier.

The arithmetic for a hypothetical SMC with €120 million worldwide turnover:

The relief only changes the number while the percentage is the smaller figure, which in both covered tiers means worldwide turnover below €500 million for 99(4) and below €750 million for 99(5). Because an SMC can exceed €150 million turnover where its balance sheet stays under €129 million, a high-turnover SMC can reach the point where the fixed sum is lower and the cap stops falling.

These are ceilings, not tariffs. Article 99(1), as amended, still requires penalties that are "effective, proportionate and dissuasive", and adds that Member States "shall take into account the interests of SMEs, including start-ups, and SMCs, and their economic viability when imposing penalties". That sentence covers all three tiers, including Article 5, but it is a factor in setting the amount, not a lower cap. Article 99(7) then lists the circumstances to which regard is to be given when deciding whether to fine and how much, among them the nature, gravity and duration of the infringement, the size, annual turnover and market share of the operator, its degree of cooperation with the national competent authorities and the intentional or negligent character of the infringement. Note too that the turnover in Article 99 is total worldwide annual turnover for the preceding financial year, while SMC status runs on the Recommendation's own data rules: the two figures will not always match.

Simplified technical documentation under Article 11(1)

Article 11(1), as amended, keeps the duty to draw up technical documentation before a high-risk system is placed on the market or put into service, containing "at a minimum, the elements set out in Annex IV". It then adds: "SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner. To that end, the Commission shall establish a simplified technical documentation form targeted at the needs of SMEs, including start-ups, and SMCs." Art 11(1)

Three features of the drafting matter in practice.

1. It is optional. An SMC "may" use the simplified route. It can always produce a full Annex IV file instead.
2. Opting in binds you to the form. "Where an SME, including a start-up, or an SMC, opts to provide the information required in Annex IV in a simplified manner, it shall use the form referred to in this paragraph." There is no simplified route other than the Commission form.
3. Notified bodies must accept it. "Notified bodies shall accept the form for the purposes of the conformity assessment." That matters for the Annex I products and the Annex III systems that go through a third-party procedure, covered in the conformity assessment explainer.

The form had not appeared on the Commission's AI Act pages or the AI Act Service Desk at the date of this article. Article 11(1) sets no deadline for it. The obligations it serves apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems under Article 113(c), so an SMC planning on the simplified route is planning against a document that does not yet exist. The content requirements of Articles 9 to 15 do not shrink with the form. The Annex IV guide sets out the nine blocks the file has to cover in either version.

Quality management under Article 17(2), and what Article 63 keeps for SMEs

Article 17(2), as amended, reads: "The implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the provider's organisation, in particular, if the provider is an SME, including a start-up, or an SMC. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation." Art 17(2)

That is proportionality in implementation, not a reduced list. All thirteen aspects in Article 17(1), points (a) to (m), still have to be addressed. The EN 18286 explainer covers how the harmonised standard approaches the system.

The separate, stronger route is not open to SMCs. Article 63(1) provides that "SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC", with the elements to be set by Commission guidelines. Article 63 does not mention SMCs.

Every other provision that names SMCs

A search of the consolidated text as at 27 July 2026 for "SMC" and "small mid-cap" across Articles 1 to 113 and Annexes I to XIV finds, beyond Articles 3(14b), 11(1), 17(2), 99(1) and 99(6a), the following. Each is a statement of focus, an objective or a commitment by the AI Office, the Commission or national authorities, none changes an SMC's obligations or fine exposure, and none appears in any annex.

• Article 1(2)(g). The subject matter now includes "measures to support innovation, with a particular focus on small mid-cap enterprises (SMCs) and small and medium-sized enterprises (SMEs), including start-ups".
• Article 57(3a). A Union-level AI regulatory sandbox the AI Office may establish for systems covered by Article 75(1) "shall provide priority access to SMEs, including start-ups, and SMCs".
• Article 57(9)(e). Sandboxes aim at "facilitating and accelerating access to the Union market for AI systems, in particular when provided by SMEs, including start-ups, and SMCs".
• Article 70(8). National competent authorities "may provide guidance and advice on the implementation of this Regulation, in particular to SMEs, including start-ups, and SMCs".
• Article 95(4). The AI Office and the Member States must take into account "the specific interests and needs of SMEs, including start-ups, and SMCs" when encouraging codes of conduct.
• Article 96(1), second subparagraph. The Commission's implementation guidelines must "pay particular attention to the needs of SMEs, including start-ups, and SMCs".

What the same search does not find is as useful. Article 4(2), on AI literacy support, names SMEs only, as the AI literacy page explains. Article 58(2)(d), on free sandbox access, and Article 62, on priority access to national sandboxes, training, communication channels and reduced conformity assessment fees, do not mention SMCs. Article 58(2)(d) and Articles 62(1)(a) and 62(2) are addressed to SMEs, including start-ups, alone. The national sandbox picture is in the regulatory sandbox explainer.

SME, small mid-cap and large company compared

Not one row in the table removes an obligation. Every category owes the same Article 5 prohibitions, the same high-risk requirements and the same Article 50 transparency duties. Size changes the ceiling on the fine and the format of some evidence, not whether the duty applies. Whether a system is high-risk at all is a separate question, and the classifier is the place to start.

What to check if you think you are a small mid-cap

1. Compute status on group figures. Take the latest approved accounts, add partner enterprises pro rata and linked enterprises in full under points 3 and 6 of the Annex to Recommendation (EU) 2025/1099, and test headcount below 750 and turnover up to €150 million or balance sheet up to €129 million. Confirm you are not already an SME.
2. Apply the two-period rule. If you crossed a ceiling in the latest year only, point 4.2 says status does not change until the ceilings are exceeded over two consecutive accounting periods.
3. Keep the working. The AI Act gives no SMC declaration procedure. The Annex, at the end of point 3.5.2, provides that enterprises may make a declaration of status as autonomous, partner or linked, including the ceiling data, which is worth preparing before an authority asks.
4. Map your exposure by tier. If your risk is in Article 5 territory, SMC status does not lower the cap. If it is in the high-risk regime, Article 50 or answers to authorities, Article 99(6a) does.
5. Do not plan around the form. Build the Annex IV evidence to the full requirements of Articles 9 to 15 now, and move it onto the simplified form once the Commission publishes one.
6. Do not borrow SME relief. Article 63 simplified quality management, Article 62(2) fee reductions and Article 58(2)(d) free sandbox access are not available to an SMC.