EU AI Act SME and Start-up Relief: What Is Already Law and What the Digital Omnibus Adopted

If you run a small or medium-sized enterprise or a start-up and you are working out which EU AI Act concessions you can actually rely on, here is the honest answer: some relief is already enacted and usable today, and a separate, more talked-about layer is the Digital Omnibus deferral package, now adopted by Parliament and Council and awaiting only Official Journal publication. Confusing the two is the most common planning mistake smaller providers make.

Four relief measures are already enacted and in force in Regulation (EU) 2024/1689: the simplified technical-documentation form under Article 11(1), the proportional administrative-fine cap under Article 99(6), and — both under Article 62 — proportionate conformity-assessment fees and priority access to regulatory sandboxes. Separately, the Digital Omnibus adopted further burden reduction and a deferral of the high-risk start dates — passed by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — and that package now awaits only Official Journal publication, expected before 2 August 2026.

This article maps every SME and start-up relief measure against that single line: enacted versus adopted. The non-negotiable caveat throughout is that relief is proportionality, never exemption — your obligations still flow from your role and the risk class of each system, not from company size.

---

Two Things at Once: Relief That Is Already Law vs Relief the Digital Omnibus Has Now Adopted

The Act and the Digital Omnibus pull in the same direction — lighter load for smaller companies — but they have very different legal status, and you need to keep them apart.

Already enacted and usable today, independent of any pending legislation:

• the simplified Annex IV technical-documentation form for SMEs and start-ups (Article 11(1));
• the proportional fine cap at the lower of the percentage or fixed amount (Article 99(6));
• proportionate conformity-assessment fees (Article 62);
• priority access to AI regulatory sandboxes (Article 62).

Adopted, pending Official Journal publication:

• the further SME and start-up burden reduction framed in the Digital Omnibus;
• the deferral of the high-risk start dates negotiated in that same package.

The distinction is commercial, not academic. The enacted measures you can build into a compliance plan now; the Digital Omnibus measures are adopted and pending only the formality of Official Journal publication, so you can plan against the deferred dates with confidence.

Throughout, hold the line that relief never becomes exemption. A 30-person company that provides a high-risk recruitment tool carries the same substantive duties as a multinational that provides one. What the Act softens is documentation volume, fees, sandbox access and fine ceilings — not the underlying Chapter III, Section 2 requirements.

---

Who Counts as an SME or Start-up Under the Act

The Act does not invent a size threshold. It borrows the established EU definition in Commission Recommendation 2003/361/EC: fewer than 250 staff, and either annual turnover not exceeding EUR 50 million or a balance-sheet total not exceeding EUR 43 million. Within that band, micro enterprises (fewer than 10 staff and turnover or balance sheet not exceeding EUR 2 million) and small enterprises receive the most proportionate treatment.

Start-ups are not separately defined. The Act consistently pairs "SMEs, including start-ups" across its proportionality provisions, so if you meet the Recommendation 2003/361/EC thresholds the relief is available regardless of how young the company is.

The trap is ownership. The linked-enterprise and partner-enterprise tests in Recommendation 2003/361/EC apply in full. A company that, on its own headcount and turnover, sits comfortably inside the SME band may not qualify if it is majority-owned by a large group — the group's figures are aggregated. Document your size classification explicitly: headcount, turnover or balance-sheet total, and ownership structure. If a market surveillance authority later disputes your entitlement to proportionate treatment, that record is your defence. This section is the gate to every relief measure that follows.

---

Relief Already Enacted in Regulation (EU) 2024/1689

Four concessions are live in the statute today. None of them depends on the Digital Omnibus.

The simplified technical-documentation form (Article 11(1), Annex IV)

Article 11(1) directs the Commission to establish a simplified technical-documentation form that meets the needs of SMEs, including start-ups, who may then complete and use it. It condenses the drafting effort and volume of the Annex IV content categories; it does not lower the substantive Chapter III, Section 2 obligations behind them. One caveat as of June 2026: the enabling provision is in force, but the template itself is still pending Commission specification. You cannot use a finished simplified form today because there is not yet one to use.

The proportional administrative-fine cap (Article 99(6))

The Act sets fines as the higher of a fixed euro amount or a percentage of worldwide turnover. Article 99(6) flips that for SMEs and start-ups: each administrative fine is capped at the lower of the percentage or the fixed-amount figure, and authorities must take the company's interests and economic viability into account. It is a structural cap, not an exemption.

The three penalty tiers it softens are precise. Article 99(3) sets infringement of the Article 5 prohibited practices at up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Article 99(4) sets most high-risk and other obligation breaches at up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. Article 99(5) sets supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities at up to EUR 7.5 million or 1% of total worldwide annual turnover, whichever is higher. For an SME, Article 99(6) takes the lower side of each.

Proportionate conformity-assessment fees (Article 62)

Article 62 directs Member States and the AI Office to set conformity-assessment fees proportionately to the size, market and relevant interests of SMEs and start-ups. Where a high-risk system needs assessment, that fee is meant to scale to the company, not flatten every provider to the same figure.

Priority access to regulatory sandboxes (Article 62)

The same article requires SMEs and start-ups to be given priority access to AI regulatory sandboxes — controlled environments where you can test a high-risk system under regulatory supervision before market entry. For a small provider, that supervised runway is a genuine de-risking tool, not a paperwork concession.

All four are live concessions you can plan around today, independent of the Digital Omnibus.

---

The Digital Omnibus High-Risk Deferral (Now Adopted)

The status has to be stated precisely, because it changes how you plan. The Digital Omnibus is adopted: the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026. It enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality that does not change the dates below.

What was agreed uses fixed calendar dates. The "stop the clock" variant — which would have tied the delay to the availability of harmonised standards — was rejected, so the deferral must not be described as standards-contingent. And not everything is delayed: Article 5 prohibitions, Article 4 AI literacy and the GPAI obligations under Articles 51-55 are untouched.

The adopted high-risk deferrals are:

• stand-alone Annex III systems (Article 6(2)): from the statutory 2 August 2026 to 2 December 2027;
• product-embedded Annex I systems (Article 6(1)): from 2 August 2027 to 2 August 2028.

Stand-alone high-risk Annex III obligations now apply from 2 December 2027. The Omnibus also delivers further SME and start-up burden reduction. For the full legislative-status picture, see the dedicated pages on what the Digital Omnibus 2027 deferral means and is the EU AI Act delayed.

---

At a Glance: Enacted vs Adopted Relief

The table below is the article's centrepiece, and the enacted/adopted split is the load-bearing column. The seven rows cover four enacted measures and three adopted under the Digital Omnibus.

The four enacted rows you can build into a plan now. The three Digital Omnibus rows are adopted and can be planned against directly, pending only Official Journal publication.

---

Worked Example: A 40-Person HR-Tech Start-up

Consider Wendlin Talent, a 40-staff EU HR-tech start-up with turnover of EUR 6 million. Its product is a CV-screening tool that ranks job applicants — an Annex III point 4(a) recruitment use case, so the system is high-risk and Wendlin Talent is its provider. Comfortably inside the Recommendation 2003/361/EC thresholds, and not group-owned, it qualifies for SME and start-up relief.

What it can rely on now: build the technical file against full Annex IV today and condense it into the Article 11(1) simplified form when the Commission publishes it; apply for Article 62 proportionate fees and priority sandbox access; and bank the Article 99(6) lower-of cap on any fine. On timing, it plans against 2 December 2027 for the high-risk stand-alone obligations, now that the Digital Omnibus deferral is adopted.

Now the second scenario, because over-scoping is the other common error. Wendlin Talent also gives staff a general productivity assistant internally. Most general business AI of that kind (productivity assistants, coding tools, search and RAG, marketing, routing) is not high-risk. The realistic duties there are Article 4 AI literacy, Article 50 transparency where AI output reaches third parties, and data governance. None of the high-risk relief is even relevant to that tool, and treating it as high-risk would waste the team's scarce capacity.

Finally, the role trap. If Wendlin Talent puts its own name or trademark on a third-party model, makes a substantial modification, or changes the intended purpose so a system becomes high-risk, it becomes a provider under Article 25. And a non-EU provider of a high-risk system must appoint an EU authorised representative under Article 22. Relief does not change which role you occupy; it only softens the edges once your role and risk class are fixed.

---

How to Use the Relief You Actually Have Today

Work the enacted measures in order, and do not wait on the agreed ones.

1. Confirm and document SME or start-up status. Test against Recommendation 2003/361/EC — headcount, turnover or balance sheet, and ownership — and write the result down so your entitlement is defensible.
2. Classify each system. Run each AI system through Article 6 and Annex III to find where high-risk relief even applies. Most general business tools fall out as not high-risk; that honesty saves effort.
3. Apply for Article 62 relief where a high-risk system is in scope. Request priority sandbox access and proportionate conformity-assessment fees early — sandbox slots are finite.
4. Build the technical file against full Annex IV now. Compile each content block as if for the complete dossier, then condense into the Article 11(1) simplified form once the Commission publishes it. The evidence is identical either way, so nothing is wasted.
5. Plan the timeline against the adopted dates. Use 2 December 2027 for stand-alone Annex III, now that the Digital Omnibus deferral is adopted.

Do not treat the Article 99(6) cap as a strategy. It is a backstop: the lower-of cap still scales fines to turnover, so completeness still matters — a capped fine on an incomplete file is still a fine.

---

How Confir helps

Confir is EU-native and built around the structure of the Regulation. It classifies each system under Article 6 and Annex III, derives whether you are a provider or a deployer, and tracks which relief measures apply to each system — so the enacted-versus-adopted split is reflected per system rather than assumed across the board.

The synthesis engine is deterministic and rule-based — the same inputs produce the same output, with the article or annex citation behind every finding. No model inference, no hallucination. Because the logic is rule-based, you can explain why each relief measure was flagged for a given system, which is exactly what an auditor or market surveillance authority will ask.

Confir builds the Annex IV technical file today and is ready to map it into the Article 11(1) simplified SME form once the Commission publishes the template, tracking the applicable deadline per system and reflecting the Digital Omnibus dates now that the deferral is adopted. On scope, Confir is honest about its limits: the GPAI provider workflow under Articles 51-55 is partial and on the roadmap, and Confir does not claim complete GPAI provider compliance. For the operational next step, smaller teams should read the simplified Annex IV documentation form for SMEs and compliance software for SMEs.

---

Frequently asked questions

What SME relief under the EU AI Act is already law right now?

Four measures are already enacted in Regulation (EU) 2024/1689. The Article 11(1) simplified technical-documentation form for SMEs and start-ups (though the Commission has not yet published the template), the Article 99(6) proportional fine cap at the lower of the percentage or fixed amount, and, under Article 62, proportionate conformity-assessment fees plus priority access to regulatory sandboxes. These are usable today and do not depend on the Digital Omnibus.

Does the EU AI Act exempt SMEs or start-ups?

No. The relief is proportionality, not exemption. Obligations flow from your role (provider or deployer) and the risk class of each system under Article 6 and Annex III, not from headcount. A 30-person company providing a high-risk system carries the same substantive duties as a large one; what the Act softens is documentation volume, fees, sandbox access and fine ceilings, not the underlying requirements themselves.

How does the Article 99(6) fine cap actually work for SMEs?

The EU AI Act sets fines as the higher of a fixed euro amount or a percentage of worldwide turnover: up to EUR 35M or 7% for prohibited practices (Article 99(3)), EUR 15M or 3% for most obligation breaches (Article 99(4)), and EUR 7.5M or 1% for incorrect or misleading information to authorities (Article 99(5)). Under Article 99(6), for SMEs and start-ups the fine is instead capped at the lower of those two figures, and authorities must weigh the company's economic viability.

What did the Digital Omnibus change for SMEs, and is it law?

The Digital Omnibus delivers further SME and start-up burden reduction plus a high-risk deferral. It is adopted: the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026. It enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality that does not affect the dates.

When do high-risk obligations actually start for an SME?

The Digital Omnibus, now adopted, defers these using fixed calendar dates: stand-alone high-risk Annex III obligations apply from 2 December 2027, and product-embedded Annex I obligations from 2 August 2028. Plan against those dates; only Official Journal publication remains, expected before 2 August 2026.

Can an SME use the simplified Annex IV form today?

Not yet as a finished template. Article 11(1) requires the Commission to establish the simplified form, but it has not been published as of June 2026. The practical approach is to build your technical file against the full Annex IV structure now and condense it into the simplified layout once the template appears, since the underlying evidence is identical either way.

Is most of our business AI even high-risk enough to need this relief?

Often not. Most general business AI, such as productivity assistants, coding tools, search and RAG, marketing and routing, is not high-risk. The realistic duties there are Article 4 AI literacy, Article 50 transparency where AI output reaches third parties, and data governance. SME high-risk relief only matters where a system actually falls under Annex III, for example recruitment screening under point 4(a) or critical-infrastructure safety components under point 2.

---

Related guides

• The simplified Annex IV documentation form for SMEs
• Compliance software for SMEs
• What the Digital Omnibus 2027 deferral means
• Is the EU AI Act delayed
• The Article 99 penalty tiers