Why the small-company reliefs matter
The EU AI Act’s high-risk regime was written with large providers in mind, and the drafters knew it. Scattered across the Regulation are four distinct mechanisms intended to make the same rules bearable for a company of twenty people: proportionality in the quality management system, a simplified form of technical documentation, a lighter quality management route, and permission to fold AI Act work into systems a company already runs. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, widened two of them.
The honest summary for a Swedish founder is that the reliefs are real, that they are narrower than the coverage suggests, and that the most concrete of them cannot currently be used at all because the European Commission has not published the document it depends on. Knowing which is which is worth a good deal of planning time, because the reliefs that do work require you to structure things in a particular way from the start, and the ones that do not work are not worth waiting for.
Who counts as small under the AI Act
Three categories appear in the relevant provisions, and they are not interchangeable. A micro, small or medium-sized enterprise, or SME, is defined by reference to the Annex to Commission Recommendation 2003/361/EC — the long-standing EU definition based on headcount and either turnover or balance sheet total. Start-ups are named alongside SMEs rather than defined separately. A small mid-cap enterprise, or SMC, is a newer category introduced into the AI Act by the Digital Omnibus, defined by reference to the Annex to Recommendation (EU) 2025/1099; it sits above the SME ceiling and is intended to catch companies that have outgrown SME status but are not large enterprises.
Microenterprises, the smallest tier within the SME definition, get their own treatment in one place. A company therefore needs to know which labels it wears, because the four reliefs have different beneficiaries. One covers SMEs, start-ups and SMCs. One covers SMEs and SMCs. One covers microenterprises and is being widened to SMEs including start-ups, but not, on the face of the recital extending it, to SMCs. The fourth is open to anyone.
The four reliefs, and what each is actually worth
Proportionality in the quality management system
Article 17 requires providers of high-risk AI systems to operate a documented quality management system covering thirteen specified aspects. Article 17(2), as replaced by the Digital Omnibus, now provides that “the implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the provider’s organisation, in particular, if the provider is an SME, including a start-up, or an SMC. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation.”
The pre-Omnibus version was identical apart from the words naming SMEs, start-ups and SMCs, so the amendment made explicit what the text already implied. Its value is evidential: a small provider challenged on the depth of its documentation can point to a provision that names it. What proportionality does not do is stated in the same paragraph. It scales how elaborately the system is documented and run; it does not lower the required rigour or level of protection. A two-page procedure that works is compliant. A two-page procedure that leaves an aspect uncovered is not.
Simplified technical documentation, and the form that does not exist
This is the most concrete relief in the Act and, at present, the least usable. The Digital Omnibus replaced the second subparagraph of Article 11(1) to provide relief for “SMEs, including start-ups, and SMCs” in drawing up the Annex IV technical documentation. The provision says that where such a provider relies on it, “it shall use the form referred to in this paragraph”, and that “notified bodies shall accept the form”.
That last sentence is unusually strong. A notified body may not reject the simplified format for a qualifying provider. The difficulty is the sentence before it: the relief operates through a form, and the Commission has not published one. Until it does, a smaller provider cannot exercise the relief, because there is nothing to use. Two phrases circulating in commentary are worth ignoring: that the simplified documentation must contain “equivalent information”, and that a notified body may request specific additional information. Neither appears in the amended text.
The simplified quality management route in Article 63
Article 63, headed derogations for specific operators, allows microenterprises within the meaning of Recommendation 2003/361/EC to comply with certain elements of the Article 17 quality management system in a simplified manner, provided they have no partner or linked enterprises within the meaning of that Recommendation. That proviso excludes most venture-backed companies and most group subsidiaries, which is why the relief has had limited practical reach.
The Digital Omnibus widens it. Recital (28) of Regulation (EU) 2026/1744 records that Article 63 “offers microenterprises who are providers of high-risk AI systems the possibility to benefit from a simplified way to comply with the obligation to establish a quality management system” and that, “with a view to facilitating compliance for more innovators, that possibility should be extended to all SMEs, including start-ups”. Note the beneficiary set: SMEs including start-ups. The recital does not extend it to SMCs, which is a different answer from Article 17(2). What Article 63 has never done is exempt anyone from the substantive requirements. It expressly leaves in place the other obligations of the Regulation, including risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, post-market monitoring and serious incident reporting.
Integration with what you already run
The fourth mechanism is not a small-company relief at all, but it is often the largest saving available to one. Article 17(3) allows providers already subject to quality management obligations under sectoral Union law to include the AI Act aspects within that existing system. Article 9(10) does the equivalent for risk management, and Article 8(2) governs the interplay with sectoral legislation more generally. Recital (37) of the Omnibus identifies these three as the mechanisms that let operators integrate AI-specific risk into existing risk and quality management systems, and requires the Commission to publish guidelines on their application by 1 August 2027 at the latest.
What is not scaled down
It is worth being blunt about the limits, because the reliefs are often reported as though the high-risk regime were now optional for small companies. It is not. Article 9, the risk management system at the centre of the Chapter III package, was not amended by the Digital Omnibus and contains no proportionality provision for smaller providers at all. Neither do the data governance requirements of Article 10, the technical documentation content of Annex IV, the logging requirements of Article 12, the instructions-for-use requirements of Article 13, the human oversight requirements of Article 14, or the accuracy, robustness and cybersecurity requirements of Article 15.
There is a further asymmetry that hits smaller companies hardest. No AI Act harmonised standard has yet been cited in the Official Journal, so no provider has a presumption of conformity available. A large company can absorb that by writing its own justification for every technical choice. A company of fifteen people is where the absence of a citable standard bites, and no relief addresses it.
Praktiskt exempel
A Linköping start-up of twelve people builds an AI system that assesses student submissions for vocational training providers. Systems used to evaluate learning outcomes fall within Annex III, so it is a provider of a high-risk AI system. It has raised a funding round, so it has partner enterprises, and it does not qualify for the Article 63 microenterprise route in its current form — though the Omnibus extension to SMEs including start-ups would bring it in.
Its realistic position is this. It gets proportionality under Article 17(2), so its thirteen quality management aspects can be short, practical documents rather than a corporate manual. It cannot yet use the Article 11 simplified technical documentation, because the form does not exist, so it should build its Annex IV file conventionally and adopt the simplified form later if one appears in time. It gets no relief on Articles 9 to 15, where most of the engineering work sits. With the high-risk obligations applying from 2 December 2027 for Annex III systems, the sensible plan is to build the full package now at small scale rather than wait for reliefs that may never arrive in usable form.
Vanliga misstag som företag gör
The first is treating proportionality as a discount on outcomes rather than on documentation. Article 17(2) says in terms that the degree of rigour and level of protection must be respected in any event, and a supervisory authority reading a thin file will look at whether the system was actually controlled, not at how many pages describe it.
The second is planning around the Article 11 simplified form as though it existed. The relief is real and the obligation on notified bodies to accept the form is strong, but a provider cannot use a form that has not been published, and building your documentation strategy around its arrival is a scheduling risk with no upside.
The third is assuming the labels are interchangeable. An SMC gets Article 17(2) proportionality and the Article 11 relief, but the Omnibus recital extending Article 63 names SMEs including start-ups and stops there. The fourth is missing the partner-and-linked-enterprise condition in Article 63, which excludes most companies that have taken outside investment. The fifth is concluding from the reliefs that the substantive requirements have been softened. They have not.
Rekommenderade åtgärder
Establish which categories your company falls into, on paper, and keep the assessment current — headcount, turnover and ownership all move, and partner or linked enterprises can appear with a single funding round. Then plan against the reliefs that work today rather than the ones that might: proportionality under Article 17(2) is available now and shapes how you write your quality system, and integration under Articles 8(2), 9(10) and 17(3) is available now if you already run a sectoral quality or risk framework.
Build the Annex IV technical documentation conventionally, and treat any simplified form the Commission publishes as a later optimisation rather than a dependency. Put the engineering effort where no relief exists: risk management under Article 9, data governance under Article 10, and the accuracy and robustness work under Article 15. Those are the requirements that will decide whether a small provider passes conformity assessment, and they are the same for a company of twelve as for a company of twelve thousand.
Vanliga frågor
Does the AI Act exempt small companies from the high-risk rules?
No. There is no small-company exemption from the high-risk regime. What exists is proportionality in how the quality management system is implemented, a simplified technical documentation route that is not yet operable, a simplified quality management derogation, and permission to integrate with sectoral systems. The substantive requirements in Articles 9 to 15 apply in full.
What is an SMC, and why does it suddenly appear?
A small mid-cap enterprise is a category introduced into the AI Act by the Digital Omnibus, defined by reference to Recommendation (EU) 2025/1099. It captures companies above the SME thresholds but below large-enterprise scale. It appears in the Article 17(2) proportionality rule and the Article 11 documentation relief, but not in the recital extending the Article 63 derogation.
Should we wait for the simplified documentation form before starting?
No. The form has not been published, and the high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Build the Annex IV documentation in the ordinary way and adopt the simplified form if and when it becomes available.
Slutsats
The AI Act’s treatment of smaller providers is better than it is often given credit for and weaker than the headlines about simplification suggest. Proportionality is genuine and now expressly names start-ups and small mid-caps. Integration with existing sectoral systems is the largest saving on offer. The simplified documentation route is well drafted and currently unusable. And the technical core of the high-risk regime is not scaled for anyone. For a small Swedish provider planning towards December 2027, the reliefs are worth understanding precisely and worth building around, but they are not a reason to start later.
Lawgent helps smaller businesses map their AI Act obligations, use the reliefs that are actually available, and build proportionate compliance documentation.
