Since 27 July 2026 the AI Act has a second size category. Small mid-cap enterprises, or SMCs, are firms that have outgrown the SME definition but still employ fewer than 750 people. They now get part of the relief the AI Act reserved for SMEs. Not all of it. Four of the reliefs that matter most to a Dutch company of 250 to 500 staff were deliberately left behind, and one of them concerns fines.
What is a small mid-cap under the AI Act?
The category comes from Commission Recommendation (EU) 2025/1099 of 21 May 2025. Point 2 of its Annex defines a small mid-cap as an enterprise that is not an SME, employs fewer than 750 people, and has either an annual turnover of at most 150 million euro or a balance sheet total of at most 129 million euro.
The word to read twice is "either". The Recommendation's own recital 11 states that an enterprise drops out of the category only if both its turnover and its balance sheet exceed the ceilings. A distributor with 120 million euro of turnover and a light balance sheet is still an SMC. So is a manufacturer with a heavy balance sheet and modest revenue. Most companies in this band clear one of the two tests comfortably, which makes headcount the criterion that decides in practice.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, inserted this by reference into Article 3 of the AI Act as new point (14b), alongside a new point (14a) that finally defines "SME" by reference to Recommendation 2003/361/EC. Before 27 July 2026 the AI Act used the word SME throughout without ever defining it. The Commission's own small mid-caps factsheet puts the population at roughly 38,000 companies across the EU and describes the problem it is solving as a "cliff edge" at 249 employees.
Which AI Act relief do small mid-caps actually get?
Eleven provisions now name SMCs. The two with practical weight are these.
- Simplified technical documentation. Article 11(1) now lets SMEs and SMCs supply the Annex IV elements in a simplified manner, using a form the Commission must publish. Notified bodies are obliged to accept that form. Note the wording: if you choose the simplified route you must use the form, not your own shortened version. The form itself had not been published at the time of writing.
- A lower fine ceiling, partially. A new Article 99(6a) gives SMCs the lower of the percentage or the fixed amount for the fines in Article 99(4) and (5), rather than the higher of the two that applies to large companies.
The rest are softer. Article 17(2) says a quality management system must be proportionate to the size of the provider, now explicitly mentioning SMCs. Article 99(1) tells member states to weigh an SMC's economic viability when setting penalties. Articles 70(8), 95(4) and 96(1) direct authorities to aim guidance at SMCs. A new Article 57(3a) lets the AI Office set up a Union-level sandbox with priority access for SMCs, but only for systems covered by Article 75(1), meaning systems built on a general-purpose model that the same provider also supplies. A mid-market firm that buys its models will not qualify. Useful in places, but none of it is an exemption from a requirement.
Which SME relief do small mid-caps still not get?
This is where reporting on the omnibus has been loose. "SME exemptions extended to small mid-caps" was the common summary. Four significant ones were not extended.
- Article 63, the quality management system derogation. The omnibus did widen this, from microenterprises to all SMEs including start-ups, and recital 28 explains that as helping "more innovators". SMCs were not included. A 300-person company is not an SME, so the one provision that genuinely relaxes a substantive obligation does not reach it.
- The Article 99(6) fine cap. SMEs get the lower-of treatment across Article 99(3), (4) and (5). The new SMC rule covers only (4) and (5). Paragraph 3 is the prohibited-practices fine of 35 million euro or 7 percent of worldwide turnover. For an SMC that one still applies at whichever figure is higher.
- Free sandbox access. Article 58(2)(d) makes national regulatory sandboxes free of charge for SMEs including start-ups. It was not amended.
- Article 62 in its entirety. Priority access to national sandboxes and proportionately reduced conformity assessment fees under Article 43 both sit in Article 62, and the omnibus did not touch that article at all.
So the honest summary is narrower than the headlines: an SMC gets lighter paperwork and a softer ceiling on most fines. It does not get the substantive derogation, the least expensive route into a sandbox, or a discount on conformity assessment.
Why you should ignore the "1,000 employees" headline
If you followed this story in the business press you may have the number 1,000 in your head. That comes from a different file. The Single Market Omnibus, sometimes called Omnibus IV, would define SMCs as firms under 1,000 employees with up to 200 million euro of turnover or 172 million euro of assets. Parliament and Council negotiators reached a provisional agreement on 9 June 2026.
Provisional is the operative word. That text still needs formal adoption by both institutions and publication in the Official Journal. More importantly, it works on MiFID II, the Prospectus Regulation, the GDPR record-keeping rules and the critical-entities directive, in a package that also reworks battery due diligence and the F-gas Portal. It does not amend the AI Act. The AI Act points at Recommendation 2025/1099, so for AI Act purposes the threshold is 750 employees. A firm with 900 staff reading about SMC relief is reading about capital markets and F-gases, not about its AI project.
Can a Dutch holding structure cost you the relief?
Quite possibly, and this is the check most worth doing first. The SMC definition inherits the machinery of the SME definition: autonomous, partner and linked enterprises, with a 25 percent holding as the threshold, and consolidation of headcount and financials across linked enterprises. Point 3.3 of the Annex also excludes any enterprise where public bodies control 25 percent or more of the capital or voting rights, subject to the investor exceptions in point 3.4.
For Dutch companies this matters more than it does in many member states, because the holding BV is the default structure rather than the exception. An operating company of 300 people sitting under a holding that also owns three sister companies is assessed on the group, not on the payroll of the entity that signed the software contract. Count the group before you count your own staff.
There is a possible counterweight, and it is worth knowing how weak it is. Recital 15 of the Recommendation says venture capital and private equity funds should not qualify as linked enterprises where the enterprise and the fund keep separate accounting records and the fund has a pre-defined exit strategy. The operative Annex is less generous. Point 3.4 makes its investor derogation conditional on the investor not being linked under point 3.5, and point 3.5(a) is holding a majority of the voting rights. A minority participation is defensible on the recital. A majority stake is an argument, not a given.
Article 63 goes further still and rules out anyone with partner or linked enterprises at all. That carve-out survived the omnibus untouched, so a group-owned company of any size gets nothing from Article 63 even when it is comfortably SME-sized.
What this means for a Dutch mid-market AI project
Start with a vocabulary problem. CBS classifies Dutch firms as zzp, microbedrijf of 2 to 10 staff, and klein- en middenbedrijf of 10 to 250. Anything above 250 is grootbedrijf. In every Dutch conversation a 300-person company has, with its bank, its accountant, its sector association or the national statistics office, it is a large enterprise. Brussels has just created a category saying it is almost an SME, and nothing in the Dutch context will point that out. That gap is the reason this relief will go unclaimed.
The sandbox point is where it bites soonest. The cabinet put the uitvoeringswet AI-verordening out for internet consultation on 20 April 2026, closing 1 June 2026, proposing a hybrid model in which existing sector regulators supervise AI within their own domains, with the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur coordinating. When a Dutch sandbox opens, an SMC arrives with neither the free access of Article 58(2)(d) nor the priority of Article 62(1)(a). Budget for the fee and the queue.
On timing, two dates are widely confused. Annex III high-risk obligations now apply from 2 December 2027 and Annex I product-embedded systems from 2 August 2028. Article 50 transparency was not postponed. It has applied since 2 August 2026, whenever the system reached the market. What sits on 2 December 2026 is narrower than it looks. The new Article 111(4) gives providers of systems generating synthetic audio, image, video or text that were on the market before 2 August 2026 until that date to comply with Article 50(2), the machine-readable marking of synthetic output, and nothing else. It says nothing about the Article 50(1) duty to tell people they are dealing with a machine, which has been live since August. If you deploy a purchased assistant rather than supply one, Article 111(4) does not reach you at all. The same date also carries the new prohibitions on non-consensual intimate imagery. Our Article 50 labelling explainer covers what that disclosure has to look like.
What to do before 2 December 2027
- Establish the group headcount. Consolidate linked enterprises and check the 25 percent public-body rule. This is an afternoon with your accountant and it determines everything downstream.
- Separate provider from deployer. Most mid-market firms deploy purchased systems rather than place their own on the market. Deployer duties under Article 26 are a different and shorter list, and Article 11 documentation relief is a provider benefit. Our risk checker walks the classification.
- Do not wait for the simplified form. The Annex IV subject matter is not shrinking, only its presentation. Assemble the underlying material now and reformat later.
- Record the Article 4 literacy measures. The literacy duty is not size-dependent and has applied since February 2025, though the omnibus softened it from ensuring a sufficient level of AI literacy to taking measures to support its development. Write down what you did.
Small mid-cap status is worth claiming, and it is worth claiming accurately. It moves paperwork and it softens most fines. It does not move a single system out of the high-risk annexes. Treat the classification as a gate on the way from pilot to production rather than a filing exercise: decide now which internal function owns the Annex IV material and who signs it off, because that is the question that stalls a mid-market rollout in its second year. If you want the classification settled before the December 2027 date arrives, our AI Act checklist for mid-sized firms and the applied AI service for 250 to 500 FTE organisations are the two places to start. For the wider omnibus picture, see our earlier analysis of the Digital Omnibus.
Last updated: 17 September 2026.
Our AI Act Check (€950 fixed) gives you your risk classification, obligations and a concrete to-do list within one week — including what you can safely ignore.
See the AI Act Check →