AI Act for SME Startups
The AI Act applies in full to SMEs, but recital 165 and Article 62 instruct member states to provide proportionate support — priority access to regulatory sandboxes, free SME-specific guidance, and simplified technical-documentation routes for microenterprises. The substantive obligations themselves do not shrink with company size.
Does AI Act apply to sme startups?
Yes — the AI Act applies to SMEs in full. Article 62 introduces proportionate facilitation measures (sandbox access, fee considerations, simplified documentation for microenterprises) but does not reduce the substantive obligations.
- Microenterprises may use a simplified Annex IV documentation form (Article 11(1) second subparagraph) — but only if the AI system is not high-risk under Annex I (product-safety lane)
- Priority access to AI regulatory sandboxes is reserved for SMEs and startups under Article 62(2)(a)
- Article 4 (AI literacy) applies to every provider and deployer regardless of size — train staff who design, deploy, or use AI systems
- Fees imposed by notified bodies must take SMEs' specific interests into account (Article 62(3)) — request the SME fee schedule
Who does AI Act apply to?
The AI Act applies to all participants in the AI value chain that place AI systems on the EU market, put them into service in the EU, or whose outputs are used in the EU — even where the provider or deployer is established outside the EU.
- Providers placing AI systems on the EU market or putting them into service in the EU
- Deployers established or located in the EU using AI systems in the course of professional activity
- Importers and distributors of AI systems in the EU
- Providers and deployers in third countries when the AI system's output is used in the EU
- General-Purpose AI (GPAI) model providers, with additional rules for models with systemic risk
What are the penalties for AI Act non-compliance?
The AI Act applies a three-band penalty regime. The highest band targets the use of prohibited AI practices. The middle band covers non-compliance with the obligations applicable to high-risk systems and GPAI models. The lower band targets the supply of incorrect or misleading information to authorities.
| Maximum fine | €35 million or 7% of global annual turnover, whichever is higher |
When does AI Act apply?
The AI Act entered into force on 1 August 2024 and applies in phases. The prohibitions on unacceptable-risk practices and the AI-literacy obligation apply first; the General-Purpose AI rules apply next; the bulk of obligations for high-risk systems apply on 2 August 2026; obligations for high-risk systems embedded in regulated products apply on 2 August 2027.
- 2024-08-01 — Entry into force
- 2025-02-02 — Prohibitions (Article 5) and AI-literacy obligation (Article 4) apply
- 2025-08-02 — Obligations for General-Purpose AI (GPAI) models apply
- 2026-08-02 — Most obligations for high-risk AI systems apply
- 2027-08-02 — High-risk obligations for Annex I-listed products apply
How to determine if your AI system is high-risk under the AI Act
Articles 6, 7 and Annex III set out the high-risk classification logic. Use this sequence to reach a defensible answer.
- 1
Check Annex I product safety lists
If the AI system is a safety component of, or itself is, a product covered by EU sectoral harmonisation legislation listed in Annex I (e.g. medical devices, machinery, toys), and that product must undergo third-party conformity assessment, the AI system is high-risk under Article 6(1).
- 2
Check Annex III use-case categories
If the AI system is used in one of the eight Annex III areas (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/border, administration of justice), it is in principle high-risk under Article 6(2).
- 3
Apply the Article 6(3) derogations
An Annex III system is not high-risk if it performs only a narrow procedural task, improves prior human work, detects decision-making patterns, or performs a preparatory task — provided it does not profile natural persons. Document the reasoning.
- 4
Register and document
If the system remains high-risk, register it in the EU database (Article 71) and prepare the Annex IV technical documentation prior to placing it on the market.
Maximum administrative fine under the EU AI Act for engaging in the prohibited AI practices listed in Article 5 (the highest of the three penalty bands).
Regulation (EU) 2024/1689, Article 99(3)
Next step — classify
Classify your AI systems against the AI Act
Targeted next step for sme startups based on AI Act scope.
Full AI Act compliance guide for all sectors and personas.
AI Act guideFor informational purposes only. This is not legal advice — consult qualified legal counsel.
Last reviewed: · Editorial policy