If your company has fewer than 750 employees and annual turnover up to €150 million (or a balance sheet up to €129 million), the EU quietly handed you a lighter AI Act compliance regime in July 2026. The Digital Omnibus — Regulation (EU) 2026/1744 — extended the simplifications previously reserved for SMEs to a brand-new category called the small mid-cap (SMC): simplified technical documentation, more proportionate quality-management expectations, priority access to regulatory sandboxes, and tailored penalty caps.
Most compliance guides don't mention any of this, because the category didn't exist when they were written.
Last verified: August 10, 2026. This is general information for business planning, not legal advice — for decisions about your specific obligations, talk to counsel qualified in EU law. For the full amended timeline, start with our pillar guide to the EU AI Act deadlines after the Digital Omnibus.
What is a small mid-cap (SMC)?
A small mid-cap is an EU company-size category sitting between the classic SME and the large enterprise: an enterprise that is not an SME, employs fewer than 750 people, and has either annual turnover up to €150 million or an annual balance sheet total up to €129 million (the EU definition).
The category exists to fix a real gap. EU regulation has long given SMEs (under 250 employees) lighter obligations, while everyone above that line got the full enterprise regime — even a 300-person company with nothing resembling an enterprise compliance department. The AI Act, as amended by the Digital Omnibus, is one of the first major EU laws to plug that gap.
Do you qualify as an SMC?
Run the two tests in order:
- Headcount: fewer than 750 employees, but more than the SME ceiling (if you're under 250 employees with SME-level turnover, you're an SME and already had these reliefs).
- Financials: annual turnover ≤ €150 million, or balance sheet total ≤ €129 million. You only need to pass one of the two.
So a 300-person software company with €80M revenue qualifies. A 500-person manufacturer with €140M turnover qualifies. An 800-person company does not, regardless of revenue.
One trap to avoid: a separate EU legislative file — the "Omnibus IV" company-law package — has been negotiating a different small mid-cap definition with higher thresholds. Coverage of the two files blurs together online. For AI Act purposes, the numbers that matter are 750 employees and €150M/€129M. For the full threshold mechanics — including how the SME and SMC lines interact and where border cases land — see our companion guide to the SMC vs SME definitions under the AI Act.
What relief do SMCs actually get?
Per the Morgan Lewis analysis of the June 2026 agreement and Orrick's summary of the final text, the SME simplification package now extended to SMCs covers four things:
- Simplified technical documentation. High-risk AI documentation is the single biggest paperwork lift in the AI Act. SMCs can use streamlined documentation templates proportionate to their size, rather than the full enterprise-grade Annex IV dossier (Baker Botts flags this as one of the two headline extensions).
- More proportionate quality-management expectations. The quality management system a 400-person company must show is not the one demanded of a 40,000-person one.
- Priority access to regulatory sandboxes. National AI sandboxes let you test novel systems under supervisory guidance before full conformity obligations bite — SMCs now queue with SMEs, ahead of large enterprises.
- Tailored penalty caps. Company size gets special consideration in the assessment of penalties, so the fine mathematics no longer assume enterprise turnover.
What SMC status does not change
Being an SMC is a lighter version of the same obligations — not an exemption from them. Three things apply to you exactly as they do to everyone else:
- Article 50 transparency rules are live now (since August 2, 2026): disclose AI interactions, label AI-generated content and deepfakes, and support machine-readable marking (with a grace period to December 2, 2026 for generative systems already on the market). Size doesn't matter here.
- The high-risk substance still arrives on December 2, 2027 for Annex III systems — hiring tools, credit scoring, education, critical infrastructure. That date is fixed in the final text. Risk management, human oversight, logging, and conformity assessment are all still coming; the SMC package changes how much paper they generate, not whether they apply.
- Prohibited practices are prohibited for everyone, including the new bans on nudification and CSAM-generation apps from December 2, 2026.
The SMC compliance timeline at a glance
| Date | What an SMC must do |
|---|---|
| Now | Article 50 transparency: disclose AI touchpoints, label AI content. Confirm SMC qualification (headcount + financials) and document it. |
| December 2, 2026 | Machine-readable marking for generative AI systems that were on the market before August 2, 2026; new prohibitions apply. |
| December 2, 2027 | Annex III high-risk obligations — using the simplified SMC documentation route and proportionate quality management. |
| August 2, 2028 | High-risk AI embedded in regulated products (medical devices, machinery, toys). |
How to use SMC status this quarter
- Confirm and document your qualification. Headcount and either financial test, with the figures filed where your future auditor can find them. If you're near a threshold, get counsel's read now, not in 2027.
- Inventory and classify your AI systems. Map everything against Annex III — most SME/SMC automation (support triage, internal workflow agents, content operations) is not high-risk, and knowing which of your systems are changes the budget by an order of magnitude. The pillar guide walks the full timeline.
- Plan documentation on the simplified route from day one. The cheapest technical documentation is the kind your systems generate as they run — per-interaction logs, decision trails, human-handoff records. Retrofitting that onto a black-box vendor tool in late 2027 is the expensive version.
- Consider a sandbox slot for anything novel. If you're building something near the high-risk line, priority sandbox access is the cheapest supervisory feedback you will ever get.
- Demand audit trails from whoever builds your AI. This is how we build AI agents at PxlPeak — permissions, activity logs, and human handoff are architecture, not an add-on — which is precisely the evidence the simplified documentation route still requires. If you're deciding what to automate first with 2027 in view, talk to us.
Is an SMC exempt from the EU AI Act?
No. SMCs get a simplified version of the same obligations — lighter documentation, proportionate quality management, better sandbox access, and size-aware penalties. The substantive requirements for high-risk systems, the Article 50 transparency rules, and all prohibitions apply to SMCs in full.
Sources
- European Commission — AI Omnibus enters into force (July 2026)
- EUR-Lex — Commission Recommendation on the definition of small mid-cap enterprises
- Morgan Lewis — EU Approves Delays and Other Amendments to Certain EU AI Act Obligations (June 2026)
- Orrick — EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes (July 2026)
- Baker Botts — EU Parliament and Council Provisionally Agree on Amendments to EU AI Act (2026)