What does the AI Act mean for SMEs, startups and open source?

Why does size matter in the AI Act?

Size matters in the AI Act because the same substantive risk can impose very different burdens on a small team and on a large organisation. A quality management system, a technical documentation file, a conformity assessment and a post market monitoring plan all require people, time and money. A large provider can spread those costs across many products and many staff. A small provider cannot, and a requirement that is proportionate for a large provider can become a barrier to market entry for a small one. The Act responds to that difference in defined ways, rather than by removing the substantive requirements. Article 62 requires Member States to provide priority sandbox access, awareness raising and training, dedicated communication channels and facilitated participation in standardisation for SMEs including startups. Article 62 also requires conformity assessment fees to take account of the specific interests of SME providers, reducing them proportionately to size, market size and other relevant indicators. Article 63 allows microenterprises to comply with quality management requirements in a simplified manner, without reducing the level of protection. Those measures are support and proportionality, not a separate low risk category. A small provider of a high risk system must still meet the high risk requirements, but the way it meets them can be proportionate to its size and to the risk.

Who counts as an SME, a startup or a small mid-cap?

The Act uses SME by reference to Commission Recommendation 2003/361/EC, which defines micro, small and medium sized enterprises by staff headcount and by turnover or balance sheet total, with rules for partner and linked enterprises and for public body control. The thresholds are set out in the next guide in this cluster and must be checked in the Recommendation itself, because group relationships can change the answer. Startup is not given a separate legal definition in the Act in the same way; the Act refers to SMEs including startups, and support measures are framed for SMEs including startups rather than for a distinct startup category. A new company that is part of a larger group may therefore not be treated as an SME for a support measure, even though it is new. Small mid-caps, or SMCs, are a separate category added by Regulation (EU) 2026/1744, defined by reference to Recommendation (EU) 2025/1099 as enterprises that are not SMEs, employ fewer than 750 persons and have turnover not exceeding 150 million euro or a balance sheet total not exceeding 129 million euro. The SMC category extends defined SME simplifications to larger growing companies, but it does not create a general exemption. The three labels, SME, startup and SMC, must not be used interchangeably in a record. The record should state which label is relied on, which definition is used and what evidence supports it.

What open source relief exists, and what are its limits?

Open source relief in the AI Act is specific and conditional. Article 2(12) provides that the Regulation does not apply to AI systems released under free and open source licences, unless they are placed on the market or put into service as high risk AI systems or as systems falling under Article 5 or Article 50. That exclusion does not apply to providers of general purpose AI models in the same way, and the general purpose model provisions contain their own limited relief. Article 53(2) disapplies two documentation and information obligations for providers of general purpose models released under a free and open source licence that allows access, usage, modification and distribution and whose parameters, architecture information and usage information are publicly available, except for models with systemic risk. Article 54(6) gives parallel relief from the authorised representative duty on similar conditions. The copyright policy and training content summary duties in Article 53(1)(c) and (d) remain. A licence that restricts use, a model whose weights are not public, a monetised component, or a model with systemic risk can fall outside the relief. The guides on open source in this cluster examine each provision separately, because a release can meet one test and fail another.

How do the guides in this cluster fit together?

This cluster moves from definitions to duties to practical planning. The next guides define SME status, explain proportionate duties and support measures, and address startup planning for a first product. Two guides then examine open source AI systems and open source general purpose models separately, because the legal tests differ. A guide on small mid-caps explains the new category and its limits. Guides on sandboxes, cost and resourcing, contracting and simplified quality management for microenterprises complete the cluster. The order matters. A startup that starts with contracting or cost planning without first establishing its SME or SMC status, its role as provider or deployer, and its open source position will plan against the wrong assumptions. A team that starts with the open source exception without checking whether its system is high risk, prohibited or subject to Article 50 will also plan wrongly. The guides therefore cross refer to the role, classification and timeline guides elsewhere on this site, and each guide states what it does not decide. None of them determines whether a named company is an SME or SMC, or whether a named release is open source for AI Act purposes.

What should a small team do first?

A small team should start with a short, written inventory: the company and any group relationships, the AI systems and models it provides or deploys, the role for each, the intended purpose, the classification screening, the Article 5 screen, the transparency screen, and the open source status where relevant. It should then check the support available in its Member State: the sandbox, the communication channel, the training, the standardisation participation route and the conformity assessment fee arrangements. It should identify the standards and templates that apply to its system, and the documentation it will need to produce. It should plan resourcing honestly, including the time of the people who will write, review and maintain the file, and the external advice it will need for borderline questions. It should keep the inventory and the support contacts in one place, with dates, so that a later reviewer can see what was known and when. A small team that does that work early will find that the proportionate measures in the Act are usable. A team that leaves the inventory until a customer or authority asks for it will find that the same measures are difficult to use retrospectively.

Continue with who counts as an SME under the AI Act.

What does this overview not decide?

This overview does not decide whether any company is an SME, a startup or an SMC, does not decide whether any release qualifies for open source relief, and does not tell a small team what it must do for a specific system. It does not reproduce the SME or SMC definitions in full, does not list the support measures available in any Member State, and does not predict sandbox availability or fee levels. Member State measures, standards and guidance change, and the position must be checked with the national competent authority, the AI Office information platform and a legal adviser. This guide is a map to the support and relief provisions, not a determination for a named company or release.

Frequently asked questions

Continue through this AI Act cluster

• who counts as an SME under the AI Act
• open source AI systems, exceptions and limits
• small mid-caps under the AI Act
• sandboxes and support for smaller firms
• providers
• general purpose AI