EU AI Act for Startups, SMEs and Small Mid-Caps: What the Digital Omnibus Actually Changes

Smaller companies were promised a lighter AI Act. With the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), some of that promise is now law. This guide separates the real relief from the headlines, and sets out what a startup should still do now.

The new category: small mid-caps

The Omnibus introduces a "small mid-cap" (SMC) definition and extends to SMCs flexibilities that previously applied only to SMEs. Per the advocacy group ACT's analysis, SMCs are companies with fewer than 750 employees and EUR 150 million in turnover. Note that ACT is an advocacy organisation, so check any threshold you rely on against the Official Journal text.

What relief exists

According to the ACT analysis and the Abreu Advogados summary, the main measures are:

• Simplified technical documentation: a simplified form that notified bodies must accept, for qualifying companies. Our Article 11 guide explains the full Annex IV file this simplifies.
• A quality management system scaled to company size, rather than a one-size-fits-all system. See Article 17.
• Priority access to regulatory sandboxes for SMEs, startups and SMCs. ACT calls this "a promise, not yet a guarantee", because entry requirements are not yet specified. National sandboxes must be established by 2 August 2027. Our Article 57 sandbox guide covers how they work.
• Real-world testing outside sandboxes extended to Annex III systems such as recruitment, education and credit scoring.
• Simplified EU database registration for systems exempted from high-risk status.
• Fine treatment that takes economic viability into account.

What did not change

• Article 5 prohibitions still apply, and two new bans (non-consensual intimate material and child sexual abuse material) apply from 2 December 2026.
• Article 50 transparency obligations applied from 2 August 2026. Systems already on the market have until 2 December 2026 for machine-readable marking; see our Article 50(2) post.
• The substance of high-risk requirements is the same. Delay does not reduce the work: ACT itself notes that compliance for a single high-risk product can cost in the hundreds of thousands of euros per Commission impact assessments.
• Role analysis still matters. A startup that fine-tunes or rebrands someone else's model may be a provider; see Article 25.

The deadlines that matter

• 2 December 2026: two new prohibitions apply, and the transition for labelling synthetic content ends for systems placed on the market before 2 August 2026.
• 2 August 2027: national sandboxes must be established.
• 2 December 2027: high-risk obligations for Annex III systems apply.
• 2 August 2028: high-risk obligations for Annex I systems apply.

Two softer changes worth knowing

AI literacy. Per Abreu Advogados, providers and deployers no longer have to ensure a sufficient level of AI knowledge; they must instead adopt measures that promote AI skills. Our Article 4 guide predates this change, so read it with that in mind.

Bias detection data. A new Article 4a allows, exceptionally, processing of special-category personal data to detect and correct bias, subject to necessity, pseudonymisation and deletion requirements.

A 12-month roadmap for a startup

1. Quarter 1: inventory and classify. List your AI features, work out your role for each (provider, deployer, both), and check whether any fall under Annex III. Use our 10-step triage guide.
2. Quarter 2: close the cheap gaps. Transparency notices for chatbots and generated content, an AI use policy, and AI skills measures for staff.
3. Quarter 3: build the foundations. If you are high-risk, start the risk management system, data governance and logging that will go into your technical file.
4. Quarter 4: engage. Apply to a sandbox where one is open, choose a conformity route, and put compliance clauses into customer contracts.

FAQ

Am I an SME, an SMC, or neither? Check headcount, turnover and ownership against the official definitions; group structure can push a subsidiary above the thresholds.

Do the new deadlines mean I can wait until 2027? Only for Annex III and Annex I high-risk obligations. Prohibitions and transparency rules are already live.

Will regulators go easy on small firms? The law lets enforcers consider size and viability, but do not treat that as an exemption.

This article is general information, not legal advice.