The AI Act for SMEs: proportionality, sandboxes and costs

Short answer: The AI Act makes no exception for SMEs, but it does build in relief. The weight of the obligations depends on the risk of your AI system, not on your company size — but for small businesses there is proportionate documentation, priority in regulatory sandboxes, and a fines regime that takes size into account. So start with the risk question, not the panic question.

First the risk question, not size

Most AI applications in SMEs fall into the minimal or limited risk categories: then at most transparency duties apply, such as telling a user they are dealing with AI. Only if you provide or deploy a high-risk system do the heavy obligations come into play. Many SMEs panic needlessly: first honestly determine which risk category your application falls into — see the state of AI regulation.

Proportionality in practice

Where obligations do apply, the way you meet them may be proportionate to your size. The AI Act and accompanying guidelines allow small businesses to keep technical documentation in a simplified form, as long as the essence is demonstrably present. Proportionality does not mean "exempt", but it does mean: no documentation burden that only a large group can carry. What you must have ready at minimum is set out in preparing for an audit.

Regulatory sandboxes

Every Member State must set up at least one regulatory sandbox: a controlled environment in which you can develop and test an AI system under supervision before market launch. SMEs get:

• priority and free or affordable access to the sandbox;
• guidance from the supervisor, which lowers uncertainty and legal costs;
• room to learn without immediate enforcement risk, provided you stick to the arrangements.

For a small business the sandbox is often the cheapest route to certainty.

Controlling costs

The costs lie mainly in documentation, conformity assessment and governance. Limit them by: following standards and codes of practice instead of reinventing the wheel, reusing supplier documentation, and making use of the AI Office and national help desks. The fines regime applies the lower of the percentage or fixed-amount cap for small businesses, so the penalty is not business-threatening — but the norm itself applies in full.

What to do

• Classify your systems: minimal, limited or high risk — that determines everything.
• Use a sandbox if you are developing something new; request priority as an SME.
• Reuse documentation from suppliers and follow codes of practice.
• Keep it proportionate: simplified documentation is allowed, as long as the essence is right.
• Know the SME fines cap — see fines and enforcement.