Small Businesses’ Guide to the AI Act
AI Act Taylor Jones
The EU's AI Act comes with a whole toolkit specifically for small businesses and startups. Free sandbox access, simpler paperwork, and lower fines - if your company qualifies as an SME.
Based on reporting by AI Act, Taylor Jones — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Brussels doesn't usually get credited with going easy on small businesses, but the AI Act actually name-checks SMEs 38 times, more than 'industry' and 'civil society' combined. That's not an accident. Regulators clearly worried that a heavy compliance regime built for the likes of Google and Siemens would crush startups before they got off the ground, so they baked in a whole set of carve-outs.
The headline perk is regulatory sandboxes. Every EU member state has to stand up at least one, letting companies test AI systems under supervision without the usual red tape, and SMEs get priority access, free of charge, with simplified application steps. Luxembourg, Spain and Lithuania already have sandboxes running. If the UK's fintech sandbox is any guide, the payoff could be real: companies that went through it saw fintech investment jump 6.6 times, and market authorisation came 40% faster than the standard process.
Beyond sandboxes, the Act tries to shrink the paperwork burden. Conformity assessment fees have to scale with company size, the Commission is required to keep reviewing compliance costs, and fines for SMEs are capped by whichever number is lower rather than higher, unlike the calculation for bigger firms. Microenterprises get extra slack on quality management documentation, and the Commission is drafting simplified technical documentation templates specifically for small and micro companies that national authorities will have to accept.
There's also a seat at the table. SMEs are guaranteed representation in standard-setting processes and in the AI Board's advisory forum, plus dedicated communication channels in each member state — Austria already runs a Service Desk for AI. And for the tiny number of companies building genuinely massive models, the Code of Practice for general-purpose AI is being written with separate KPIs for smaller providers, acknowledging that a startup training a modest model shouldn't face the same bar as whoever built GPT-4o or Gemini 1.0 Ultra. Only 15 models worldwide cross the 10^25 FLOP systemic-risk threshold as of February 2025, so this mostly protects everyone else.
None of this matters much if implementation goes sideways, though. The text grants generous exemptions on paper, but whether national regulators actually deliver simple sandbox procedures, accept the simplified documentation forms, and keep fees proportional is a separate fight that plays out country by country over the next few years.
My take — AI-written commentary, not fact-checked reporting
I'll believe the SME-friendly rhetoric once I see a founder in Sofia or Ljubljana actually get through a sandbox application in under six months without hiring a compliance lawyer. Brussels loves writing generous provisions into law and then leaving national authorities to quietly under-resource them, and that gap between text and execution is exactly where European AI startups keep losing ground to their US and Chinese rivals who don't have this problem in the first place.
Read more about this at: AI Act