Blog Post
Crossing 750 Employees Triples an AI Act Penalty
September 29, 2026
Compliance cost is usually modeled as scaling with size. More systems, more documentation, more effort, roughly in proportion.
For high-risk AI in Europe it jumps at a threshold. Regulation (EU) 2026/1744 created a new category of small mid-cap enterprise that inherits reliefs previously reserved for smaller firms, so an organization approaching the boundary faces a discontinuity rather than a gradient, and one of the steps is a penalty calculation that inverts.
Where Are the Boundaries?
Three of them now rather than one, which is the first thing a growth plan has to account for.
Small enterprises sit below fifty staff. Small and medium-sized enterprises sit below two hundred and fifty. The new category covers organizations that are not SMEs, employ fewer than seven hundred and fifty people, and have annual turnover not exceeding one hundred and fifty million euro or a balance sheet total not exceeding one hundred and twenty-nine million.
Which Test Binds First?
Headcount, because it is conjunctive while the financial tests are alternatives. An organization has to satisfy the employee count and then either the turnover or the balance sheet figure, so the seven hundred and fifty-first employee removes eligibility regardless of how modest the revenue is. What the obligations require does not change with size.
What Does the Relief Consist Of?
Four things, and they are not equally valuable.
The amendment rewrote the second subparagraph of Article 11(1) so that the documentation still has to contain the elements of Annex IV at a minimum, while smaller organizations and the new category may provide those elements in a simplified manner, with the Commission required to establish a form targeted at their needs. More proportionate quality management expectations, reduced regulatory sandbox fees and a different penalty calculation complete the set.
Which Is Worth the Most?
The penalty calculation, by a wide margin, and it gets the least attention because it looks technical.
How Does the Penalty Change?
It inverts, which is the sharpest step in the whole boundary and the one worth computing for your own figures.
Administrative fines for general obligations and for providing incorrect information are normally the higher of a percentage of worldwide turnover or a stated monetary amount. For SMEs and the new category, the lower of the two applies instead.
What Does That Look Like Arithmetically?
Breaching a high-risk obligation carries fifteen million euro or three percent of worldwide turnover. At a hundred and fifty million euro of turnover, three percent is four and a half million. Inside the category you pay the lower figure and outside it you pay the higher, so the same breach at the same size costs more than three times as much on the far side of the line.
What Does Not Change?
Most of it, and stating that plainly prevents the relief being read as an exemption.
The deadlines are the same, at December 2027 for standalone high-risk systems and August 2028 for those embedded in regulated products. The obligations are the same, since Annex IV still has to be answered. The conformity assessment is the same. What changes is the volume and detail of the documentation, the proportionality of the quality management expectation, and how a fine is computed.
The Prohibitions Are Untouched
The penalty benefit expressly does not extend to prohibited practices, which carry up to thirty-five million euro or seven percent of worldwide turnover. So the most severe exposure in the Act is identical at every size, and an organization treating the category as a general softening has misread the most expensive provision.
Is the Relief Available Yet?
Legislated and not operational, which is an awkward position and worth knowing before budgeting against it.
The simplified form has to be established by the Commission, which is required to publish templates and guidance before the December 2027 deadline. Until it appears, an eligible organization knows it will be permitted to submit less and cannot see how much less. Planning against an unpublished template is planning against an unknown.
What Should Be Done in the Meantime?
Assemble against Annex IV itself rather than against the anticipated simplification, since the elements are required at a minimum in both versions. Work done to the full standard transcribes into the simplified form, and work scoped to a guessed simplification may not, which storing observations rather than documents addresses as a general principle.
How Should a Growth Plan Treat the Boundary?
As an input rather than a constraint, since the answer is almost never to stay below it.
Crossing the threshold changes the penalty exposure on every high-risk system operated, and the change is computable from turnover and the number of systems in scope. An organization forecasting a crossing in the next two years should know the figure before it happens rather than discovering it during a hiring round.
Which Also Affects the Documentation Decision
An organization expecting to cross will submit under the full standard eventually, so building to the simplified form and rebuilding later costs more than building once. One near the boundary and not growing has the opposite calculation, and AI compliance readiness assessed per requirement is what shows how much of either version already exists.
Does Group Structure Affect Eligibility?
Materially, and it is the question most likely to produce a wrong answer from an internal estimate.
The definitions come from established EU law on enterprise size, which looks at linked and partner enterprises rather than at a single legal entity in isolation. A subsidiary of a large group counts differently from a standalone company with identical headcount and revenue, so the entity performing the calculation is not necessarily the entity the test applies to.
Which Function Should Answer It?
Whoever maintains the group structure, meaning finance or company secretarial rather than a compliance team working from an organization chart. The figures are ordinary reporting data and the aggregation rule is the part that requires the right source.
What About a Portfolio?
Each entity is assessed on its own facts including its links, so a sponsor holding several companies may find some eligible and others not, with different documentation and penalty positions across the same portfolio. Reporting exposure in one comparable unit is what makes that legible, and governing AI across a portfolio sets out the reporting problem that creates.
What Should Be Established?
Four figures, and all four are already known inside the organization.
Current headcount against the seven hundred and fifty threshold, and the trajectory. Which of the turnover or balance sheet test the organization satisfies, since only one is needed. How many systems would be classified high-risk, because the penalty exposure multiplies across them, which categorizing systems by what they do establishes. Then what a high-risk breach would cost at your turnover under both calculations, since that difference is the value of the category and the cost of leaving it.
The Cost Jumps, It Does Not Scale
A new category covers organizations that are not SMEs, employ fewer than seven hundred and fifty people, and satisfy either a turnover or a balance sheet test, so there are now three boundaries rather than one. Headcount binds first because it is conjunctive while the financial tests are alternatives. The relief covers simplified Annex IV documentation, proportionate quality management, sandbox fees and a penalty calculation, and the penalty calculation is worth the most because it inverts from the higher of a percentage or a fixed amount to the lower. The deadlines, the obligations and the conformity assessment are identical on both sides, and the prohibited practices exposure is untouched at every size. The simplified form also does not exist yet, so assembling against Annex IV itself is the only safe approach. Kovrr's AI compliance readiness shows how much of either version existing records answer.
To see how much of an Annex IV requirement your existing records already satisfy, book a demo mapped to your own estate.
Small Mid-Cap Threshold FAQs
Speak to an ExpertWhat is a small mid-cap enterprise under the EU AI Act?
Does the 750 employee threshold use turnover or balance sheet?
Are EU AI Act penalties capped for SMEs and small mid-caps?
Does the SME relief apply to prohibited AI practices?
Who qualifies for simplified technical documentation under the AI Act?
Does simplified documentation change the AI Act deadlines?
