SME and Small Mid-Cap Exemptions

The EU Digital Omnibus introduces a new category of protected businesses: Small Mid-Caps (SMCs). By extending exemptions and simplifications to companies with up to 749 employees, the regulation eliminates the "cliff edge" compliance burden that hits growing businesses and saves an estimated €5-19 million annually across the European economy.

The Growth Problem

The SME Cliff Edge

Under current EU law, businesses enjoy lighter regulatory treatment while they qualify as SMEs (Small and Medium Enterprises):

SME definition (Commission Recommendation 2003/361/EC):

• Fewer than 250 employees
• AND either:
  • Annual turnover ≤ €50 million, OR
  • Balance sheet total ≤ €43 million

Examples of SME exemptions:

• GDPR Article 30: No processing record requirement (with exceptions)
• Simplified audit requirements
• Lighter reporting obligations
• Reduced fees for certifications

What Happens at 250 Employees

The cliff edge: A company crossing from 249 to 250 employees suddenly faces:

• Full GDPR Article 30 processing records
• Complete Data Act compliance
• All AI Act obligations without transition
• Higher fees for data access requests
• Maximum regulatory burden overnight

Real-world impact:

• Growth deterrent (companies delay hiring)
• Compliance shock (sudden cost increase)
• Resource strain (must rapidly build compliance infrastructure)
• Competitive disadvantage vs. companies that stayed below threshold

Economic inefficiency: A company with 250 employees is not fundamentally different from one with 249, yet faces drastically different regulatory treatment.

The Solution: Small Mid-Caps (SMCs)

New Category: SMCs

The Digital Omnibus creates an intermediate category between SMEs and large enterprises:

Small Mid-Cap (SMC) definition:

• 250-749 employees
• AND either:
  • Annual turnover ≤ €150 million, OR
  • Balance sheet total ≤ €129 million

Rationale: Companies in this range are still growing, resource-constrained, and deserve proportionate regulation.

How Many Companies Qualify?

Approximately 38,000 companies across the EU fall into the SMC category.

Sectors with high SMC presence:

• Technology and software
• Manufacturing
• Professional services
• Healthcare providers
• Logistics and transportation
• Hospitality and tourism

Geographic distribution: Concentrated in larger Member States (Germany, France, Italy, Spain) but present in all EU countries.

Extended Exemptions for SMCs

1. Public Sector Data Access Fees

Current rule (Data Act): SMEs can request waiver of fees for accessing public sector data

Extended: SMCs also qualify for fee waivers

Savings: Approximately €500 per data access application

Use cases:

• Weather data for logistics optimization
• Geographic data for urban planning services
• Traffic data for mobility applications
• Public procurement data for market analysis

Annual impact: €5-19 million savings across SMC sector (based on estimated application volumes)

Benefit: Levels playing field with large enterprises that can more easily absorb data access costs

2. Data Intermediation Compliance

Current complexity: Data intermediation service providers face heavy compliance burden

Extended: SMCs receive simplified compliance pathways for data intermediation services

Simplifications:

• Lighter monitoring requirements
• Reduced documentation burden
• Proportionate transparency obligations
• Risk-based supervision

Impact: Encourages SMCs to offer data intermediation services (data marketplaces, sharing platforms, cooperatives) without prohibitive compliance costs

Market effect: More competition in data intermediation market; benefits data providers and users

Learn more: Data Intermediation Services

3. Cloud Switching Requirements

Data Act Chapter V: Rules for switching between cloud and data processing services

Extended: SMCs receive lighter regime for:

• Switching assistance obligations (as providers)
• Contract transparency (as users)
• Data portability implementation (as providers)

Rationale: SMC cloud providers don't have resources of hyperscalers; proportionate rules enable competition

Benefit: SMC cloud providers can compete without matching compliance investment of AWS/Azure/Google Cloud

4. Browser Signal Implementation (GDPR Article 88b)

Article 88b(6): Browsers must provide technical means for consent signals

Exemption: SME browser providers are exempt

Extended to SMCs: Since browsers are software products, SMC browser vendors (if any) would also be exempt

Practical impact: Limited (most browsers are from large tech companies), but removes barrier for innovative browser startups that grow into SMC size

Examples: Brave, Vivaldi, or regional browsers could grow to SMC size without facing Article 88b(6) implementation burden

5. AI Act Compliance (via AI Omnibus)

Separate proposal: AI Omnibus (COM(2025) 836) extends AI Act exemptions to SMCs

Extended provisions:

• Longer compliance timelines for high-risk AI systems
• Simplified conformity assessment procedures
• Reduced technical documentation requirements
• Lighter post-market monitoring obligations

Coordination: AI Omnibus and Digital Omnibus work together for coherent SME/SMC treatment across digital regulations

Impact: SMC AI developers can innovate without compliance burden designed for large AI labs

GDPR Article 30 Extension (Proposed)

Current GDPR Article 30

Article 30(5) exempts SMEs from maintaining processing records unless:

• Processing is high-risk
• Processing includes special categories (Article 9) or criminal data (Article 10)
• Processing is regular and systematic

In practice: Most SMEs must maintain records anyway due to exceptions

Omnibus IV Proposal

Separate legislative proposal (Omnibus IV) currently under discussion:

Proposal: Extend Article 30(5) exemption to SMCs

Status: Being negotiated by European Parliament and Council (not part of Digital Omnibus COM(2025) 837)

Expected timeline: Adoption in 2026-2027

If adopted: SMCs would not need processing records unless high-risk/special categories/regular systematic processing

Savings: Significant reduction in administrative burden for SMCs (records require substantial compliance resources)

Note: This is separate from the Digital Omnibus but demonstrates broader EU policy of proportionate SMC treatment

Size Thresholds Comparison

Visual Overview

┌─────────────────────────────────────────────────────────────┐
│ MICRO ENTERPRISE                                            │
│ < 10 employees                                              │
│ Turnover/Balance Sheet ≤ €2M                                │
│ → Maximum exemptions and simplifications                    │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ SMALL ENTERPRISE                                            │
│ < 50 employees                                              │
│ Turnover/Balance Sheet ≤ €10M                               │
│ → SME exemptions apply                                      │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ MEDIUM ENTERPRISE (SME)                                     │
│ < 250 employees                                             │
│ Turnover ≤ €50M OR Balance Sheet ≤ €43M                     │
│ → SME exemptions apply                                      │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ SMALL MID-CAP (SMC) ← NEW CATEGORY                          │
│ 250-749 employees                                           │
│ Turnover ≤ €150M OR Balance Sheet ≤ €129M                   │
│ → SME exemptions EXTENDED by Digital Omnibus                │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ LARGE ENTERPRISE                                            │
│ ≥ 750 employees                                             │
│ OR Turnover > €150M AND Balance Sheet > €129M               │
│ → Full compliance obligations                               │
└─────────────────────────────────────────────────────────────┘

Determining Your Category

Step 1: Count employees

• Include full-time equivalent (FTE)
• Include employees in parent and subsidiary companies (group concept)

Step 2: Calculate annual turnover OR balance sheet total

• Based on last approved accounting period
• Consolidate group accounts if applicable

Step 3: Apply thresholds

Category	Employees	Turnover	Balance Sheet
Micro	< 10	≤ €2M	≤ €2M
Small	< 50	≤ €10M	≤ €10M
Medium (SME)	< 250	≤ €50M	≤ €43M
SMC (NEW)	250-749	≤ €150M	≤ €129M
Large	≥ 750	> €150M	> €129M

Note: You must meet employee threshold AND (turnover OR balance sheet). If you exceed both turnover AND balance sheet but are under employee threshold, you're still in the category.

Example 1:

• 300 employees
• €80M turnover
• €60M balance sheet
• Result: SMC (employees 250-749, turnover ≤ €150M)

Example 2:

• 600 employees
• €200M turnover
• €180M balance sheet
• Result: Large enterprise (exceeds SMC thresholds)

Example 3:

• 240 employees
• €70M turnover
• €50M balance sheet
• Result: SME (under 250 employees, even though financials exceed SME limits)

Benefits Summary

For SMCs (Direct Benefits)

Financial savings:

• €500 per public sector data access request (fee waiver)
• Reduced compliance costs (lighter data intermediation regime)
• Lower certification and audit costs
• Delayed AI Act compliance costs

Operational benefits:

• Simpler compliance processes
• Proportionate documentation requirements
• Risk-based supervision (less frequent audits)
• More time to implement new obligations

Competitive advantages:

• Can offer data services without prohibitive costs
• Compete with large enterprises for data-driven innovation
• Attract investment (lower regulatory risk)
• Scale without cliff-edge compliance shock

For the EU Economy (Indirect Benefits)

Encourages growth:

• Companies less hesitant to hire 250th employee
• Smooth transition from SME to mid-cap
• Reduced "threshold gaming" (deliberately staying small)

Promotes innovation:

• More SMC participation in data economy
• More data intermediation providers (competition)
• More AI development by mid-sized companies
• More diverse market (not just tech giants)

Job creation:

• Companies can grow to 750 employees without regulatory deterrent
• High-skill jobs in tech, data, AI sectors
• Regional employment (SMCs often rooted in local communities)

Market competition:

• SMCs can challenge large incumbents
• More diverse data service offerings
• Consumer choice and innovation

Comparison with Other Jurisdictions

United States

No equivalent: U.S. generally does not create intermediate regulatory categories between small business and large enterprise

CCPA/CPRA: Some exemptions for businesses under revenue thresholds, but no mid-cap category

Impact: EU SMCs have regulatory advantage over U.S. mid-sized companies

United Kingdom

Post-Brexit: UK considering similar SME/SMC distinctions in data and digital regulation

Status: Proposals under discussion; no implemented SMC category yet

Convergence: Likely UK will adopt similar approach for competitiveness

Asia-Pacific

Varied approaches:

• Japan: Some SME exemptions in data protection law
• South Korea: Tiered compliance based on business size
• Australia: Limited SME exemptions

EU leadership: SMC category is innovative; may influence global regulatory design

Practical Guidance for SMCs

If You Qualify as SMC

Step 1: Verify your status

• Calculate employees, turnover, balance sheet
• Confirm you meet 250-749 employee threshold
• Check financial thresholds

Step 2: Identify applicable exemptions

• Public sector data access: Apply for fee waivers
• Data intermediation: Use simplified compliance
• Cloud services: Leverage lighter switching regime
• AI Act: Monitor AI Omnibus adoption for extended timelines

Step 3: Update compliance documentation

• Privacy policies: Reflect proportionate obligations
• Data processing records: Check if GDPR Article 30(5) extension applies (Omnibus IV)
• Vendor contracts: Negotiate based on SMC status

Step 4: Engage with regulators

• National competent authorities may have SMC-specific guidance
• Participate in industry consultations
• Seek clarification on borderline cases

If You're Growing Toward SMC Status

Plan ahead:

• Track employee count and financials
• Anticipate threshold crossing
• Budget for compliance changes

Smooth transition from SME to SMC:

• Incremental compliance build-up
• No cliff edge (extended exemptions continue)
• More time to mature compliance functions

Growing from SMC to large enterprise:

• At 750 employees or financial thresholds, exemptions end
• Plan 6-12 months ahead for full compliance
• Consider phased hiring to manage transition

Limitations and Conditions

Not All Exemptions Apply

SMC status does NOT exempt from:

• Core GDPR obligations (lawful basis, transparency, security)
• Fundamental data subject rights
• High-risk processing safeguards
• Sector-specific regulations (financial services, healthcare)

SMC exemptions are limited to:

• Proportionate administrative requirements
• Fee reductions
• Simplified reporting
• Lighter documentation (where risk permits)

Group Company Rules

Parent-subsidiary relationships:

• Employee count includes entire group
• Financial thresholds consolidate group accounts
• Cannot split company to qualify for SMC status

Example: Parent company with 100 employees and subsidiary with 200 employees = 300 total (SMC category)

Monitoring and Enforcement

Abuse prevention:

• Supervisory authorities can challenge SMC status claims
• Must demonstrate genuine compliance with thresholds
• Artificial structuring to gain SMC status may be disregarded

Verification:

• Based on audited accounts where applicable
• Self-certification with potential spot checks
• Penalties for fraudulent claims

Future Developments

Omnibus IV (Ongoing)

Proposal: Extend GDPR Article 30(5) to SMCs

Status: Co-legislators negotiating

Expected: Adoption 2026-2027

Impact: Major administrative relief for SMCs (no processing records unless high-risk)

AI Omnibus (Parallel)

Proposal: COM(2025) 836

SMC provisions:

• Extended AI Act timelines
• Simplified conformity assessment
• Lighter documentation

Status: Legislative process (parallel to Digital Omnibus)

Expected: Adoption 2026-2027

Broader SMC Policy

EU trend: Recognizing SMCs as distinct category across regulations

Future areas:

• Tax simplifications
• State aid eligibility
• Public procurement preferences
• Research funding access

Policy goal: Enable European SMCs to scale and compete globally

Related Resources

• EU Digital Omnibus Overview - Complete regulation guide
• Data Intermediation Services - How SMCs benefit from voluntary regime
• Timeline and Implementation - When SMC exemptions take effect
• GDPR Amendments - GDPR changes that may affect SMCs

Key Takeaways

1. New SMC category: 250-749 employees, extending SME protections
2. Approximately 38,000 EU companies qualify as SMCs
3. €5-19M annual savings across SMC sector from fee exemptions alone
4. Eliminates cliff edge: Smooth transition from SME (249 employees) to SMC (250-749)
5. Extended exemptions: Public data fees, data intermediation, cloud switching, browser signals
6. Coordination with AI Omnibus: SMC treatment extends to AI regulation
7. Economic benefits: Encourages growth, innovation, job creation, competition
8. Verify your status: Calculate employees and financials to determine if you qualify

The SMC category represents a sophisticated understanding of business lifecycle. By recognizing that a company with 250 employees is not suddenly a large enterprise, the Digital Omnibus enables European mid-sized companies to grow, innovate, and compete without being crushed by regulatory burden designed for tech giants. This proportionate approach to regulation may prove to be one of the Omnibus's most significant contributions to European competitiveness.