Summary Under the proposed Cloud and AI Development Act (CADA), small and medium-sized enterprises (SMEs) are defined by reference to Commission Recommendation 2003/361/EC. As proposed, Article 2(8) ties SME status to that standard EU definition, and CADA then attaches specific advantages to it — most concretely, automatic cross-border recognition of a level-1 EU statement of conformity (Article 17(3)), and an objective that at least 25% of public procurement for cloud and AI go to innovative SMEs (Article 33(4)). Note: some SME measures often associated with the AI Act (such as regulatory sandboxes and reduced conformity-assessment fees) are not part of CADA.

Detail

To see how CADA treats smaller providers, start with the definition. As proposed, Article 2(8) defines a "small and medium-sized enterprise" or "SME" as a small or medium-sized enterprise as defined in Article 2 of Annex I to Commission Recommendation 2003/361/EC. That recommendation uses three criteria: fewer than 250 staff, annual turnover not exceeding EUR 50 million, and/or an annual balance-sheet total not exceeding EUR 43 million. A startup meeting these thresholds is an SME for CADA's purposes.

CADA also defines a related category. Article 2(9) defines a "small mid-cap" or "SMC" by reference to point 2 of the Annex to Commission Recommendation (EU) 2025/1099 — a tier above SMEs that several CADA support objectives mention alongside SMEs.

The point of singling out SMEs is to lower barriers to entry for smaller European providers and foster a more competitive, diverse cloud and AI ecosystem, in line with CADA's broader aim of reducing dependence on a small number of non-European providers.

How SME status helps under CADA

1. Automatic recognition for cloud sovereignty (level 1) This is the most concrete benefit. For Union assurance level 1, providers ordinarily submit an EU statement of conformity to the evaluating national competent authority for recognition (Article 17(3), first subparagraph). By way of derogation, as proposed, an EU statement of conformity issued under Article 19(2) by a provider that is an SME is directly and automatically recognised in all Member States without prior recognition by the evaluating authority (Article 17(3), second subparagraph). This removes a step that other providers must complete. Note that this derogation applies to level 1 only; levels 2, 3 and 4 still require independent third-party audits (Article 20).

2. A 25% procurement objective for innovative SMEs As proposed, Article 33(4) provides that Member States shall pursue, as an objective, that at least 25% of their procurement for cloud computing services and AI systems be awarded to innovative SMEs, and shall include plans to achieve this in their national strategies (referred to in Article 7). This is an objective rather than a hard quota, but it is intended to drive demand toward smaller providers.

3. SME-friendly procurement design and monitoring Article 33 more broadly requires Member States to monitor procurement of innovation and to use that monitoring to identify and remove barriers to SME participation — for example through simplified, proportionate and SME-friendly procurement strategies, division into lots where appropriate, and promotion of pre-commercial procurement. Member States must report yearly to the Commission on SME participation, including the number of contracts awarded to SMEs and their share of total contract value (Article 33(3)). Union entities and contracting authorities must also promote preliminary market consultations, matchmaking with innovative European SMEs and start-ups, and contract clauses favourable to innovative SMEs (Article 33(5)).

4. Particular attention in data-centre support Where data-centre operators in acceleration zones receive administrative assistance, the single point of contact must, under Article 12(4), pay particular attention to SMEs and, where appropriate, establish a dedicated SME communication channel.

5. Support through the leadership initiatives CADA's Cloud and AI Leadership Initiatives (Title II, beginning at Article 3) repeatedly reference SMEs and SMCs as intended beneficiaries — for example, supporting the scaling-up of spin-offs and start-ups emerging from universities, SMEs and SMCs. CADA itself does not directly distribute funds; it sets the framework within which such support and related Union programmes operate.

What this means for you

For cloud and AI startups operating as SMEs, the definition is a strategic asset, not a formality.

  • Verify your status: Confirm you meet the staff and financial thresholds in Commission Recommendation 2003/361/EC. If you are near a threshold, track your growth — crossing it can change your eligibility for SME-specific advantages.
  • Use automatic level-1 recognition: If you provide cloud services to the public sector, aim for Union assurance level 1 and rely on the Article 17(3) derogation so your EU statement of conformity is recognised across the Union without prior recognition.
  • Target the SME procurement objective: Position offerings against the 25% objective for innovative SMEs in Article 33(4), and watch for SME-friendly procurement design (lots, pre-commercial procurement, matchmaking).
  • Plan for higher levels separately: SME status does not exempt you from the audit requirements for levels 2–4; budget for independent audits if you target those tiers.

Common misconceptions

  • "CADA gives SMEs regulatory sandboxes and reduced conformity-assessment fees."
    • Reality: Those measures are associated with the EU AI Act, not CADA. CADA's concrete SME-specific advantages are the level-1 automatic-recognition derogation (Article 17(3)) and the procurement provisions in Article 33; it does not establish AI regulatory sandboxes or set conformity-assessment fees.
  • "SME status exempts me from compliance."
    • Reality: It does not. SMEs must still meet the applicable Union assurance-level criteria; the benefits are procedural (automatic level-1 recognition) and market-facing (procurement objectives), not exemptions.
  • "Startups are automatically SMEs."
    • Reality: A startup must actually meet the thresholds in Recommendation 2003/361/EC. A fast-growing startup that exceeds them no longer qualifies for SME-specific advantages.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.