Data Act SME Exemptions: Article 7 for Micro and Small Enterprises, the Medium-Sized Grace Year and the Small Mid-Cap Proposal

The carve-out sits in Regulation (EU) 2023/2854, the EU Data Act.

The Regulation has been in force since 11 January 2024 and has applied since 12 September 2025 (Art. 50); Articles 4 and 5 also reach connected products already on the market.

Medium-sized enterprises get one year, other SME rules sit in Chapters III to V, and a small mid-cap definition is pending.

Table 1: ceilings from the Annex to Recommendation 2003/361/EC; the small mid-cap row is pending as of 5 November 2026.

What Does Article 7 Exempt Micro and Small Enterprises From?

Article 7(1) Regulation (EU) 2023/2854 switches off the obligations of Chapter II, such as the design duty of Article 3 and the access and sharing duties of Articles 4 and 5, for data generated through connected products or related services of a qualifying micro or small enterprise. The carve-out attaches to the data from the enterprise's own products and services, as the Article 7 text shows; who the Data Act applies to beyond size sits on the parent page.

Which Enterprises Count as Micro or Small

A microenterprise employs fewer than 10 persons and has an annual turnover or balance sheet total of at most EUR 2 million, and a small enterprise employs fewer than 50 persons with at most EUR 10 million (Art. 2(26) and 2(25) Data Act, with Art. 2(3) and 2(2) of the Annex to Recommendation 2003/361/EC). Table 2 lists the counting rules, including the reference period and the two-period rule (Annex Art. 4(1) and 4(2)).

Table 2: all defined terms are in the Data Act definitions.

The Partner and Linked Enterprise Condition

Article 7(1) fails if the enterprise has a partner or linked enterprise within the meaning of Article 3 of the Annex to Recommendation 2003/361/EC that is not itself micro or small. A holding of 25 % or more makes a partner (Annex Art. 3(2)), except for business angels investing less than EUR 1,250,000 in the same enterprise (Art. 3(2)(a)) and small autonomous local authorities (Art. 3(2)(d)).

Enterprises are linked where one holds a majority of the voting rights in the other, may appoint or remove a majority of its management body, may exercise dominant influence under a contract or its articles, or alone controls a majority of its voting rights under an agreement with other shareholders (Annex Art. 3(3)).

The Subcontracting Condition

The carve-out also fails where the micro or small enterprise is subcontracted to manufacture or design a connected product or to provide a related service (Art. 7(1)). The duty then stays with the product or service, as explained under connected products under the Data Act.

How Does the Medium-Sized Grace Year Work?

Article 7(1), second subparagraph, Regulation (EU) 2023/2854 gives medium-sized enterprises one year, not a permanent exemption: the Chapter II obligations are off for data from an enterprise medium-sized for less than one year and for its connected products during one year after it placed them on the market. Medium-sized means fewer than 250 persons and a turnover of at most EUR 50 million or a balance sheet total of at most EUR 43 million (Art. 2(1) of the Annex).

Enterprises That Became Medium-Sized Less Than a Year Ago

The first window covers data from products and related services of an enterprise that has qualified as medium-sized for less than one year (Art. 7(1), second subparagraph). Recital 41 states: "Such a transitional period does not apply where such a medium-sized enterprise has a partner enterprise or a linked enterprise that does not qualify as a microenterprise or a small enterprise or where such a medium-sized enterprise was subcontracted to manufacture or design the connected product or to provide the related service."

Products a Medium-Sized Enterprise Placed on the Market

The second window runs per product: connected products are outside Chapter II for one year after the date on which a medium-sized enterprise placed them on the market (Art. 7(1), second subparagraph). After that year the product carries the full Chapter II duties, including data access by design for products placed on the market after 12 September 2026.

What Article 7 Does Not Switch Off

Article 7(1) covers only the Chapter II obligations for the enterprise's own products and services, so Article 7(2), the cost cap of Article 9(4), the unfair-terms test of Article 13, Chapter V and the cloud switching rules each apply by their own terms. Table 3 maps each rule.

Small Firms Acting for Another Manufacturer's Products

A micro or small enterprise may still carry Data Act requirements as data holder where it is not the manufacturer of the connected product or the provider of the related service (recital 41).

Contract Terms That Cut the User's Chapter II Rights

Article 7(2) makes any contractual term that, to the detriment of the user, excludes, derogates from or varies the effect of the user's Chapter II rights not binding on the user. Recital 25 and Commission FAQ v1.4 (Q19) let a business user waive using or sharing data against proportionate compensation; the rights are set out in the user's right to access data.

The Cost-Only Price for SME Data Recipients

Where the data recipient is an SME or a not-for-profit research organisation without non-SME partner or linked enterprises, compensation is capped at the costs of making the data available under Article 9(2)(a) (Art. 9(4)). Commission FAQ v1.4 (Q39) reads this as no margin, while other recipients may be charged a reasonable compensation that may include a margin (Art. 9(1)).

Public-Sector Requests to Micro and Small Enterprises

Micro and small enterprises are protected only against non-emergency requests: Article 15(2) disapplies Article 15(1)(b) to them, while public-emergency requests under Article 15(1)(a) still reach them. Article 20(1) free provision excludes micro and small data holders, and Article 20(3) lets them claim fair compensation. The pending proposal COM(2025) 837 would also bar mitigation or recovery requests to them (proposed Art. 15a(3)).

Unfair Terms and Cloud Switching Apply Regardless of Size

Article 13(1) protects any enterprise on which a contractual term is unilaterally imposed, and Commission FAQ v1.4 (Q41) states that Chapter IV does not specifically address SMEs. The 2022 proposal COM(2022) 68 limited the test to SMEs; the adopted text does not. As of 5 November 2026, no size-based exemption from Chapter VI is in force, as cloud switching under the Data Act explains.

The Small Mid-Cap Proposal in the Digital Omnibus

The small mid-cap enterprise is not a category of the Data Act in force: the Commission's Digital Omnibus proposal COM(2025) 837 would add it as a new definition in Article 2(45), pointing to Commission Recommendation (EU) 2025/1099, and is pending as of 5 November 2026. The Recommendation was adopted on 21 May 2025 and published on 28 May 2025; the Data Act in force does not refer to it.

What the Proposal Would Change for SMEs and Small Mid-Caps

A small mid-cap enterprise under Recommendation (EU) 2025/1099 has fewer than 750 persons, a turnover of at most EUR 150 million or a balance sheet total of at most EUR 129 million, and is not an SME (Annex point 2). Its business angel ceiling is EUR 5,000,000 (Annex point 3.4(a)).

The proposal would relieve SME and small mid-cap cloud providers of Chapter VI, except Article 29, and of Article 34 for services other than infrastructure as a service, under contracts concluded on or before 12 September 2025. It would add small mid-caps to the SME evaluation point of Article 49(1)(m), but would not amend Article 7, so the carve-out would stay with micro and small enterprises.

Where the Proposal Stands as of 5 November 2026

As of 5 November 2026 the proposal is pending: Commission proposal COM(2025) 837 of 19 November 2025, Council mandate agreed by Coreper on 21 October 2026 (ST 14756/26 of 22 October 2026), and the European Parliament at committee stage, where the procedure file shows "Awaiting committee decision" and no committee vote. It is not law; the changes are collected under Data Act amendments.

How Micro, Small and Medium-Sized Firms Check and Document Their Position

An enterprise relies on Article 7 by working through seven checks and keeping the evidence for each one with its accounts:

1. Classify the enterprise with the latest approved accounts.
2. List partner, linked and public holdings and add their figures.
3. Check each product line and related service for subcontracting.
4. Record both one-year windows per product if medium-sized; after a window closes, the Data Act obligations for manufacturers apply.
5. List the products whose data the firm holds without being their manufacturer.
6. Keep user contracts free of terms that cut Chapter II rights and plan the Art. 9(4), Art. 13 and Chapter V positions.
7. Re-check at each accounting close and when the Digital Omnibus proposal is adopted.

The Data Act sets no notification or register for Article 7; an enterprise may declare its status (Annex Art. 3(5)). Commission FAQ v1.4 has no question on Article 7, so the reading rests on the text and recital 41.

The duties that apply once Article 7 does not are set out in the Data Act compliance checklist.

How the SME Rules Connect to the Other Chapters

The size test of Article 7 is one input into the wider scope questions of the Data Act, and four points connect it to the rest of the Regulation:

• Role: the size test matters only for an enterprise that manufactures, designs or provides the related service (Data Act roles).
• Dates: Chapter II has applied since 12 September 2025 and Article 3(1) covers products placed on the market after 12 September 2026 (see the Data Act timeline).
• Non-EU manufacturers: see the Data Act for non-EU companies.
• Evaluation: the Commission reports by 12 September 2028, including the impact on SMEs (Art. 49(1)(m)).

Questions about the SME Rules

Five questions recur about the SME rules of the Data Act.

Are SMEs exempt from the Data Act?

No: Article 7(1) takes only the Chapter II obligations off data from products and services of qualifying micro and small enterprises, medium-sized enterprises get one year, and every other chapter applies by its own rules.

Does Article 7 apply to a start-up with a large investor?

Not if the investor is a partner or linked enterprise that is not itself micro or small: a holding of 25 % or more makes an investor a partner (Annex Art. 3(2)), but business angels investing less than EUR 1,250,000 in the same enterprise do not count (Art. 3(2)(a)).

Must a micro or small enterprise register or notify its status?

No: the Data Act sets no notification or register for Article 7, and Article 3(5) of the Annex to Recommendation 2003/361/EC lets an enterprise declare its status as autonomous, partner or linked.

Does the exemption cover the cloud switching rules?

No: Article 7 covers Chapter II only, and as of 5 November 2026 no size-based exemption from the Chapter VI rules is in force. The proposal COM(2025) 837 would relieve SME and small mid-cap providers for some contracts concluded on or before 12 September 2025, as set out under cloud services exempt from switching rules.

Is a small mid-cap exempt from Chapter II?

No: Article 7 names micro and small enterprises and newly medium-sized ones only, and neither the Commission proposal COM(2025) 837 nor the Council mandate ST 14756/26 would change it as of 5 November 2026.