{"meta":{"dataset_id":"praxikon:sys:registry:dataset:ai-act-implementation-graph","dataset_version":"2.2.0","schema_version":"1.5.0","lang":"en","effective_at":"2026-08-08T00:00:00.000Z","known_at":"2026-09-06T00:00:00.000Z","count":1,"filters":{"id":"praxikon:eu:ai-act:obligation:article-63-sme-derogations","type":"obligation","role":null,"duty_holder":null,"topic":null},"identifiers":{"canonical_namespace":"praxikon","canonical_form":"praxikon:<jurisdiction>:<regulation>:<type>:<slug>","legacy_namespace":"raip","legacy_resolution":"permanent","resolved":{"id":"praxikon:eu:ai-act:obligation:article-63-sme-derogations","role":null,"duty_holder":null}}},"data":[{"id":"praxikon:eu:ai-act:obligation:article-63-sme-derogations","legacy_id":"raip:obligation:article-63-sme-derogations","type":"obligation","slug":"article-63-sme-derogations","version":"1.0.0","effective_at":"2026-08-02T00:00:00.000Z","known_at":"2026-09-06T00:00:00.000Z","valid_until":null,"payload_hash_sha256":"249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde","label":"Article 63: derogations for SMEs in the quality management system","summary":"SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. Until 27 July 2026 this read microenterprises; Article 1, point (26), of Regulation (EU) 2026/1744 replaced paragraph 1 and widened the circle to SMEs. Which elements those are is for the Commission to set out in guidelines, considering the needs of SMEs and without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 rules out any wider reading: the provision shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.","topics":["high-risk-requirements","innovation"],"actor_ids":["praxikon:eu:ai-act:actor:provider"],"duty_holder_ids":[],"affected_actor_ids":["praxikon:eu:ai-act:actor:provider"],"oversight_actor_ids":[],"evidence_owner_ids":[],"duty_holder_uncertainty_status":"out_of_scope","interpretation_status":null,"interpretation_note":null,"obligation_ids":[],"change_ids":[],"action_ids":["praxikon:eu:ai-act:action:article-63-scope-simplified-quality-management"],"evidence_ids":["praxikon:eu:ai-act:evidence:article-63-sme-eligibility-record"],"control_ids":["praxikon:eu:ai-act:control:article-63-simplification-boundary-review"],"template_ids":["praxikon:eu:ai-act:template:article-63-legal-text"],"conditions":[{"id":"article-63-scope","operator":"all","description":"Two cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026."}],"exceptions":[{"id":"article-63-no-exemption-from-other-requirements","operator":"not","description":"Paragraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full."}],"statements":[{"kind":"official_fact","text":"Paragraph 1, as replaced by Article 1, point (26), of Regulation (EU) 2026/1744, provides: SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. For that purpose, the Commission shall develop guidelines on the elements of the quality management system which may be complied with in a simplified manner considering the needs of SMEs, without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 provides: paragraph 1 of this Article shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.","citations":[{"source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 63(1) and (2)","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"source_checked"}},{"kind":"official_fact","text":"Article 17(1) is the obligation to which the derogation in Article 63 relates and provides: providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects: (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system; (b) techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system.","citations":[{"source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 17(1); Article 62(2); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"source_checked"}},{"kind":"editorial_interpretation","text":"This article is called derogations and that word does more harm than good. Nothing is abolished. Paragraph 1 says that certain elements of a single obligation, the quality management system of Article 17, may be complied with in a simplified manner. Paragraph 2 then says in as many words that this shall not be interpreted as exempting those operators from other requirements or obligations under this Regulation, and names nine of them: Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. That is the enumeration that heads off the misunderstanding, and it covers exactly the heaviest requirements: risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity, post-market monitoring, and the reporting of serious incidents. A microenterprise providing a high-risk system therefore does very nearly everything a large company does; only the form in which the quality management system is written down may be lighter. Two things to settle now. First the entry test, because it is stricter than it looks: on top of the thresholds in Recommendation 2003/361/EC there is the additional condition that you have no partner enterprises or linked enterprises within the meaning of that Recommendation. A holding by a parent company or a shared shareholder can break that condition, and that is a structural question you do not want to raise in the last week before an assessment. Second the reach of the simplification: which elements exactly may be lighter is not in the Regulation but in guidelines the Commission develops under this article. We make no claim here about which elements those are or whether those guidelines already exist; until they do, you build the Article 17 system as it stands and keep a note of which parts you would later want to simplify.","citations":[{"source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 17(1); Article 62(2); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"editorial"}},{"kind":"editorial_interpretation","text":"Put Article 63 next to Article 62 and the picture sharpens. Article 62 lowers the price and the threshold, Article 63 simplifies the form of a document. Together they are the only two places in this Regulation where the size of an undertaking legally makes a difference, and neither touches the substantive requirements for high-risk AI systems. Anyone who hears in a sales conversation or a grant application that the AI Regulation is softer for small companies can test that against these two articles and will find the claim too broad. Think as well about the commercial side of paragraph 2. The nine articles it names are precisely the items a buyer asks for: the risk management system, the data governance, the technical documentation, the logs, the instructions for use, the human oversight, the performance and security figures, the post-market monitoring and the incident reporting. A microenterprise invoking Article 63 in order not to produce those items will be found out in the first serious procurement process, before a regulator comes into view at all. The sensible reading is therefore the reverse: use Article 63 to keep your quality management system small and workable, and invest the time you win in the nine topics of paragraph 2, because that is what both your customer and your market surveillance authority will judge you on.","citations":[{"source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 17(1); Article 62(2); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"editorial"}},{"kind":"recommended_action","text":"First test whether you fall within scope and record that test: are you a microenterprise within the meaning of Recommendation 2003/361/EC, and do you genuinely have no partner enterprises or linked enterprises within the meaning of that Recommendation? Put that second question to whoever knows the shareholding structure rather than to the product team, and repeat the test at every investment round or acquisition. Then build the Article 17 quality management system in full, and mark in your own documentation which elements you would want to simplify once the Commission guidelines on that exist; that way you do not start over when that text appears. Next, make an explicit list of the nine articles paragraph 2 names and set out per article who in your organisation produces the corresponding item and where it sits; that is the same list a buyer asks for and a market surveillance authority walks through. Put no sentence in quotations or contracts suggesting that your size releases you from a requirement. Finally, check whether Article 62 gives you something Article 63 does not, such as the reduced conformity assessment fee or priority access to a sandbox; those two tracks run separately and you can use both.","citations":[{"source_id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","source_locator":"Article 17(1); Article 62(2); Article 113, second paragraph","source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"editorial"}}],"legal_status":"applicable","deadline_at":null,"timing_basis":null,"high_risk_regime_from":null,"links":[{"relation":"public_page","href":"https://www.praxikon.com/en/verplichtingen/article-63-sme-derogations","label":"Open the human explanation"},{"relation":"official_source","href":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","label":"Article 63 on EUR-Lex"},{"relation":"public_page","href":"/en/ai-act/artikel/63","label":"Read Article 63 in the AI Act Explorer"}],"review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"source_checked"},"source_review":{"level":"source_verified","last_checked_at":"2026-09-06T00:00:00.000Z","next_review_due_at":"2027-03-05T00:00:00.000Z","date_basis":"first_publication"}}],"included":{"sources":[{"id":"praxikon:eu:ai-act:source:reg-eu-2024-1689","title":{"nl":"EU AI-verordening 2024/1689","en":"EU Artificial Intelligence Act 2024/1689"},"publisher":{"nl":"Europees Parlement en Raad","en":"European Parliament and Council"},"canonical_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","eli":"http://data.europa.eu/eli/reg/2024/1689/oj","source_version":"original-oj-2024-07-12","verified_at":"2026-08-08T00:00:00.000Z","fingerprint_basis":"canonical_url|source_version|verified_at","source_record_hash_sha256":"bf0fca3e1fb47ce58924f6e736d572bb5db3812c3276c0b2891fbf328c42a5c6","review":{"reviewed_at":"2026-08-08T00:00:00.000Z","reviewer":"Praxikon release validation","review_method":"source_link_and_rule_validation","legal_status":"source_checked"},"legacy_id":"raip:source:reg-eu-2024-1689"}]},"links":{"self":"https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&lang=en","alternate":"https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&lang=en&format=jsonld","licence":"https://www.praxikon.com/nl/legal/terms"}}