Skip to main content
Praxikon
Back to the explorer
ObligationApplicablev1.0.0

Article 63: derogations for SMEs in the quality management system

SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. Until 27 July 2026 this read microenterprises; Article 1, point (26), of Regulation (EU) 2026/1744 replaced paragraph 1 and widened the circle to SMEs. Which elements those are is for the Commission to set out in guidelines, considering the needs of SMEs and without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 rules out any wider reading: the provision shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.

The official source remains authoritative. This is general information about obligations and not legal advice. See this object on the map

Address and citation

This object has an address of its own that is never renamed or reused. Store the identifier in your own file, not the title or the link.

Identifier
praxikon:eu:ai-act:obligation:article-63-sme-derogations
Payload hash (sha256)
249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde

Citation line

Praxikon, "Article 63: derogations for SMEs in the quality management system", praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0), effective_at 2026-08-08T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z, sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde
Version
1.0.0
Legal time (effective_at)
2 August 2026
Knowledge time (known_at)
6 September 2026
Closed on
Not closed
Topics
high-risk-requirements, innovation

Review status: Placed against the official source (6 September 2026). Next check due by 5 March 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

Who must act and who is affected

On an obligation the addressee is recorded separately from the party that is merely affected. That difference decides who a supervisory authority addresses and who has work to do without the duty resting on them.

No duty holder assigned

The addressee falls outside the roles this dataset models. The duty exists, it just does not rest on a role recorded here.

Duty holder

Not recorded on this object.

Affected actor

Oversight

Not recorded on this object.

Evidence owner

Not recorded on this object.

What this object links to

Every relation appears below as a path: from the source with its locator, through the conditions and exceptions of the object carrying the relation, to the consequence. A locator belongs to a statement in the data and not to a relation, so the source is the source anchor of the carrying object.

Who is affected without being the addressee

1 of 1 shown

This role is practically affected without being the addressee: it receives the information, has to cooperate, or absorbs the consequences in its own process.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allTwo cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
    • ExceptionParagraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be done

1 of 1 shown

This is what concretely has to be done under the obligation.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allTwo cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
    • ExceptionParagraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be recorded

1 of 1 shown

This is what has to be in the file to show that the action was carried out.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allTwo cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
    • ExceptionParagraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What keeps it in place

1 of 1 shown

This is what keeps compliance in place over time, periodic or event-driven.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allTwo cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
    • ExceptionParagraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Public tools

1 of 1 shown

This is the public route a reader can actually use.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allTwo cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
    • ExceptionParagraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What points at this object

Objects hanging off this obligation

4 of 4 shown

The object belongs to this obligation. The source line it hangs off sits there.

  1. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allArises where you are the provider of a high-risk AI system and want to rely on Article 63, and again at every change in the shareholding structure. This action is our construction: Article 63 grants a possibility and places the only literal duty on the Commission.

    Relation recorded on: Determine and bound the simplification of your quality management system

    Consequence

  2. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Review of the boundary of the simplification

    Consequence

  3. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: File on microenterprise status

    Consequence

  4. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 63(1) and (2)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 17(1); Article 62(2); Article 113, second paragraph

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Full text of Article 63

    Consequence

What this object states

Official fact

Attributable to a named primary source, with a locator. Where they differ, the official source prevails.

  • Paragraph 1, as replaced by Article 1, point (26), of Regulation (EU) 2026/1744, provides: SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. For that purpose, the Commission shall develop guidelines on the elements of the quality management system which may be complied with in a simplified manner considering the needs of SMEs, without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 provides: paragraph 1 of this Article shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.

  • Article 17(1) is the obligation to which the derogation in Article 63 relates and provides: providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects: (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system; (b) techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system.

    • Locator: Article 17(1); Article 62(2); Article 113, second paragraphpraxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Our interpretation

Our own reading. It can change without the law changing, and it is not the position of a supervisory authority.

  • This article is called derogations and that word does more harm than good. Nothing is abolished. Paragraph 1 says that certain elements of a single obligation, the quality management system of Article 17, may be complied with in a simplified manner. Paragraph 2 then says in as many words that this shall not be interpreted as exempting those operators from other requirements or obligations under this Regulation, and names nine of them: Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. That is the enumeration that heads off the misunderstanding, and it covers exactly the heaviest requirements: risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity, post-market monitoring, and the reporting of serious incidents. A microenterprise providing a high-risk system therefore does very nearly everything a large company does; only the form in which the quality management system is written down may be lighter. Two things to settle now. First the entry test, because it is stricter than it looks: on top of the thresholds in Recommendation 2003/361/EC there is the additional condition that you have no partner enterprises or linked enterprises within the meaning of that Recommendation. A holding by a parent company or a shared shareholder can break that condition, and that is a structural question you do not want to raise in the last week before an assessment. Second the reach of the simplification: which elements exactly may be lighter is not in the Regulation but in guidelines the Commission develops under this article. We make no claim here about which elements those are or whether those guidelines already exist; until they do, you build the Article 17 system as it stands and keep a note of which parts you would later want to simplify.

    • Locator: Article 17(1); Article 62(2); Article 113, second paragraphpraxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

  • Put Article 63 next to Article 62 and the picture sharpens. Article 62 lowers the price and the threshold, Article 63 simplifies the form of a document. Together they are the only two places in this Regulation where the size of an undertaking legally makes a difference, and neither touches the substantive requirements for high-risk AI systems. Anyone who hears in a sales conversation or a grant application that the AI Regulation is softer for small companies can test that against these two articles and will find the claim too broad. Think as well about the commercial side of paragraph 2. The nine articles it names are precisely the items a buyer asks for: the risk management system, the data governance, the technical documentation, the logs, the instructions for use, the human oversight, the performance and security figures, the post-market monitoring and the incident reporting. A microenterprise invoking Article 63 in order not to produce those items will be found out in the first serious procurement process, before a regulator comes into view at all. The sensible reading is therefore the reverse: use Article 63 to keep your quality management system small and workable, and invest the time you win in the nine topics of paragraph 2, because that is what both your customer and your market surveillance authority will judge you on.

    • Locator: Article 17(1); Article 62(2); Article 113, second paragraphpraxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

Recommended step

A practical step we consider appropriate. Not an obligation following from the Regulation.

  • First test whether you fall within scope and record that test: are you a microenterprise within the meaning of Recommendation 2003/361/EC, and do you genuinely have no partner enterprises or linked enterprises within the meaning of that Recommendation? Put that second question to whoever knows the shareholding structure rather than to the product team, and repeat the test at every investment round or acquisition. Then build the Article 17 quality management system in full, and mark in your own documentation which elements you would want to simplify once the Commission guidelines on that exist; that way you do not start over when that text appears. Next, make an explicit list of the nine articles paragraph 2 names and set out per article who in your organisation produces the corresponding item and where it sits; that is the same list a buyer asks for and a market surveillance authority walks through. Put no sentence in quotations or contracts suggesting that your size releases you from a requirement. Finally, check whether Article 62 gives you something Article 63 does not, such as the reduced conformity assessment fee or priority access to a sandbox; those two tracks run separately and you can use both.

    • Locator: Article 17(1); Article 62(2); Article 113, second paragraphpraxikon:eu:ai-act:source:reg-eu-2024-1689Open official source

When this applies

  1. 1Two cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.

When this does not apply

  • Paragraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 63: derogations for SMEs in the quality management system",
praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0),
effective_at 2026-08-02T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z,
sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde,
https://www.praxikon.com/en/verkenner/obligation/article-63-sme-derogations
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&effective_at=2026-08-02&known_at=2026-09-06&lang=en, accessed 2026-09-21)

Short form

praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0 (sha256 249cec1c)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-63-sme-derogations-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 63: derogations for SMEs in the quality management system},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-63-sme-derogations},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.2.0, schema 1.5.0},
  note         = {effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde},
  url          = {https://www.praxikon.com/en/verkenner/obligation/article-63-sme-derogations},
  urldate      = {2026-09-21},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0",
    "type": "dataset",
    "title": "Article 63: derogations for SMEs in the quality management system",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-63-sme-derogations",
    "URL": "https://www.praxikon.com/en/verkenner/obligation/article-63-sme-derogations",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          9,
          6
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          9,
          21
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0; schema 1.5.0; effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&effective_at=2026-08-02&known_at=2026-09-06&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

For agents and integrations

This page and the machine output come from the same object and the same two time axes.

Open as JSONOpen as JSON-LDHuman explanationRead the methodology