Article 63: derogations for SMEs in the quality management system
SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. Until 27 July 2026 this read microenterprises; Article 1, point (26), of Regulation (EU) 2026/1744 replaced paragraph 1 and widened the circle to SMEs. Which elements those are is for the Commission to set out in guidelines, considering the needs of SMEs and without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 rules out any wider reading: the provision shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.
Paragraph 1, as replaced by Article 1, point (26), of Regulation (EU) 2026/1744, provides: SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC.
Praxikon tracks Article 63: derogations for SMEs in the quality management system under the EU AI Act, checked against the official source on 6 September 2026, citing the source for every statement.
- Status
- Applicable
- Application date
- Not recorded
- Version
- 1.0.0
- Last reviewed
- 6 September 2026
Review status: placed against the official source (6 September 2026). Next check due by 5 March 2027. The check date is the knowledge date of this version; no later recheck has been recorded.
From source to evidence
Why this obligation applies, what it asks of you, and what you show for it.
Applies
Applicable · Not recorded
For whom
Provider of an AI system
What you do
Determine and bound the simplification of your quality management system
What you record
File on microenterprise status
Official source
Who this is relevant to
When this applies
Provider of an AI system
A party that develops or has an AI system developed and places it on the market under its own name.
- 1Two cumulative conditions. The organisation is an SME, including a start-up, within the meaning of Recommendation 2003/361/EC, and it does not have partner enterprises or linked enterprises within the meaning of that Recommendation. A standalone small enterprise that is not a microenterprise is therefore covered since 27 July 2026. The thresholds and the notions of partner enterprise and linked enterprise sit in that Recommendation and not in this Regulation; anyone relying on this article tests against that text. The benefit touches only the quality management system required by Article 17, and only those elements of it that the Commission designates in its guidelines. Article 63 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
What the official source establishes
Article 17(1) is the obligation to which the derogation in Article 63 relates and provides: providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects: (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system; (b) techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system.
Our interpretation
The official source remains authoritative. This general interpretation is not legal advice.
This article is called derogations and that word does more harm than good. Nothing is abolished. Paragraph 1 says that certain elements of a single obligation, the quality management system of Article 17, may be complied with in a simplified manner. Paragraph 2 then says in as many words that this shall not be interpreted as exempting those operators from other requirements or obligations under this Regulation, and names nine of them: Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. That is the enumeration that heads off the misunderstanding, and it covers exactly the heaviest requirements: risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity, post-market monitoring, and the reporting of serious incidents. A microenterprise providing a high-risk system therefore does very nearly everything a large company does; only the form in which the quality management system is written down may be lighter. Two things to settle now. First the entry test, because it is stricter than it looks: on top of the thresholds in Recommendation 2003/361/EC there is the additional condition that you have no partner enterprises or linked enterprises within the meaning of that Recommendation. A holding by a parent company or a shared shareholder can break that condition, and that is a structural question you do not want to raise in the last week before an assessment. Second the reach of the simplification: which elements exactly may be lighter is not in the Regulation but in guidelines the Commission develops under this article. We make no claim here about which elements those are or whether those guidelines already exist; until they do, you build the Article 17 system as it stands and keep a note of which parts you would later want to simplify.
Put Article 63 next to Article 62 and the picture sharpens. Article 62 lowers the price and the threshold, Article 63 simplifies the form of a document. Together they are the only two places in this Regulation where the size of an undertaking legally makes a difference, and neither touches the substantive requirements for high-risk AI systems. Anyone who hears in a sales conversation or a grant application that the AI Regulation is softer for small companies can test that against these two articles and will find the claim too broad. Think as well about the commercial side of paragraph 2. The nine articles it names are precisely the items a buyer asks for: the risk management system, the data governance, the technical documentation, the logs, the instructions for use, the human oversight, the performance and security figures, the post-market monitoring and the incident reporting. A microenterprise invoking Article 63 in order not to produce those items will be found out in the first serious procurement process, before a regulator comes into view at all. The sensible reading is therefore the reverse: use Article 63 to keep your quality management system small and workable, and invest the time you win in the nine topics of paragraph 2, because that is what both your customer and your market surveillance authority will judge you on.
What you can do now
First test whether you fall within scope and record that test: are you a microenterprise within the meaning of Recommendation 2003/361/EC, and do you genuinely have no partner enterprises or linked enterprises within the meaning of that Recommendation? Put that second question to whoever knows the shareholding structure rather than to the product team, and repeat the test at every investment round or acquisition. Then build the Article 17 quality management system in full, and mark in your own documentation which elements you would want to simplify once the Commission guidelines on that exist; that way you do not start over when that text appears. Next, make an explicit list of the nine articles paragraph 2 names and set out per article who in your organisation produces the corresponding item and where it sits; that is the same list a buyer asks for and a market surveillance authority walks through. Put no sentence in quotations or contracts suggesting that your size releases you from a requirement. Finally, check whether Article 62 gives you something Article 63 does not, such as the reduced conformity assessment fee or priority access to a sandbox; those two tracks run separately and you can use both.
- 01
Determine and bound the simplification of your quality management system
Test whether you are a microenterprise with no partner or linked enterprises, build the Article 17 system, mark which elements you would want to simplify once the Commission guidelines exist, and keep the nine articles of Article 63(2) expressly outside that simplification.
What to retain
File on microenterprise status
The record of the test against Recommendation 2003/361/EC with the date, the evidence that there are no partner enterprises or linked enterprises, and the list of the elements of the quality management system for which you want to invoke a simplification once the Commission guidelines exist.
Control and reassessment
Review of the boundary of the simplification
The control that every simplification you make under Article 63 is tested against paragraph 2, so that no item from Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73 falls away, and that the shareholding structure test is redone at every change.
Public tools
Full text of Article 63
The full legal text in the public AI Act Explorer.
Conditions and exceptions
- Paragraph 2 expressly provides that paragraph 1 shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73. The risk management system, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, post-market monitoring and the reporting of serious incidents therefore continue to apply in full.
Official sources and locators
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 63(1) and (2)
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 17(1); Article 62(2); Article 113, second paragraph
Referring to this object
Citation block
Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.
Reference
Praxikon, "Article 63: derogations for SMEs in the quality management system", praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0), effective_at 2026-08-02T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z, sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde, https://www.praxikon.com/en/verplichtingen/article-63-sme-derogations (https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&effective_at=2026-08-02&known_at=2026-09-06&lang=en, accessed 2026-09-15)
Short form
praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0 (sha256 249cec1c)
BibTeX
@misc{praxikon-eu-ai-act-obligation-article-63-sme-derogations-1-0-0,
author = {{Praxikon}},
title = {Article 63: derogations for SMEs in the quality management system},
year = {2026},
version = {1.0.0},
number = {praxikon:eu:ai-act:obligation:article-63-sme-derogations},
howpublished = {AI Act Change \& Evidence Graph, dataset 2.2.0, schema 1.5.0},
note = {effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde},
url = {https://www.praxikon.com/en/verplichtingen/article-63-sme-derogations},
urldate = {2026-09-15},
language = {en}
}CSL JSON
[
{
"id": "praxikon:eu:ai-act:obligation:article-63-sme-derogations@1.0.0",
"type": "dataset",
"title": "Article 63: derogations for SMEs in the quality management system",
"container-title": "AI Act Change & Evidence Graph",
"publisher": "Praxikon",
"version": "1.0.0",
"number": "praxikon:eu:ai-act:obligation:article-63-sme-derogations",
"URL": "https://www.praxikon.com/en/verplichtingen/article-63-sme-derogations",
"language": "en",
"issued": {
"date-parts": [
[
2026,
9,
6
]
]
},
"accessed": {
"date-parts": [
[
2026,
9,
15
]
]
},
"note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0; schema 1.5.0; effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 249cec1c5363acf6ee7e50aca22d6a1f93b27a07655d9cb2d2ebd8494810bcde; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-63-sme-derogations&effective_at=2026-08-02&known_at=2026-09-06&lang=en; licence https://www.praxikon.com/nl/legal/terms"
}
]How to verify a reference later is set out in the methodology. Terms
Version history
v1.0.0
2 August 2026
Article 63: derogations for SMEs in the quality management system
SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. Until 27 July 2026 this read microenterprises; Article 1, point (26), of Regulation (EU) 2026/1744 replaced paragraph 1 and widened the circle to SMEs. Which elements those are is for the Commission to set out in guidelines, considering the needs of SMEs and without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems. Paragraph 2 rules out any wider reading: the provision shall not be interpreted as exempting those operators from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.
Corrections to this obligation
No substantive correction to this object has been recorded.
Open the correction log
Help with implementation
Zahed Ashkara, jurist and freelance AI & Privacy Consultant, supports implementation with your team through Embed AI.
View AI governance at Embed AIFor AI agents and integrations
This page and the machine output derive from the same versioned object. Use the API for deterministic filters by role, topic and time.