Article 63 Derogations for specific operators

This article carves out a limited concession for SMEs, including start-ups, by allowing them to meet certain quality management system obligations from Article 17 in a simplified manner.

Importantly, the article is careful to contain its own scope: the simplification is narrow and does not amount to a general exemption.

The Commission is tasked with developing guidelines to define what "simplified" looks like in practice, while ensuring the overall level of protection for high-risk AI systems remains intact.

Important points:

• If you are an SME or start-up without partner or linked enterprises, you may comply with certain Article 17 quality management system requirements in a simplified manner.
• The Commission is required to develop guidelines specifying which elements of the quality management system can be simplified for SMEs.
• This simplification does not exempt SMEs from any other obligations under the regulation, including those on risk management, data governance, transparency, human oversight, and incident reporting.