Article 63 provides that microenterprises may comply with the quality management system requirements in Article 17 in a simplified manner, provided that they have no partner enterprise or linked enterprise, and provided that the simplification does not affect the level of protection required or the compliance with the high risk requirements. The simplified manner is not defined as a fixed template in the Article, and the microenterprise must still meet Article 17 in substance, in a form proportionate to its size and to the system. A microenterprise that has a partner or linked enterprise cannot rely on Article 63 on that ground, and a simplification that omits required content is not a simplified system in the sense of the Act.
What does Article 17 require?
Article 17 requires providers of high risk AI systems to put in place a quality management system that ensures compliance with the Regulation. The system must be documented in a systematic and orderly manner, in the form of written policies, procedures and instructions, and must include, in outline, a strategy for regulatory compliance, design and development procedures, data management procedures, risk management, post market monitoring, incident reporting, communication with authorities, record keeping, resource management, and an accountability framework. The quality management system must be proportionate to the size of the provider organisation, and, where the provider is an SME or SMC, a simplified form may be used where the Commission has specified it under Article 17(2) as amended. The system is not a single document. It is a set of procedures and records that together show how compliance is managed over the life of the system. A microenterprise must therefore think in terms of procedures and records, not in terms of a single quality manual that is written once and never used. The procedures should be written in the language the team actually uses, and should be followed in practice, because a procedure that is not followed will be treated as a gap on inspection.
What does Article 63 allow?
Article 63 allows microenterprises, as defined by reference to Recommendation 2003/361/EC, to comply with the Article 17 quality management requirements in a simplified manner, provided that they have no partner enterprise or linked enterprise within the meaning of that Recommendation, and provided that the simplification does not affect the level of protection required or the compliance with the high risk requirements. The Article does not list the simplifications, and it does not authorise the omission of any Article 17 element. The simplification is in the form, the scale and the documentation, not in the substance. A microenterprise can have a quality management system that is a small set of coherent documents, with a single responsible person, with procedures that are short and direct, and with records that are kept in a simple system, provided that the procedures cover the Article 17 elements and are actually followed. A microenterprise cannot have a quality management system that consists only of a statement that it will comply, or that omits risk management, post market monitoring or record keeping. The test is whether the system, in its simplified form, still ensures compliance. If it does not, it is not a simplified system under Article 63. It is a non compliant system.
For the broader regulatory framework, see SMEs, startups and open source overview.
Who cannot use Article 63?
Article 63 cannot be used by a microenterprise that has a partner enterprise or a linked enterprise, as those terms are used in Recommendation 2003/361/EC. A microenterprise with a significant investor, a parent, a subsidiary, a joint venture or a group relationship that meets the partner or linked thresholds must therefore check its position before relying on Article 63. The condition is framed in terms of the Recommendation, not in terms of a general impression of independence. A company that is small in its own accounts but that is linked to a larger enterprise must use the ordinary quality management arrangements, proportionate to its size, rather than the Article 63 simplification. A company that changes its group structure, for example by taking investment that creates a partner enterprise, should reassess its Article 63 position at the time of the change, and should update its quality management system if the simplification is no longer available. The group structure, the holdings and the calculation should be recorded with the quality management file, so that the Article 63 condition can be tested by a reviewer. A file that states Article 63 reliance without the group evidence does not show that the condition is met.
What should a simplified system contain?
A simplified quality management system should contain, in a form proportionate to the microenterprise and to the system, the regulatory compliance strategy, the design and development control, the data management approach, the risk management process, the post market monitoring plan, the incident reporting procedure, the communication arrangements, the record keeping arrangements, the resource and competence arrangements, and the accountability framework. Each element can be short, but each must be present, must name the person responsible, must state the procedure, and must point to the records that show the procedure was followed. For a microenterprise with a single product, the system can be a single file with sections for each element, with version control and a review date. For a microenterprise with several products, the system should distinguish the common procedures from the product specific procedures, so that a change to one product does not require rewriting the whole system. The system should be reviewed at least when a product changes, when the law or a standard changes, when an incident occurs, or at a planned interval, whichever comes first. A system that is never reviewed will become out of date, and a review that is not recorded will not be visible to a reviewer.
How is simplification different from omission?
Simplification and omission differ in their effect on protection and compliance. Simplification changes the form and the scale, while keeping the substance. Omission removes substance. A simplified risk management procedure can be a short procedure that identifies hazards, assesses risks, records mitigations and residual risk, and is reviewed after each product change. An omitted risk management procedure is no procedure at all. A simplified record keeping arrangement can be a single indexed folder with version control, rather than a large document management system. An omitted record keeping arrangement is a folder with no index, no versions and no retention rule. A simplified accountability framework can name one person for each duty, with a deputy where the person is absent. An omitted framework names no one. The microenterprise should test its system by asking, for each Article 17 element, whether a reviewer who was not involved in writing the system could follow the procedure, find the records and test the conclusion. If the answer is no, the element has been omitted, not simplified, and the system should be revised before it is relied on.
Continue with who counts as an SME.
What does this guide not decide?
This guide does not decide whether any named enterprise is a microenterprise, whether it has a partner or linked enterprise, or whether its quality management system is compliant in simplified form. Those questions need the Recommendation calculation, the group documents and the quality management file for the specific enterprise and system. A microenterprise that wishes to rely on Article 63 should confirm its status and its system with a competent authority or legal adviser, and should record the confirmation with the file. This guide explains the provision and the distinction between simplification and omission, not the compliance of a particular system.
Frequently asked questions
Can a microenterprise skip quality management?
No. Article 63 allows a simplified manner of complying with Article 17, not an exemption from it. The quality management system must still ensure compliance, must cover the Article 17 elements in substance, and must not reduce the level of protection. Simplification is in form and scale, not in substance.
What stops a microenterprise using Article 63?
Having a partner enterprise or a linked enterprise, as defined in Recommendation 2003/361/EC, stops reliance on Article 63. The group structure and holdings must be checked and recorded. A microenterprise that acquires a partner or linked relationship should reassess its position at the time of the change.
Is there a fixed simplified template?
Article 63 does not prescribe a fixed template. Article 17(2) as amended allows a simplified form specified by the Commission for SME and SMC providers in defined circumstances. A microenterprise should check the consolidated text and any Commission specification, and should build a system that covers the Article 17 elements in a proportionate form, with the reasoning recorded.
How can a reviewer tell simplification from omission?
By whether each Article 17 element is present in substance, with a named responsible person, a stated procedure and records that show the procedure was followed. A short procedure that can be followed and tested is simplification. An element with no procedure, no owner and no records is omission.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗