Article 63 – Derogations for Specific Operators

WHAT THE ARTICLE IS ABOUT

Simplified QMS compliance for microenterprises

Article 63 creates a targeted derogation allowing microenterprises — defined as businesses with fewer than ten employees and annual turnover or balance sheet not exceeding EUR 2 million — to comply with certain elements of the quality management system required by Article 17 in a simplified manner. It is a proportionality measure that prevents the Act’s most administratively demanding requirements from being applied identically to the smallest and largest market participants.

WHAT IT SAYS

Simplified QMS for microenterprises — but all other obligations remain

• Microenterprises within the meaning of Commission Recommendation 2003/361/EC may comply with certain elements of the Article 17 quality management system in a simplified manner
• The derogation only applies to microenterprises that do not have partner enterprises or linked enterprises — meaning truly independent micro-businesses, not subsidiaries of larger groups
• The Commission must develop guidelines specifying which QMS elements may be complied with in simplified form and how
• The simplified compliance option does not exempt microenterprises from any other requirements in the Act — including the full requirements of Articles 9 (risk management), 10 (data governance), 11 (technical documentation), 12 (record-keeping), 13 (transparency), 14 (human oversight), 15 (accuracy and cybersecurity), 72 (post-market monitoring) and 73 (incident reporting)
• The derogation is specifically scoped to Article 17 QMS documentation requirements — it does not reduce any substantive safety or rights protection obligations

WHO IS AFFECTED

Independent microenterprises building or deploying high-risk AI

• Microenterprises (fewer than 10 employees, turnover/balance sheet under EUR 2 million) that are providers of high-risk AI systems
• Importantly: only truly independent microenterprises — those that are part of a larger group through partner or linked enterprise relationships do not qualify
• The Commission, which must develop the simplification guidelines
• National competent authorities who must apply the derogation consistently

WHAT IT MEANS FOR SMES

Check if you qualify — the QMS simplification is meaningful

• First check whether you are a microenterprise under the official EU definition: fewer than 10 employees AND annual turnover or annual balance sheet not exceeding EUR 2 million
• Second check the independence condition: you must not have partner enterprises (25%+ ownership stake in or by another enterprise) or linked enterprises (50%+ ownership) — if you do, you do not qualify even if you meet the size criteria
• If you qualify, the Article 17 QMS simplification will reduce your documentation burden — but wait for the Commission guidelines before assuming what can be simplified
• The derogation does not reduce your substantive compliance obligations — your AI system must still meet all the technical requirements and you must still manage risks, govern data, maintain records and oversee the system
• Think of the derogation as reducing paperwork, not reducing compliance — the safety requirements remain identical

Related Articles

• Article 17 — Quality management system (the requirement this article derogates from)
• Article 62 — SME measures (the broader support framework within which this derogation sits)
• Article 9 — Risk management (explicitly not derogated — microenterprises must still comply fully)
• Article 96 — Commission guidelines (where the simplification guidance will be published)