Article 63 Derogations for specific operators

This article provides a limited concession for microenterprises, allowing them to comply with the quality management system requirements under Article 17 in a simplified manner.

The Commission is tasked with developing guidelines to define what that simplification looks like in practice.

Critically, the article is clear that this is a narrow carve-out: it does not exempt microenterprises from any other obligations under the regulation, and the level of protection for high-risk AI systems must not be diminished.

Important points:

• Microenterprises (with no partner or linked enterprises) may comply with Article 17 quality management system requirements in a simplified manner.
• The Commission is required to develop guidelines specifying which elements of the quality management system can be simplified for microenterprises.
• This simplification does not exempt microenterprises from any other obligations in the regulation, including those on risk management, data governance, transparency, human oversight, and incident reporting.