# A Framework for Compliance with Regulation (EU) 2024/1689 for Small and Medium-Sized Enterprises
## 2 Methods
These core characteristics make it unsuitable for AI-related projects that are complex by their nature and demand full documentation in the context of the EU AI Act. XP, which stands for extreme programming, is one of the main implementations of agile used to develop small-size projects. It concentrates on the development aspects rather than the managerial ones and it is designed so that companies can adopt all or part of its methodology [15]. Scrum, the second main implementation of agile, focuses on project management, in cases where initial planning is a difficult task to complete, delivering independent and small-sized features. Its framework activities consist of four main activities, requirements, analysis, design, evolution and delivery [13; 16]. DevOps is an SDLC that combines, as its name states, development and operations to achieve improved delivery times for projects. In cases where quick releases are needed, DevOps promises to address challenges and implement short release cycles [17]. It is a time-sensitive model that is ideal for short-cycle projects, unsuitable for the development of AI systems that by nature take time to develop. The spiral model, first introduced by [PERSON] in 1988, is a risk-driven software development process that integrates principles from both linear and iterative methodologies. The model inherited some of the characteristics of the waterfall model, but it is based on an iterative cyclical development focusing on risk assessment. According to [18], this model is suitable for large projects that involve risk assessment with high-risk factors, due to its risk-driven approach. The spiral model consists of four phases: the first one is planning, the second is risk analysis, the third is development and the final is evaluation. Each cycle, consisting of these four phases, produces a version of the prototype, until the final version comes up that is called the operational prototype. Two main characteristics of the model make it suitable to become the basis of our framework for compliance with the EU AI Act that focuses on AI systems that fall within its scope, that is, for those categorized as high-risk systems after the applied risk assessment process. Both categories involve complex and time-consuming projects that demand compliance throughout the system's lifecycle. The spiral model seems an ideal base upon which to build a framework for compliance with the Act, as risk-assessment is its inherent characteristic. In addition to that, the spiral model can be adapted and used for projects that do not end after the final product is delivered but extend throughout the life of the software [16]. These two characteristics make it ideal for the case of the EU AI Act, as the latter mandates that a high-risk AI system needs to be validated for its conformity throughout its lifetime. Several standards in terms of technical and legal regulation exist or are emerging as AI evolves. Countries, international organizations and national agencies are investing in research related to AI development and how it can be canalized and controlled in order to avoid or reduce its negative effects. The NIST AI Risk Management Framework (AI RMF) [19] is designed to help organizations manage risks associated with artificial intelligence systems in a trustworthy, responsible and effective manner. Among other things, it provides voluntary guidance for the development of any AI system, while the proposed framework is EU AI Act-oriented and refers to certain risk-based AI systems. The ISO has adapted and developed standards that have a different orientation concerning the development of AI. The most relevant to this research are ISO 31000 and ISO/IEC 42001. ISO 31000 [20] is an international standard that provides principles, a framework and a process for risk management. Its primary purpose is to support organizations in developing a structured, systematic and enterprise-wide approach to managing risk that enhances decision-making, strengthens governance and improves operational performance.