# A Framework for Compliance with Regulation (EU) 2024/1689 for Small and Medium-Sized Enterprises
## 3 The EU AI Act Compliance Framework for SMEs--Results  
The proposed framework provides a structured and simplified approach, assisting SMEs which are or intend to become actively involved in the development process of AI systems and fall within the scope of Regulation (EU) 2024/1689. It helps them to better comply with it, during all phases, and extends throughout the whole lifecycle of the system. Ideally, it should be used from the very beginning of the process, but it can work, if adapted properly, at any stage. The phases and the tasks of the proposed framework are visualized in Figure 1, mapping them with certain articles of the EU AI Act. Furthermore, we highlight its components in Table 1, where the first column represents the four iterative phases based on those of the spiral model. These four phases of the model are planning, risk analysis, development and evaluation. Each phase is divided into tasks or compliance areas, shown in the second column, which should be completed prior to the next phase according to the spiral model's iterations. For the content of each task, we provide a short description in the third column. The company must take a set of actions, depending on its business type, to complete and move to the next one, explained in the fourth column. The final column matches the most relevant recitals, articles and annexes of Regulation (EU) 2024/1689, published in the official European Union's Journal on 12 July 2024, to each task. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Phase** & **Task-Compliance Area** & **Description** & **Action Needed** & **EU AI Act Reference** \\ \hline \multirow{6}{*}{Phase 1—Planning} & \multirow{6}{*}{Identification of AI systems} & Provide specific information about the AI systems involved in the entity’s activities. & Inventory all AI systems related to the entity’s activities. & Recitals 7, 9, 10, 11,13, 14, 15, 21–45, 47, 48, 49, 52, 63, 64, 69, 99, 100, 103 \\  & & & Classify the systems, based on their purpose, functionality and type of data processed. & Articles 2, 5, 7, 8 Annexes III, VIII \\ \cline{2-5}  & & & Analyze quality and ensure integrity of data sources. & \\ \cline{2-5}  & & & Ensure compliance with the applicable data protection laws (for the EU, the GDPR and other related laws). & Recitals 67, 68, 70 Article 10 \\ \cline{2-5}  & & & Document data sources and storage practices. & \\ \hline \multirow{6}{*}{Phase 2—Risk Analysis} & \multirow{6}{*}{Risk analysis} & \multirow{6}{*}{Conduct risk assessments.} & Conduct risk analysis to identify potential impact on fundamental rights, safety and other issues. & \\ \cline{2-5}  & & & Categorize AI systems into risk levels as defined in the EU AI Act. & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Components of the framework. Figure 1: Visualization of the framework. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Phase** & **Task-Compliance Area** & **Description** & **Action Needed** & **EU AI Act Reference** \\ \hline \multirow{8}{*}{Compliance strategy} & & Develop a compliance strategy for the AI systems identified in phase 1. & \\  & & Establish roles and responsibilities to support the AI governance model within the organization. & Rectals 36, 37 \\  & & Rigorous testing of AI systems to ensure they meet compliance & Anneves I, III, VIII, IX \\ \hline \multirow{8}{*}{Documentation and policies} & & Develop documentation templates for the description of AI systems, risk assessments and compliance reports. & \\  & & Set up and update policies related to AI ethics, data usage and risk management. & \\ \hline \multirow{8}{*}{Transparency} & & Implement measures for transparency related to algorithms. & \\  & & algorithm and explainability for interested parties. & Support mechanisms to provide explainability to interested parties and authorities. & Rectals 72, 132 \\ \cline{1-1} \cline{2-5}  & & Ensure oversight by humans with specific roles and rights. & Implement measures to ensure human oversight.