# A Framework for Compliance with Regulation (EU) 2024/1689 for Small and Medium-Sized Enterprises
## 1 Introduction
The purpose of this research is to provide an easy-to-use framework for SMEs that allows them to overcome their main and common constraints. These include:  
* Limited resources and expertise of personnel, as in most cases there is not enough specialized and adequate human capital. * Narrow financing capabilities. These constraints, combined with a demanding legal framework such as Regulation (EU) 2024/1689 that involves a significant workload, simultaneously with the development process, result in a discouraging business environment for SMEs. This creates a concurrent, three-fold problem for an SME to resolve: the limited resources that deter companies from investing in any additional need except for their main functions, the complexity of the Regulation (EU) 2024/1689 that demands a lot of back-office work and concurrent management of the main development lifecycle of an AI system. The proposed framework aims to address the compliance challenge by integrating the AI system's development process and regulatory requirements into a single, unified model. It is built around two key attributes:  
* Compliance-Driven Design: A core focus on ensuring alignment with the provisions of Regulation (EU) 2024/1689. * Development Lifecycle Integration: The incorporation of a Software Development Life Cycle (SDLC) model that guides the AI system's development stages. Each phase of the SDLC is mapped to specific articles of the Regulation, linking every development task to its corresponding legal obligations. This parallel structuring allows compliance activities to be embedded directly into the development workflow. As a result, organizations--particularly SMEs--can manage compliance more efficiently, minimizing costs while maintaining momentum in AI development. A significant benefit of this approach is that it allows SMEs to concentrate their limited resources on their core business activities. Moreover, it supports the development of internal expertise by involving personnel directly in the compliance process. The novelty of this framework lies in its systematic mapping of SDLC phases to the legal provisions of the EU AI Act--marking the first time such an alignment has been proposed. This offers a clear, practical pathway for simultaneously achieving regulatory compliance and technological development. It aims to guide and prepare SMEs that develop the previously mentioned systems, to cope with the Act, reducing its complexity and compliance costs. However, due to the general approach of the framework, companies active in another part or parts of the supply chain of AI systems can use it as well, to serve their special needs. Thus, in each phase of the framework we include tasks and actions covering the obligations mentioned not only for providers but also for authorized representatives, importers, distributors and deployers, too. This paper is structured as follows: The first section introduces the reader to the underlying process that resulted in Regulation (EU) 2024/1689, including the research question this paper intends to answer and its main components. The second section presents a literature review and the related sources used to build the research question, focusing on the spiral model on which we based our framework. The third section describes the proposed framework and its components, addressing the original goal of this study. The fourth section discusses the work's results, while the fifth section concludes the research, summarizes the research and proposes possible future work.