# A Framework for Compliance with Regulation (EU) 2024/1689 for Small and Medium-Sized Enterprises
## 2 Methods  
The data, the reports and the papers used in this article were collected from various sources including the official communications of the EU Commission, scientific journals, international databases and organizations such as the OECD, EU AI Watch and the European Statistics Office. The latter were used to understand the market size and other aspects of SMEs that are active in the AI industry. Some of the chosen papers from journals deal with a variety of SDLC models and their features in order to provide the reader with a brief overview of what we consider as the most important. Others relate to existing technical and legal standards and are comparable to our research. The rest come from the communications of the EU Commission that resulted in the EU AI Act. Our framework consists of two main components, the EU Regulation and an SDLC model. To begin with, we used as a reference the published Regulation (EU) 2024/1689 in the European Official Journal. The proposed compliance framework was built based on an analysis of the obligations coming from Regulation (EU) 2024/1689 embedded in the process of the spiral model. This strategy, in our opinion, minimizes the complexity of the whole process and increases its possibilities for success. The first component was briefly analyzed previously and in the next paragraphs we will present the second one. According to [8], as a generic definition, SDLC is a process to create or alter a system. The National Institute of Standards and Technology (NIST), in NIST SP 800-218 [9], defines SDLC as a methodology used to design, create and maintain software. The International Organization for Standardization (ISO) has developed an international standard for SDLC which is ISO/IEC 12207 [10]. According to [11] the models have certain characteristics that make them suitable for certain types of projects. We can divide these models and their variations into two main categories, the traditional ones and their evolution, the agile ones. The most popular in the first category are the waterfall, the V-shaped, the incremental/iterative and the spiral model. The second category includes the agile methodology and its variations like extreme programming, scrum and DevOps. The waterfall model is the oldest of all the above-mentioned SDLCs as it was developed in 1970. It was ideal for large projects of the past that were well-defined and its success made it popular in the field of software development. Its main structure comprises five sequential steps, the requirements analysis, the design, the implementation, the integration and the maintenance. The main idea behind it is that each step must be completed to move to the next one [12; 13; 14]. The V-shaped model is often considered an extension of the waterfall model and pairs each development phase with a testing phase. All processes are arranged in pairs in a V-shape comprising the three phases of the model, the validation, the coding and the verification. On the left side of the V-shape, you have validation phase that has several independent tasks. Once completed, it is followed by the coding phase positioned at the bottom of the V-shape. Moving to the right side of the V-shape, you have the steps of the verification phase. To move to the next phase, as in the waterfall model, we must complete the previous one [12; 13]. The incremental/iterative model gathers requirements in every phase. To be able to utilize the results of each phase the project is divided into smaller components. After each increment, new functionalities are added based on the requirements until the final project is delivered [14]. The basic idea behind agile models is flexibility and time, as the focus of the models is on the speed of a project's adaptation to change. This family of SDLC models is useful in small projects and teams where there is no need for documentation and time is the critical factor [14].