# A Framework for Compliance with Regulation (EU) 2024/1689 for Small and Medium-Sized Enterprises
## 2 Methods
ISO/IEC 42001 [21] is the first international standard specifically developed for Artificial Intelligence Management Systems (AIMSs). It provides a framework for organizations to assist them in managing the risks and responsibilities of AI, while ensuring that AI technologies are developed and deployed in a transparent, ethical and accountable manner. While this is an AI-specific governance and management system and focuses on AI lifecycle governance, transparency, bias, explainability and oversight, compared to the proposed framework it does not refer to specific provisions of the EU AI Act and how they can be addressed during the development process, which requires a high level of expertise. This means that ISO 42001 needs adaptation to satisfy the provisions of the Act, while 31000 focuses only on specific articles concerning risk management. Other frameworks such as FAIR (Factor Analysis of Information Risk) [22] are more specific in terms of purpose. It is a quantitative framework for understanding, analyzing and measuring information risk. FAIR enables organizations to express risk in financial units, making it easier to prioritize and justify decisions related to cybersecurity investments. It provides an evaluation for event loss exposure, transforming risk into monetary units, using as factors threat event frequency, vulnerability and impact. As such, it could be used in a complementary way during the development phase, when discussing the security and cybersecurity measures for the system. Our research is broader in application as it discusses the AI Act provisions during the lifecycle that expand further than the investment decisions in cybersecurity. There are some EU-approved guidelines to help SMEs related to specific issues, such as the EDPS guidelines for data protection issues and the AI Act conformity tool for evaluating whether the company must conform with the AI Act. All of these are useful, but they are focused on specific articles of the AI Act and they do not deal with the development life cycle and all related articles. The EDPS, in June 2024, issued a guidance paper [23] to provide some practical advice to EU institutions, bodies, offices and agencies (EUIs) on the processing of personal data in their use of generative AI systems. The aim is to ensure that they comply with their data protection obligations as set out in Regulation (EU) 2018/1725. However, these guidelines can be meaningful to SMEs that can use them to their benefit in the process of the AI Act's adoption in the data protection task. The scope of our framework is broader than this paper; however, it could be a positive input during the data protection requirements as described in the articles of the AI Act. The European DIGITAL SME Alliance's \"AI Act Conformity Tool\" [24] is a useful tool to evaluate whether the AI system being developed/used by a company needs to comply with the AI Act. It is a form of questionnaire that provides initial feedback for SMEs on whether their product must conform with the AI Act. It does not provide a pathway to conformity and development compared to the proposed framework. The OECD recently developed a methodology [25] to evaluate AI performance using a set of indicators compared to specific human attributes. Linking AI capabilities to human ones allows the assessment of AI's potential role in education. Beyond education, the indicators provide a framework to enable discussion concerning the implications of AI in other sectors: employment, civic participation, leisure activities and everyday life. This methodology is performance-related as it focuses on impact and not on the development of AI systems. All the above-mentioned standards, methodologies, tools and guidelines address different parts of AI such as terminology, lifecycle processes, risk, bias, trustworthiness, impact assessment and management systems. Each one is a useful tool for companies that deal with one or more parts of how AI systems can be developed but they are not aligned to the EU AI Act.