EU AI Act for startups and SMEs: the cheapest defensible path to evidence
A buyer or an investor has asked a startup for AI Act evidence, and no compliance function exists to produce it. For a provider of an Annex III high-risk system under Regulation (EU) 2024/1689 the smallest set that answers each element covers Art. 9, Art. 11 and Art. 17, from the Annex III application date in the regulation data Deferred. Art. 11(1), Art. 17(2) and Art. 63 simplify the form for an SME and remove no requirement. This page gives the sequence, the evidence list and the consequence of inaction.
Where this starts
The request arrives as a questionnaire item or a due-diligence line, and the first sorting question is classification. A company that develops the system under its own name is a provider under Art. 3(3). The system is high-risk under Art. 6(2) when its intended purpose matches an Annex III use case, unless one of the four conditions in Art. 6(3) applies and the system performs no profiling of natural persons. A provider that relies on Art. 6(3) documents that assessment under Art. 6(4) before placing the system on the market, and the classifier runs the Art. 6 routes in the order of PR-CLS v1.0. The registration duty that follows a not-high-risk conclusion is an unsettled point, shown with both readings on the startup hub; this page follows the provider whose system stays high-risk. Art. 50 applies by function whatever the tier, and a startup whose product also generates synthetic content carries that duty in addition.
"Cheapest" on this page means the smallest evidence set in which each element of the three articles is answered once, and no element is skipped. The Act allows three simplifications of form. Art. 11(1) third subparagraph lets an SME, including a start-up, supply the Annex IV elements in the simplified technical documentation form the Commission establishes, and notified bodies accept that form. Art. 17(2) makes the implementation of the Art. 17(1) aspects proportionate to the size of the provider's organisation, with the degree of rigour and the level of protection kept in any event. Art. 63(1) lets an SME without partner or linked enterprises within the meaning of Recommendation 2003/361/EC meet certain elements of the quality management system in a simplified manner, under Commission guidelines, and Art. 63(2) keeps Art. 9 to 15, 72 and 73 in full. The content of the evidence is therefore fixed by the articles; only its form and the depth of some quality management elements shrink.
What makes the set small is reuse across the three articles. The risk management file under Art. 9(1) is also the content of Annex IV section 5, and Art. 17(1)(g) places the same risk management system inside the quality management system. The test records that Art. 9(8) requires before placing on the market, each with a metric and threshold dated before the run, are also the validation and testing description of Annex IV section 2(g) and the examination, test and validation records of Art. 17(1)(d). The list of applied standards under Art. 17(1)(e) is also Annex IV section 7. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available and that list names, for each requirement, the standard applied with its stage or the solution adopted. Regulation (EU) 2024/1689 sets no numeric threshold in Art. 9, 11 or 17: Art. 9(8) leaves the metrics and probabilistic thresholds to the provider, Art. 9(5) gives no acceptance level for residual risk, and Art. 17 names no frequency, sampling depth or retention period. The reference documents in use today are prEN 18228Enquiry, a JTC 21 draft under enquiry, for the Art. 9(2) cycle and its records; prEN 18286Published, a JTC 21 standard not cited in the Official Journal, for the clause structure of the quality management system; and the published ISO/IEC 23894:2023Published and ISO/IEC 42001:2023Published at the next level. None of them publishes a numeric acceptance level for residual risk. The provider sets each threshold, justifies it against the context of use, and records the justification; the sequence below places that record before any test runs.
The sequence
The work runs in the order below: classification and SME status first, then the register that assigns one evidence item per element, then the risk management records and tests, then the quality management review, then the documentation and the matrix.
Determine the role under Art. 3 and match each function against Annex III and the Art. 6(3) conditions.
Record Classification and role determination report with the Art. 6(3) assessment record per function
[Regulation (EU) 2024/1689, Art. 3(3), Art. 6(2), 6(3) and 6(4) and Annex III; PR-CLS steps 8 to 17]
Record the SME status and select the documentation route: full Annex IV or the simplified form.
Record SME status record without partner or linked enterprises and the documentation route record
[Regulation (EU) 2024/1689, Art. 11(1) third subparagraph, Art. 17(2) and Art. 63(1); PR-11-DOC step 2 and PR-17-QMS step 4]
Compile the obligation register with one evidence item per Art. 9, 11 and 17 element, none duplicated.
Record Obligation register with a regulation entry id per date and one evidence item per element
[PR-CLS steps 39 to 41]
Open the hazard register and record the acceptance criterion for each hazard before any test.
Record Hazard register with intended purpose and reasonably foreseeable misuse conditions, and the residual risk acceptance record per hazard and overall
[Regulation (EU) 2024/1689, Art. 9(2)(a), 9(2)(b) and 9(5); PR-17-QMS steps 25 to 27]
Declare each metric and threshold with the reason it fits the intended purpose, dated before the run.
Record Prior defined metrics and probabilistic thresholds declaration (Art. 9(8))
[Regulation (EU) 2024/1689, Art. 9(8); PR-17-QMS step 29]
Run the full test on the frozen version before placing on the market and record a result per condition.
Record Test records naming the version tested, with a result per operating condition and per misuse condition
[Regulation (EU) 2024/1689, Art. 9(6) and 9(8); PR-17-QMS steps 28 to 32]
Sample the quality management records against each Art. 17(1) aspect and record the proportionality justification.
Record QMS gap analysis report with the proportionality justification per aspect (PR-17-QMS output)
[Regulation (EU) 2024/1689, Art. 17(1)(a) to (m) and 17(2); PR-17-QMS steps 9 to 23 and 37 to 38]
Draft the Annex IV sections, or the simplified form, from the risk management file, test records and procedures.
Record Annex IV gap and consistency report (PR-11-DOC output)
[Regulation (EU) 2024/1689, Art. 11(1) and Annex IV; PR-11-DOC steps 7, 10 and 14 to 19]
Build the traceability matrix with one row per element, its evidence and its result, and deliver the set.
Record Traceability matrix and the assembled sections with their source map
[PR-11-DOC steps 43 to 45]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Classification and role determination report with the Art. 6(3) assessment record | Art. 3(3), 6(2), 6(3) and 6(4): the role, the risk tier and the documented assessment per function | PR-CLS v1.0 |
| Risk management file (Art. 9(1)) with the hazard register and the residual risk acceptance record | Art. 9(1), 9(2)(a), 9(2)(b) and 9(5), and Annex IV section 5: the risks, the method, the measures and the acceptance criterion per hazard | the provider |
| Prior defined metrics and probabilistic thresholds declaration (Art. 9(8)) | Art. 9(8): the metric and the threshold dated before the test run, with the reason each fits the intended purpose | the provider |
| Risk management system review record (PR-17-QMS output) | Art. 9(2), 9(6) and 9(8): the cycle ran across the lifecycle, a test record exists per condition, and each residual risk is compared with its criterion | PR-17-QMS v1.0 |
| QMS gap analysis report (PR-17-QMS output) | Art. 17(1)(a) to (m) and 17(2): each aspect marked conforms, partial or gap, with the proportionality rationale and the sampled record | PR-17-QMS v1.0 |
| Simplified technical documentation form (Art. 11(1) third subparagraph), or the Annex IV technical documentation set | Art. 11(1) and Annex IV sections 1 to 9: the elements in the form the SME opts for | the provider |
| Annex IV gap and consistency report (PR-11-DOC output) | Annex IV sections 1 to 9: each row present, partial, absent or not applicable, and each declared value matched to a dated test record for the same version | PR-11-DOC v1.0 |
| Traceability matrix | Every element of Art. 9, 11 and 17: the evidence item, the protocol step and the result in one row | PR-11-DOC v1.0 |
Each artifact follows a specification with a synthetic sample on the deliverables page: the classification report follows the assessment memo specification, the two review reports follow the findings register specification, the register and the checklist output follow the register or checklist specification, and the matrix follows the traceability matrix specification.
If nothing is done
A high-risk system placed on the market after the Annex III application date without the Art. 9, 11 and 17 evidence is subject to the market surveillance procedure of Art. 79: the authority evaluates the system and, where the Chapter III requirements are not met, requires the provider under Art. 79(2) to take corrective action, to withdraw the system or to recall it within a period the authority sets. An infringement of the provider obligations in Art. 16, which cover the Section 2 requirements and the Annex IV documentation, falls in the penalty tier of Art. 99(4); Art. 99(6) sets the fine for an SME, including a start-up, at the lower of the two amounts in that tier, and the national authority sets the figure under the Art. 99(7) criteria. The provider's action is the corrective action under Art. 20 on its own initiative, and the supply under Art. 21(1) of the information and documentation a competent authority requests, which is the same set the sequence above produces. On the buyer's side, a deployer under Art. 26(1) uses the system in accordance with the instructions for use, so a provider without the Annex IV set leaves its buyer without the document that duty rests on.
Services, guides and tools for this situation
The classification and readiness assessment produces the classification report and the obligation register that scopes the rest, within the limits stated on what we cannot do; the technical documentation and evidence-pack service runs the Annex IV gap and consistency check and builds the matrix under PR-11-DOC v1.0, and the quality management review runs under PR-17-QMS v1.0.
- Services
- Guides
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.