{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T14:21:36Z","timestamp":1787235696425,"version":"build-2736575974"},"reference-count":25,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Research Center of the University of Piraeus"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>The European Union\u2019s Artificial Intelligence Act (EU AI Act) is expected to be a major legal breakthrough in an attempt to tame AI\u2019s negative aspects by setting common rules and obligations for companies active in the EU Single Market. Globally, there is a surge in investments to encourage research, development and innovation in AI that originates both from governments and private firms. The EU recognizes that the new Regulation (EU) 2024\/1689 is difficult for start-ups and SMEs to cope with and it announced the release of tools, in the near future, to ease that difficulty. To facilitate the active participation of SMEs in the AI arena, we propose a framework that could assist them to better comply with the challenging EU AI Act during the development life cycle of an AI system. We use the spiral SDLC model and we map its phases and development tasks to the legal provisions of Regulation (EU) 2024\/1689. Furthermore, the framework can be used to promote innovation, improve their personnel\u2019s expertise, reduce costs and help the companies avoid the proposed substantial fines described in the Act.<\/jats:p>","DOI":"10.3390\/jcp5030040","type":"journal-article","created":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T10:45:08Z","timestamp":1751366708000},"page":"40","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["A Framework for Compliance with Regulation (EU) 2024\/1689 for Small and Medium-Sized Enterprises"],"prefix":"10.3390","volume":"5","author":[{"given":"Sotirios","family":"Stampernas","sequence":"first","affiliation":[{"name":"Department of Digital Systems, University of Piraeus, 18532 Piraeus, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3101-5347","authenticated-orcid":false,"given":"Costas","family":"Lambrinoudakis","sequence":"additional","affiliation":[{"name":"Department of Digital Systems, University of Piraeus, 18532 Piraeus, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,1]]},"reference":[{"key":"ref_1","unstructured":"(2018). Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions. Artificial Intelligence for Europe, 25.4.2018 COM(2018) 237 Final, European Union. Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:52018DC0237."},{"key":"ref_2","unstructured":"(2021). Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions. Fostering a European Approach to Artificial Intelligence, COM(2021) 205 Final, European Union. Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A52021DC0205."},{"key":"ref_3","unstructured":"(2024, August 01). Proposal of Regulation of the European Parliament and of the Council, Laying Down Harmonised Rules on Artificial Intelligence and Amending Regulations (EC) No 300\/2008, (EU) No 167\/2013, (EU) No 168\/2013, (EU) 2018\/858, (EU) 2018\/1139 and (EU) 2019\/2144 and Directives 2014\/90\/EU, (EU) 2016\/797 and (EU) 2020\/1828 (Artificial Intelligence Act); PE-CONS 24\/24. 14 May 2024. Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/PDF\/?uri=CONSIL:PE_24_2024_INIT."},{"key":"ref_4","unstructured":"(2024, August 01). Regulation (EU) 2024\/1689 of the European Parliament and of the Council, of 13 June 2024, Laying Down Harmonised Rules on Artificial Intelligence and Amending Regulations (EC) No 300\/2008, (EU) No 167\/2013, (EU) No 168\/2013, (EU) 2018\/858, (EU) 2018\/1139 and (EU) 2019\/2144 and Directives 2014\/90\/EU, (EU) 2016\/797 and (EU) 2020\/1828 (Artificial Intelligence Act). Available online: https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\/eng."},{"key":"ref_5","unstructured":"(2024, September 10). Commission Recommendation of 6 May 2003. Concerning the Definition of Micro, Small and Medium-Sized Enterprises. C(2003) 1422. Available online: https:\/\/eur-lex.europa.eu\/eli\/reco\/2003\/361\/oj\/eng."},{"key":"ref_6","unstructured":"Di Bella, L., Katsinis, A., Lag\u00fcera-Gonz\u00e1lez, J., Odenthal, L., Hell, M., and Lozar, B. (2023). Annual Report on European SMEs 2022\/2023, Publications Office of the European Union."},{"key":"ref_7","unstructured":"Righi, R., Pineda Le\u00f3n, C., Cardona, M., Soler Garrido, J., Papazoglou, M., Samoili, S., and V\u00e1zquez-Prada Baillet, M. (2022). AI Watch Index 2021, Publications Office of the European Union."},{"key":"ref_8","first-page":"778","article-title":"A review on various software development life cycle (SDLC) models","volume":"3","author":"Kute","year":"2014","journal-title":"Int. J. Res. Comput. Commun. Technol."},{"key":"ref_9","unstructured":"National Institute of Standards and Technology (NIST) (2022). Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities, NIST. NIST Special Publication 800-218."},{"key":"ref_10","unstructured":"(2017). Systems and Software Engineering\u2014Software Life Cycle Processes (Standard No. ISO\/IEC\/IEEE 12207:2017). Available online: https:\/\/www.iso.org\/obp\/ui\/en\/#iso:std:63712:en."},{"key":"ref_11","first-page":"106","article-title":"A comparison between three SDLC models waterfall model, spiral model, and Incremental\/Iterative model","volume":"12","author":"Alshamrani","year":"2015","journal-title":"Int. J. Comput. Sci. Issues (IJCSI)"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"155","DOI":"10.46338\/ijetae0422_19","article-title":"Comparison of the System Development Life Cycle and Prototype Model for Software Engineering","volume":"12","author":"Prabowo","year":"2022","journal-title":"Int. J. Emerg. Technol. Adv. Eng."},{"key":"ref_13","first-page":"268","article-title":"Analysis of SDLC models","volume":"6","author":"Arora","year":"2016","journal-title":"Int. J. Curr. Eng. Technol."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"30","DOI":"10.32628\/CSEIT206410","article-title":"Software development life cycle models-A comparative study","volume":"5","author":"Gurung","year":"2020","journal-title":"Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol."},{"key":"ref_15","unstructured":"Javed, M., Ahmad, B., Hussain, S., and Ahmad, S. (2010). Mapping the best practices of XP and project management: Well defined approach for project manager. arXiv."},{"key":"ref_16","unstructured":"Pressman, R.S., and India, M.G. (2010). Software Engineering: A Practitioner\u2019s Approach, McGraw-Hill Education. [7th ed.]."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Wettinger, J., Breitenb\u00fccher, U., and Leymann, F. (2014). Devopslang\u2013bridging the gap between development and operations. Service-Oriented and Cloud Computing: Third European Conference, Manchester, UK, 2\u20134 September 2014, Proceedings, Springer.","DOI":"10.1007\/978-3-662-44879-3_8"},{"key":"ref_18","first-page":"69","article-title":"A Spiral Model of Software Development and Enhancement","volume":"23","author":"Boehm","year":"1995","journal-title":"IEEE Eng. Manag. Rev."},{"key":"ref_19","unstructured":"National Institute of Standards and Technology (NIST) (2025, June 18). Artificial Intelligence Risk Management Framework (AI RMF 1.0). 26 January 2023, Available online: https:\/\/nvlpubs.nist.gov\/nistpubs\/ai\/NIST.AI.100-1.pdf."},{"key":"ref_20","unstructured":"(2018). Risk Management\u2014Guidelines (Standard No. ISO 31000:2018). Available online: https:\/\/www.iso.org\/standard\/65694.html."},{"key":"ref_21","unstructured":"(2023). Artificial Intelligence Management System (Standard No. ISO\/IEC 42001:2023). Available online: https:\/\/www.iso.org\/standard\/81230.html."},{"key":"ref_22","unstructured":"Wong, C. (2025, June 14). Investigation of Information Risk Management Frameworks. Available online: https:\/\/www.researchgate.net\/publication\/364293344."},{"key":"ref_23","unstructured":"(2025, June 18). Available online: https:\/\/www.edps.europa.eu\/system\/files\/2024-05\/24-05-29_genai_orientations_en_0.pdf."},{"key":"ref_24","unstructured":"European Digital SME Alliance (2025, June 19). AI Act Conformity Tool. Available online: https:\/\/www.digitalsme.eu\/ai-act-conformity-tool\/."},{"key":"ref_25","unstructured":"OECD (2025, June 19). Introducing the OECD AI Capability Indicators. Available online: https:\/\/www.oecd.org\/en\/publications\/introducing-the-oecd-ai-capability-indicators_be745f04-en.html."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/5\/3\/40\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:02:35Z","timestamp":1760032955000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/5\/3\/40"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,1]]},"references-count":25,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["jcp5030040"],"URL":"https:\/\/doi.org\/10.3390\/jcp5030040","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,1]]}}}