Small and medium sized enterprises (SMEs) increasingly deploy artificial intelligence solutions, yet they must comply with the European Union's Artificial Intelligence Act. High-risk systems, such as credit scoring tools or automated hiring screeners, must meet stringent requirements for risk management, technical documentation, human oversight, and post-market monitoring. Medium and low-risk systems also require ongoing observation to verify that their initial classification remains accurate and does not escalate. Although legislators introduced proportionality measures for smaller businesses, recent analyses suggest that implementation costs remain prohibitive for SMEs lacking in-house compliance staf. Commission estimates indicate that a 50-person start-up could incur roughly EUR 216 000-319 000 in first-year compliance costs for a single AI system. To close this gap, we propose the Lightweight AI Governance (LAIG) framework, a pragmatic, risk-based governance model expressly designed for SMEs. LAIG distils best practices from ISO/IEC 42001 and the NIST AI Risk Management Framework into modular procedures that can be embedded in familiar DevOps workflows and maintained with limited resources. Core elements include clear role assignment, inventory-centred risk classification, checklistdriven impact assessments, targeted mitigation controls, and concise Markdown and Git documentation templates optionally drafted with large language model assistance and always subject to human verification. An illustrative ifntech scenario demonstrates how a company with forty employees can address bias, transparency, and oversight obligations without hiring a dedicated compliance department. By lowering the organisational and financial thresholds for trustworthy AI compliance, LAIG empowers European SMEs to continue innovating while satisfying both the letter and the spirit of the AI Act.
Artificial intelligence now reaches deeply into everyday operations of European small and medium sized
enterprises, yet most of these firms still operate without formal governance structures. The absence
of clear oversight exposes them to legal, ethical, and reputational risk. During the past four years
the share of companies with fewer than 250 employees experimenting with AI doubled, according to
Eurostat [
Voluntary standards have emerged in parallel. ISO/IEC 42001 sets out a Plan–Do–Check–Act
management system that presumes enterprise-level resources [
In response, we present the Lightweight AI Governance framework, an approach tailored to Gitcentred development teams that converts every clause of Annex IV into modular checklists, Markdown templates, and automated gap analysis scripts. The framework builds on lessons from agile software engineering and aligns compliance checkpoints with familiar commit and review rituals. By grounding governance in existing developer workflows, we aim to minimise friction while maximising traceability. Our study therefore investigates whether the Act’s obligations can be divided into tasks suited to limited resources, which parts of ISO/IEC 42001 and the NIST framework remain essential, how governance artefacts can coexist with source code in the same repository and continuous integration pipeline, and whether the resulting workflow can reduce compliance overhead while preserving auditability and the core principles of trustworthy AI. Unlike standalone checklist tools, LAIG integrates compliance steps directly into DevOps practices and automates verification, which we hypothesise can reduce overhead without compromising rigour.
Scholars and standard setters agree that trustworthy AI demands both technical safeguards and
organisational controls, yet their guidance difers in level of detail, which complicates implementation for smaller
ifrms. The European AI Act is the most comprehensive legal instrument to date. Chapter III mandates
risk management, data governance, documentation, transparency, accuracy, robustness, cybersecurity,
and human oversight for every high-risk system, while Annex IV lists the technical documentation
required to demonstrate conformity [
Focused research on SME governance remains scarce. Analyses warn that the Act’s proportionality
measures may prove illusory without practical templates, shared tools, and subsidised audits [
The LAIG framework rests on two intertwined investigations. A clause-by-clause reading of the Artificial
Intelligence Act supplied an exhaustive inventory of legal obligations, while a matching exercise linked
each obligation with the management functions defined in ISO/IEC 42001 and the NIST AI RMF [
Interview data showed that small product teams weigh governance steps against tight sprints, quarterly burn rates, and investor deadlines. In response the framework commits to six principles. First, every activity must create compliance evidence or mitigate risk in a way that exceeds its efort cost. Second, the workload is sliced into small autonomous tasks so that a developer can complete a compliance item between ordinary feature tickets. Third, traceability is guaranteed because every file carries explicit tags that point to one or more Annex IV clauses and the entire history lives in Git, which ofers dif-based evidence for auditors. Fourth, the architecture embeds governance artefacts in the same repository, continuous integration system, and code review flow already familiar to engineers, so no one needs to log into a second platform. When a separate repository is unavoidable, a release build in the product repository must reference a signed governance commit, and the build fails if that commit does not pass coverage checks. Fifth, language models may propose text, yet a human must read, approve, and merge the content, which reduces the risk of hallucination and keeps accountability clear. Sixth, the framework relies on familiar tools, including Markdown editors, Git command line utilities, and spreadsheets, so adoption does not mandate new software procurement. These principles aim to preserve velocity, protect product quality, and satisfy regulators without turning a ten-person team into a paperwork factory.
LAIG treats documentation as source material. A dedicated repository contains seven Markdown files that mirror the order of Annex IV, beginning with system description and ending with post-market monitoring. Each file opens with a YAML header that records system identifier, version, and author, then continues with section text marked by short comment tags that reference clause numbers. A lightweight linter runs on every pull request to highlight any tag that still lacks narrative. Because each commit message must quote the clause identifier, reviewers can follow the compliance trail from first model prototype to production deployment with no separate log.
Daily operation unfolds in five human-controlled stages. A developer completes a short Markdown intake form that captures purpose, stakeholders, data sources, and maturity stage together with intended use, decision context, afected users, input data origin, model family, oversight thresholds, and the expected deployment pathway. A helper script transforms the answers into prompts that reference the legal clauses, so authors do not start from a blank page. A language model drafts text and inserts VERIFY tokens wherever confidence is low. A subject matter expert resolves tokens, edits numbers, checks links, and merges the pull request, which locks the draft into Git history. A continuous integration job then renders the repository to PDF and, optionally, to DOCX, so the latest technical file is always downloadable in a single click. The same job applies two gates. First, all applicable Annex IV items are complete or explicitly marked not applicable with a justification in one sentence, and no VERIFY tokens remain. Second, if any condition fails, the release is blocked and a remediation ticket is opened. When governance and product live in diferent repositories, the product build reads the referenced governance commit and blocks the release whenever the gates are not satisfied. Folding the entire loop into the familiar pull request rhythm converts compliance from an end-of-project silo into an everyday habit.
To operationalise the principle that every action must generate evidence or mitigation, the governance
repository is linked to the implementation repository through a shared CI/CD pipeline [
The clause mapping table pairs every Annex IV requirement with a heading path and a checkbox. If a requirement is irrelevant, such as photographs of a physical device for a pure software product, the author marks the row not applicable and writes a one-sentence justification. Because the table itself is version-controlled, auditors can review how coverage improves over time and developers can run automated dif checks to catch accidental deletions. Closely related sub-requirements are grouped to reduce boilerplate, and each group links to concrete artefacts and tests. This repository-first mapping contrasts with questionnaire tools because it is versioned alongside the code and enforced through automated checks during pull requests and releases.
FinPay is a hypothetical fintech based in Warsaw that employs forty people and provides AI-driven credit scoring services. As creditworthiness assessment falls within Annex III of the AI Act as a high-risk use, FinPay must demonstrate comprehensive risk management, maintain technical documentation, ensure human oversight, transparency, robustness, and cybersecurity, and implement post-market monitoring. Before adopting LAIG, compliance evidence was scattered across unversioned documents and ad hoc spreadsheets, hindering audit readiness, obscuring accountability, and undermining traceability. Adoption proceeded in three compact sprints that embedded governance in everyday engineering. First, the team created a dedicated governance repository, assigned named responsibility for each relevant legal clause, and completed an intake questionnaire capturing purpose, stakeholders, data lineage, model family, oversight thresholds, and the intended deployment path. A machine-readable clause map linked Annex IV requirements to specific document headings and checkboxes, ensuring that each item was either completed or explicitly marked as not applicable with justification. Next, developers and data scientists drafted seven Markdown sections mirroring Annex IV using language model assistance for first drafts with explicit verification markers, while legal and risk specialists resolved markers, corrected figures, validated links, and tightened claims. In parallel, the modelling team addressed dataset imbalance with balanced resampling and recorded the rationale for calibration and fairness thresholds alongside the data governance narrative. Finally, engineers implemented continuous integration that automatically renders the repository into a technical file with each change and enforces two release gates: full clause coverage with no unresolved verification markers, and a signed governance commit referenced by the product build. If either gate fails, the release is blocked and a remediation ticket is generated. The first end-to-end execution of this workflow produced a seventeen-page technical file, ready for engagement with a regulatory sandbox and for supporting early dialogue with assessors. Developers reported that handling governance artefacts through pull requests felt natural, while managers valued the living audit trail in Git and the clear line from requirement to mitigation. Although formal time and cost measurements are forthcoming, the team reports higher confidence and improved readiness for its first conformity assessment under the AIA.
The LAIG framework gives small enterprises a practical route to trustworthy AI by folding risk checks, human oversight, and continuous monitoring into the Git-based routines developers already follow. This arrangement addresses Annex IV documentation duties and supports the operationalisation of key Chapter III obligations within development workflows, while creating a minimum viable Plan–Do– Check–Act loop that aligns with the Govern and Manage functions of the NIST AI RMF. By slicing Annex IV into bite-sized tasks, the method lets teams focus on the highest risks first, a need often voiced in founder interviews. Governance files sit beside source code so engineers can move from feature branch to compliance update without changing context, and each commit records a searchable audit trail that managers and examiners value. Automated gap tests flag missing clauses the moment a pull request appears, and language models generate draft text that experts refine, a pairing that speeds writing yet keeps the final judgement human.
These gains come with caveats. The simplified nature of the framework, which is its main advantage for SMEs, simultaneously creates risks that must be managed. LAIG in its basic form is best suited for low- and moderate-risk systems. For AI systems classified as high-risk under the AI Act, such as tools for credit scoring or recruitment screening, a simplified governance approach alone may prove insuficient. SMEs implementing such systems will need to invest in more rigorous control, risk management, and post-market monitoring mechanisms in line with the strict requirements of the regulation. In this context, LAIG should be interpreted as a transitional instrument of proportional governance. Its role is not to replace comprehensive conformity assessment procedures prescribed for high-risk AI systems, but rather to enable SMEs to initiate systematic preparation of Annex IV documentation within their existing development workflows. The artefacts created in this process—Git-based audit trails, clause-referenced checklists, and modular records—constitute a preparatory layer of evidence that can be expanded into the full compliance structures required under ISO/IEC 42001 or NIST-aligned frameworks and presented to notified bodies during formal assessments.
A lightweight approach omits some formalities, which can lead to overlooking hidden issues such
as undiscovered bias in training data or security vulnerabilities [
Using language models to assist with documentation speeds drafting but introduces concerns about
data confidentiality and the accuracy of generated content. Although the framework requires human
verification, the risk associated with sending sensitive information to external service providers remains
significant. The FinPay case remains illustrative rather than empirical, hardware-rich products will
require extra safety documentation, and sector-specific laws may layer additional duties on top of the AI
Act. Future pilot deployments are expected to yield empirical data on time and cost eficiency, while the
development of open-source tools for automated clause verification and dossier generation, combined
with cooperation with notified bodies, may support the emergence of a “light audit track” in which
the repository itself serves as primary evidence [
The European AI Act asks SMEs to deliver governance that rivals large corporations even though their budgets are far smaller. The LAIG framework responds by turning every Annex IV duty, along with the intent of ISO/IEC 42001 and the NIST AI RMF, into modular routines that fit naturally within existing engineering practice. Documentation resides alongside source code in a version-controlled repository, and every change generates verifiable evidence that can be independently reviewed. Clause coverage is enforced through structured checklists and machine-readable mappings, ensuring that each requirement is either fulfilled or explicitly marked as not applicable with justification. Automated CI/CD gates prevent releases in which required artefacts or reviews are incomplete. Optional language model assistance accelerates drafting but human approval remains decisive, which preserves accountability and limits the risk of error. Teams define acceptance thresholds for accuracy, calibration, and fairness in line with the system’s risk profile and track them across releases. In this way LAIG establishes a disciplined cycle of planning, doing, checking, and improving that protects developer velocity while creating a durable audit trail.
Next steps are empirical and collaborative. Planned pilots in finance and health analytics will measure documentation efort, auditor revision cycles, developer usability, and outcome quality including calibration and fairness. Findings will feed improvements to templates, coverage checks, and acceptance criteria and will inform engagement with regulators and notified bodies toward a credible light audit path in which a well-maintained repository can serve as primary evidence of compliance. If the expected gains are confirmed, LAIG will lower the organisational and financial threshold for trustworthy AI and help European SMEs sustain innovation while meeting both the letter and the spirit of the Act.
During the preparation of this work, the authors used ChatGPT to generate Figures 1 and 2. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content.