Article 17 AI Act: Quality Management System for High-Risk AI

Article 17(1) lists at least twelve mandatory components: a compliance strategy including conformity assessment procedures, design and development procedures with design verification, development quality control and assurance, testing and validation procedures before, during and after development, technical specifications and applicable standards, data management systems, a risk management system per Article 9, post-market monitoring per Article 72, incident reporting procedures per Article 73, communication procedures with authorities and notified bodies, record-keeping and documentation systems, and resource management with an accountability framework.

An existing ISO 9001 QMS provides a solid foundation but needs targeted AI-specific extensions. Key additions include data quality management for training and validation data, algorithmic quality control with bias testing and robustness checks, model versioning and change management for AI models, post-market monitoring with continuous performance tracking, and AI incident handling procedures. The harmonised standard prEN 18286 is deliberately aligned with ISO 9001 to facilitate integration.

The Digital Omnibus Regulation shifted the deadlines: the QMS obligation for high-risk AI systems under Annex III applies from 2 December 2027, and for Annex I systems from 2 August 2028. Providers should start gap analysis and QMS development early, as implementation typically takes six to eighteen months depending on organisation size and existing QM maturity.

prEN 18286 is the first harmonised standard specifically developed for the quality management system under the AI Act. It specifies the twelve mandatory components from Article 17 and provides practical implementation guidance. Applying harmonised standards creates a presumption of conformity, meaning that compliance with the standard simplifies demonstrating that the QMS meets regulatory requirements.

The risk management system under Article 9 is a standalone component of the QMS under Article 17. It must be integrated into the entire lifecycle of the AI system and covers risk identification, assessment, treatment and continuous monitoring. The QMS defines the organisational processes and responsibilities within which risk management operates. Both systems must be aligned and documented.

Article 17(1)(f) requires a system for data management covering the entire data lifecycle: data acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation and retention. These procedures apply to all data processed before and during placing on the market or putting into service. In practice, this means documented processes for training, validation and test data with quality criteria and traceability.

Yes, the QMS obligation applies to all providers of high-risk AI systems regardless of company size. However, Article 17(2) includes a proportionality clause: implementation must be proportionate to the size of the provider organisation. Micro-enterprises with fewer than ten employees may use simplified procedures. The minimum standard of rigour and level of protection must be maintained in all cases.