EU AI Act Article 17: Quality Management System (QMS)

What the QMS Requirement Is

Providers of high-risk AI systems must establish a quality management system that ensures compliance with the AI Act, documented in a systematic and orderly manner as written policies, procedures and instructions.

The QMS is proportionate to the size of the provider's organisation, and for providers that are already subject to sectoral quality-management obligations under other Union law, the AI Act requirements can be integrated into the existing system rather than duplicated. The point is not paperwork for its own sake: the QMS is how a provider demonstrates that compliance is a repeatable, governed process rather than a one-off effort.

Elements the QMS Must Document

Article 17(1) enumerates the aspects the quality management system must cover, at least:

• Regulatory compliance strategy — including for conformity assessment and for managing modifications to the high-risk system
• Design and development procedures — techniques, procedures and systematic actions for design, design control and design verification
• Development and quality control — procedures for development, quality control and quality assurance of the system
• Examination, test and validation — procedures to be carried out before, during and after development, and how frequently they are performed
• Technical specifications and standards — the standards applied, and where harmonised standards are not applied in full, the means used to meet the requirements
• Data management — systems and procedures for data acquisition, collection, analysis, labelling, storage, filtering, mining, aggregation and retention
• Risk management — the Article 9 risk management system
• Post-market monitoring — setting up, implementing and maintaining a post-market monitoring system under Article 72
• Incident reporting — procedures for reporting serious incidents in line with Article 73
• Communication and accountability — handling of communication with authorities and other parties, record-keeping, resource management, and an accountability framework defining management and staff responsibilities

The Harmonised Standard Is Still Emerging

To support Article 17, a dedicated harmonised standard on the AI quality management system is being developed under the Commission's standardisation request to CEN-CENELEC.

That work is progressing under the reference prEN 18286 (an AI quality management system standard). It is still a draft: the 'pr' prefix marks a work-in-progress European standard that has not yet been published or cited in the Official Journal, so it does not yet confer a presumption of conformity. Providers should design their QMS to the Article 17 text now and track the standard as it matures — building to the draft can reduce rework, but it is not a substitute for the legal requirement and should not be relied on as if already in force.

Standard references and publication status change over time; always verify the current status of prEN 18286 and any related harmonised standards against the Official Journal before relying on them.