Art. 17: Quality management system under the EU AI Act

Art. 17 requires providers of high-risk AI systems to put a quality management system in place, documented in written policies, procedures and instructions that cover the aspects in Art. 17(1) points (a) to (m). In this mapping, eight elements are testable, seventeen are documentation and twelve are process. Regulation (EU) 2026/1744 moved the Annex III application date 2027-12-02Deferred and left the content of the obligation unchanged. The one wording change sits in Art. 17(2), which now names SMEs, start-ups and SMCs in the proportionality rule.

Where this applies

2027-12-02DeferredAnnex III standalone high-risk obligations
2028-08-02DeferredAnnex I product-embedded high-risk obligations
2026-07-27In forceDigital Omnibus on AI, entry into force

What the text requires

Art. 17(1)(g) places the risk management system under Art. 9 inside the quality management system, and Art. 17(1)(f) holds the data management procedures that the data sets under Art. 10 rely on. The record-keeping procedure under Art. 17(1)(k) covers the documents Art. 18(1) names, among them the technical documentation under Art. 11. Art. 63(1), which Regulation (EU) 2026/1744 amended, lets an SME without partner or linked enterprises meet certain elements in a simplified manner, and Art. 63(2) keeps every other requirement in force.

What the text requires and how each element is verified
Requires	Testable	Documentation	Process
Art. 17(1)Providers of high-risk AI systems put a quality management system in place. The system has the purpose of compliance with Regulation (EU) 2024/1689. The provider documents the system in a systematic and orderly manner in the form of written policies, procedures and instructions. The system includes at least the aspects in points (a) to (m). Art. 17(1)(a)A strategy for regulatory compliance. The strategy includes compliance with conformity assessment procedures. The strategy includes procedures for the management of modifications to the high-risk AI system. Art. 17(1)(b)Techniques, procedures and systematic actions for the design, design control and design verification of the high-risk AI system. Art. 17(1)(c)Techniques, procedures and systematic actions for the development, quality control and quality assurance of the high-risk AI system. Art. 17(1)(d)Examination, test and validation procedures that the provider carries out before, during and after the development of the high-risk AI system. The frequency with which the provider carries them out. Art. 17(1)(e)Technical specifications, including standards, that the provider applies. Where the provider does not apply the relevant harmonised standards in full, or where those standards do not cover all of the relevant requirements in Chapter III Section 2, the means the provider uses so that the high-risk AI system meets those requirements. Art. 17(1)(f)Systems and procedures for data management. Data management includes data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation on the data that the provider performs before and for the purpose of the placing on the market or the putting into service for first use directly to the deployer or for own use in the Union for its intended purpose. Art. 17(1)(g)The risk management system referred to in Art. 9. Art. 17(1)(h)The setting-up, implementation and maintenance of a post-market monitoring system in accordance with Art. 72. Art. 17(1)(i)Procedures related to the reporting of a serious incident in accordance with Art. 73. Art. 17(1)(j)The handling of communication with national competent authorities, other relevant authorities, including those that provide or support access to data, notified bodies, other operators, customers or other interested parties. Art. 17(1)(k)Systems and procedures for record-keeping of all relevant documentation and information. Art. 17(1)(l)Resource management, including security-of-supply related measures. Art. 17(1)(m)An accountability framework that sets out the responsibilities of the management and other staff with regard to all the aspects listed in Art. 17(1). Art. 17(2)The implementation of the aspects in Art. 17(1) is proportionate to the size of the provider's organisation, in particular where the provider is an SME, including a start-up, or an SMC. Regulation (EU) 2026/1744 inserted the reference to SMEs, start-ups and SMCs. Providers respect in any event the degree of rigour and the level of protection that the Regulation requires for their high-risk AI systems. Art. 17(3)Providers of high-risk AI systems that are subject to obligations on quality management systems or an equivalent function under relevant sectoral Union law may include the aspects in Art. 17(1) as part of the quality management system under that law. Art. 17(4)For providers that are financial institutions subject to requirements on their internal governance, arrangements or processes under Union financial services law, the obligation to put a quality management system in place is deemed fulfilled when they comply with the rules on internal governance arrangements or processes under the relevant Union financial services law. This does not apply to Art. 17(1) points (g), (h) and (i). Art. 63(1)SMEs, including start-ups, may comply with certain elements of the quality management system required by Art. 17 in a simplified manner, provided that they have no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC. Regulation (EU) 2026/1744 extended this derogation from microenterprises to SMEs. The Commission develops guidelines on the elements that may be complied with in a simplified manner, without effect on the level of protection or on the requirements for high-risk AI systems. Under Art. 63(2) the derogation does not exempt these operators from any other requirement in the Regulation, including Art. 9 to 15, 72 and 73.	Each released version of the high-risk AI system has a modification record that states whether the change is a substantial modification and which conformity assessment step follows (Art. 17(1)(a)); verified by record sampling Design verification records exist for the current version and trace each verified item to a design input (Art. 17(1)(b)); verified by record sampling Quality control records for the current release show the checks and outcomes that the development procedure names (Art. 17(1)(c)); verified by record sampling Examination, test and validation records exist for the current version at the frequency the procedure states, and each record names the version tested (Art. 17(1)(d)); verified by record sampling against the stated frequency Dataset records for the training, validation and testing sets show the acquisition, labelling, storage and retention steps that the data management procedure names (Art. 17(1)(f)); verified by record sampling A simulated serious incident walked through the reporting procedure reaches the reporting step with the market surveillance authority and the Art. 73 timeframe identified (Art. 17(1)(i)); verified by procedure walk-through A sample of the records named in the record-keeping procedure is retrievable for the current version and for one earlier version within the retention period the procedure states (Art. 17(1)(k)); verified by retrieval test Each responsibility in the accountability framework is held by a named role, and the role holder confirms the responsibility in a walk-through (Art. 17(1)(m)); verified by role walk-through	The quality management system is documented in written policies, procedures and instructions (Art. 17(1)) A strategy for regulatory compliance names the conformity assessment procedure the provider follows and the procedure for the management of modifications (Art. 17(1)(a)) Techniques, procedures and systematic actions for design, design control and design verification are written (Art. 17(1)(b)) Techniques, procedures and systematic actions for development, quality control and quality assurance are written (Art. 17(1)(c)) Examination, test and validation procedures state what is carried out before, during and after development, and the frequency of each (Art. 17(1)(d)) A list of the technical specifications and standards applied, and, where harmonised standards are not applied in full or do not cover a Chapter III Section 2 requirement, a statement of the means used for that requirement (Art. 17(1)(e)) Data management procedures cover data acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation and retention (Art. 17(1)(f)) The post-market monitoring plan that Art. 72(3) requires is part of the quality management system documentation (Art. 17(1)(h)) Serious incident reporting procedures name the reporting path, the authority and the Art. 73 timeframes (Art. 17(1)(i)) Procedures for the handling of communication with authorities, notified bodies, other operators, customers and other interested parties are written (Art. 17(1)(j)) Record-keeping procedures name the records kept, where they are kept and the retention period of each (Art. 17(1)(k)) Resource management, including security-of-supply related measures, is described (Art. 17(1)(l)) The accountability framework sets out the responsibilities of the management and other staff for each Art. 17(1) aspect (Art. 17(1)(m)) A proportionality rationale records how the size of the organisation, including SME, start-up or SMC status, shaped the implementation and shows that the degree of rigour is kept (Art. 17(2)) Where a sectoral quality management system is used, a mapping from each Art. 17(1) aspect to the element of the sectoral system that holds it (Art. 17(3)) Where Art. 17(4) applies, a mapping from the Union financial services governance rules to the quality management system obligation, with points (g), (h) and (i) documented separately (Art. 17(4)) Where an SME uses the simplified manner, a record of the SME status without partner or linked enterprises and of the elements simplified under the Commission guidelines (Art. 63(1))	The quality management system operates across the lifecycle and is kept current after each modification of the system (Art. 17(1)) Modifications to the high-risk AI system are managed under the written procedure before release (Art. 17(1)(a)) Quality assurance activities run during development as the procedure states (Art. 17(1)(c)) Examination, test and validation are repeated after development at the stated frequency (Art. 17(1)(d)) The risk management system under Art. 9 runs as part of the quality management system (Art. 17(1)(g)) The post-market monitoring system is set up, implemented and maintained in accordance with Art. 72 (Art. 17(1)(h)) Serious incidents are reported to the market surveillance authority in accordance with Art. 73 (Art. 17(1)(i)) Communication with authorities, notified bodies, other operators and customers follows the written procedure (Art. 17(1)(j)) Records are kept under the record-keeping procedure for the period set in Art. 18 (Art. 17(1)(k)) Resources, including security of supply, are managed under the written measures (Art. 17(1)(l)) Responsibilities are assigned to roles and kept current as management and staff change (Art. 17(1)(m)) Risk management, post-market monitoring and serious incident reporting continue for a financial institution that relies on Art. 17(4) (Art. 17(4))

Metrics and where thresholds come from

Threshold sources, in order of precedence

A harmonised standard cited in the Official Journal (none as of the anchor date)
A JTC 21 draft standard (prEN), with its stage
An ISO/IEC standard or technical report, with its stage
A Commission guideline or code of practice, with its date from the standards data
NIST AI RMF or a sector framework
The state of the art, which the provider justifies and documents

Regulation (EU) 2024/1689 sets no numeric threshold in Art. 17. The article names the aspects a quality management system contains; it names no frequency, sampling depth or retention period for any of them, and Art. 17(2) states the proportionality principle without a size figure. No harmonised standard for Art. 17 is cited in the Official Journal as of the anchor date, so no presumption of conformity exists at hierarchy level 1. The reference used today sits at levels 2 and 3: prEN 18286 from CEN-CENELEC JTC 21, at the stage shown from the standards data and not cited in the Official Journal, supplies the clause structure; ISO/IEC 42001:2023 supplies the management-system clauses and Annex A controls. Where either document names a frequency or a period, the record cites the clause and its condition. Where neither does, there is no published threshold; the provider justifies the test frequency, the record retention period and the sampling depth against the context of use, and the PR-17-QMS element-evidence step records that justification for each Art. 17(1) point.

Metric sources and their stage
Source and stage	Title	What it provides here	Verified on
`prEN 18286`Published	Quality management system for EU AI Act regulatory purposes (approved as EN 18286:2026)	the clause structure of an Art. 17 quality management system: the policies, procedures, records and lifecycle controls a gap analysis checks for each of Art. 17(1) points (a) to (m), with an Annex ZA mapping to the Act; not cited in the Official Journal	Verified on 18 September 2026CEN-CENELEC, EN in the spotlight: AI quality management (31 July 2026)
`ISO/IEC 42001:2023`Published	AI management system	management-system clauses (context, leadership, planning, support, operation, performance evaluation, improvement) and Annex A controls that map to Art. 17(1) points (b), (c), (d), (f), (k), (l) and (m), plus the internal audit and management review method a QMS review reuses	Verified on 18 September 2026ISO catalogue, ISO/IEC 42001:2023
`NIST AI RMF 1.0`Published	AI Risk Management Framework	Govern function: policies, roles and accountability structures that map to Art. 17(1)(a) and (m), used when a provider reuses US framework artifacts as Art. 17 evidence	Verified on 18 September 2026NIST, AI Risk Management Framework

Procedures

Each protocol is versioned; its page states the derivation from the standards above. PR-17-QMS v1.0 covers the eight testable elements, from the modification record sampling under Art. 17(1)(a) to the role walk-through under Art. 17(1)(m).

PR-17-QMS v1.0QMS gap analysis protocolv1.0

What an assessor asks for

Quality management system manual with written policies, procedures and instructions (Art. 17(1))
Regulatory compliance strategy and modification management procedure (Art. 17(1)(a))
Examination, test and validation procedure with stated frequency and the records of each run (Art. 17(1)(d))
Applied technical specifications and standards list with the Section 2 coverage statement (Art. 17(1)(e))
Data management procedure and dataset lineage records (Art. 17(1)(f))
Record-keeping procedure and record register (Art. 17(1)(k))
Accountability framework with management and staff responsibilities (Art. 17(1)(m))
QMS gap analysis report (PR-17-QMS output)

Common findings

The quality management system exists as a policy statement without the procedures and instructions that Art. 17(1) names
Examination, test and validation procedures state what is tested but not the frequency that Art. 17(1)(d) asks for
The list of applied standards names ISO/IEC 42001:2023 without the statement of how the Chapter III Section 2 requirements it does not cover are met, as Art. 17(1)(e) asks
Modification management has no rule for deciding whether a change is a substantial modification, so the re-assessment step in the compliance strategy is never triggered
Record-keeping procedures name the records, but sampled records for an earlier version of the system cannot be retrieved
The accountability framework lists departments rather than the responsibilities of the management and other staff

Questions

What does AI Act Article 17 require?

Art. 17(1) requires providers of high-risk AI systems to put a quality management system in place. The provider documents the system in written policies, procedures and instructions under Art. 17(1). The system covers the aspects in Art. 17(1) points (a) to (m), from a strategy for regulatory compliance to an accountability framework. Art. 17(2) makes the implementation proportionate to the size of the provider, in particular for an SME, a start-up or an SMC, with the degree of rigour kept. The obligation applies to Annex III systems from the Annex III application date and to Annex I systems from the Annex I application date under Art. 113(c).

What is the AI Act quality management system?

The quality management system is the set of written policies, procedures and instructions that Art. 17(1) requires from a provider of a high-risk AI system. It is not a single document. It holds the design, development, test, data management, record-keeping and incident reporting procedures that the other Chapter III Section 2 articles rely on. Art. 17(1)(g) places the Art. 9 risk management system inside it. Art. 17(1)(h) places the Art. 72 post-market monitoring system inside it. prEN 18286 gives the clause structure for such a system; its stage is shown from the standards data, and it is not cited in the Official Journal.

Which elements does the Article 17 quality management system contain?

Art. 17(1) lists the elements in points (a) to (m). Points (a) to (e) cover the strategy for regulatory compliance, the design procedures, the development procedures, the examination, test and validation procedures with their frequency, and the technical specifications and standards applied. Point (f) covers data management. Points (g), (h) and (i) cross-reference the risk management system under Art. 9, post-market monitoring under Art. 72 and serious incident reporting under Art. 73. Points (j) to (m) cover communication with authorities, record-keeping, resource management and the accountability framework. Each element is met by a written procedure, by records that show the procedure ran, or by both.

Is there a standard for a quality management system for EU AI Act regulatory purposes?

prEN 18286 carries the title Quality management system for EU AI Act regulatory purposes. CEN-CENELEC JTC 21 drafted it under standardisation request M/613. Its current stage is shown from the standards data on this page. No harmonised standard for Art. 17 is cited in the Official Journal as of the verified-on date, so it carries no presumption of conformity. Until a citation exists, the standard is a structure to test against, not a binding requirement.

EU AI Act vs ISO 42001 vs NIST AI RMF: which one covers Article 17?

Art. 17 of Regulation (EU) 2024/1689 is the legal obligation; the other two documents are voluntary frameworks. ISO/IEC 42001:2023 is a published management-system standard whose clauses and Annex A controls map to most Art. 17(1) points. It does not name the AI Act cross-references in Art. 17(1)(g), (h) and (i), and it does not supply the Art. 17(1)(e) statement of how uncovered Section 2 requirements are met. NIST AI RMF 1.0 is a published framework; its Govern function maps to the accountability framework in Art. 17(1)(m). Neither document is a harmonised standard, so neither gives a presumption of conformity. A gap analysis records what each existing framework artifact covers and what Art. 17 still asks for.

How we test this

We test the quality management system against Art. 17(1) points (a) to (m): we sample the modification, design verification, test and dataset records for the current version, walk through the serious incident reporting procedure and the accountability framework, and run a retrieval test on the records the record-keeping procedure names. We prepare the gap analysis as evidence for the provider and its notified body; the scope limits are stated on what we cannot do.

Pre-conformity mock assessmentPR-43-MOCK
QMS gap analysisPR-17-QMS

What we cannot do

We do not perform conformity assessments where a notified body is required.
We do not issue CE marking or the EU Declaration of Conformity.
We are not a notified body.
We do not give legal opinions on classification or liability.
We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.

Read the full statement