Article 17 requires providers of high-risk AI systems to put in place a quality management system that ensures compliance with the Act. The system must be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and must include, as a minimum, a compliance strategy, design and development control procedures, data management procedures, risk management under Article 9, post-market monitoring under Article 72, serious incident reporting, communication with authorities, record keeping, resource management, and an accountability framework. The quality management system must be proportionate to the size of the provider's organisation, and providers that already operate a quality management system under sectoral legislation can adapt it, provided the AI Act elements are covered.
What is the purpose of the Article 17 system?
The quality management system is the organisational infrastructure that makes compliance repeatable. Without it, conformity depends on individual effort and memory, and a change of personnel or a new release can silently break a control. With it, design, testing, documentation, release, monitoring and corrective action follow defined procedures, with named owners and review points. The system does not need to be a separate bureaucracy: it can be built on an existing quality, product or safety management system, provided the AI Act elements are explicitly covered and evidenced. The test is whether the system, as documented and as operated, ensures that each high-risk system complies with the Act throughout its lifecycle, not whether a quality manual exists on a shelf.
What elements must the system include?
Article 17 lists the elements the system must address, including a strategy for regulatory compliance with procedures for design, design control and design verification; procedures for development, quality control and quality assurance; examination, test and validation procedures to be carried out before, during and after manufacture, and the frequency of those procedures; technical specifications and standards to be applied; data management procedures covering acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation, retention, and other operations relevant to data sets; the risk management system under Article 9; the post-market monitoring system under Article 72; procedures for reporting serious incidents under Article 73; procedures for communication with national competent authorities, notified bodies and other operators; systems and procedures for record keeping; resource management including security of supply; and an accountability framework setting out responsibilities of management and other staff. Each element should be traceable to a procedure and an owner.
For the broader regulatory framework, see provider responsibilities.
How should the system be proportionate?
Article 17 requires the system to be proportionate to the size of the provider's organisation. A small provider does not need the same volume of documentation as a large manufacturer, but it does need the same elements covered, in a form suited to its size and complexity. Proportionality is about scale and form, not about omitting elements. A small team can document a procedure in a short, controlled document with a named owner and a review date, provided the procedure is followed and evidenced. A large organisation with many systems needs a system that can handle multiple products, versions and markets without losing traceability. The record should state how proportionality was applied, so that a reviewer can see that the choice of form was deliberate.
How does quality management connect to risk and post-market work?
The quality management system houses the risk management system under Article 9 and the post-market monitoring system under Article 72, and it connects them to design, testing and corrective action. Risk management identifies, analyses and evaluates foreseeable risks, adopts targeted risk management measures, and evaluates residual risk throughout the lifecycle. Post-market monitoring collects and analyses data on performance, including feedback from deployers and users, and feeds findings back into risk management and design. Serious incident reporting under Article 73 is triggered from that monitoring. A quality system that treats risk management as a pre-release document and post-market monitoring as a separate complaints inbox has not connected the elements the Act requires.
What documentation and review does Article 17 require?
The quality management system must be documented in written policies, procedures and instructions, and the documentation must be kept and made available to authorities as part of the Article 18 documentation keeping duty. The system should be reviewed regularly, and updated where the organisation, the systems, the standards, or the regulatory requirements change. Internal audit, management review, and corrective action for quality system failures should be part of the system itself. Where a notified body is involved in conformity assessment, the quality system may be assessed as part of that procedure, and the provider should be ready to show how the system operates in practice, not only how it is written.
Continue with Article 16 provider duties.
What does this guide not certify?
This guide explains the Article 17 elements in outline. It does not certify that any particular quality system complies, does not design a quality system for a specific organisation, and does not decide whether an existing sectoral quality system covers the AI Act elements. Those questions need the organisation's size, structure, products and existing systems, read against Article 17 in the consolidated text and, where applicable, the sectoral legislation. A provider building or adapting a quality system should confirm the design with a competent authority or legal adviser, and with a notified body where one is involved, before relying on it for a high-risk release.
Frequently asked questions
Can an existing ISO quality system satisfy Article 17?
It can be adapted, provided the AI Act elements in Article 17 are explicitly covered, documented and operated. An existing system that does not address data management, risk management under Article 9, post-market monitoring and serious incident reporting for AI systems will need to be extended.
Does a small provider need a full quality department?
No. Article 17 requires proportionality to the size of the organisation. A small provider needs the required elements covered in a form suited to its size, with named owners and review, not a large department. Omitting elements is not proportionality.
How often should the quality system be reviewed?
The Act requires the system to ensure compliance throughout the lifecycle, which implies regular review and update on change. The provider should set review intervals, trigger reviews on organisational, product or regulatory change, and record the reviews and actions taken.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗