What quality management system does Article 17 require?

What must a quality management system cover?

A quality management system under Article 17 must cover, in outline, the regulatory compliance strategy, design and development control, data management, risk management, testing and validation, documentation control, change control, post-market monitoring, incident handling, communication with authorities and deployers, and record-keeping. Each element should be documented as a policy, procedure or instruction that staff can follow, with named owners and review points. The system should be designed as a coherent whole, not as a set of disconnected documents, so that a change in one area, such as a data change, triggers the related controls in risk, testing and documentation. A provider should be able to show, from the quality system documentation, how each Section 2 requirement is addressed by a process, who owns that process, and what record it produces.

How is proportionality applied?

Regulation (EU) 2026/1744 made explicit that the quality management system must be proportionate to the size of the provider's organisation and to the nature and scale of its activities, and the consolidated Article 17 text should be checked for the current wording. Proportionality means that a small provider with a single system does not need the same bureaucratic structure as a large provider with many systems, but it does need the same substantive controls, in a form that fits its scale. A proportionate system is one where the procedures are actually followed, the records are actually kept, and the controls are actually effective for the systems in question. A provider claiming proportionality should record the basis: its size, the number and complexity of its systems, and how each Article 17 element is addressed in its form. Proportionality is not a reason to omit an element.

For the broader regulatory framework, see Conformity assessment and CE marking overview.

How should the system be documented?

The quality management system must be documented in a systematic and orderly manner, in the form of written policies, procedures and instructions, and must be kept up to date. Documentation should include the quality policy, the organisational structure and responsibilities, the procedures for each lifecycle stage, and the records that demonstrate the procedures are followed. The documentation should be controlled, with version history, approval, and access for the staff who need it. A quality system that exists only as unwritten practice, or only in the heads of a few staff, cannot be assessed in conformity assessment and cannot be shown to be maintained over time. The documentation should be reviewed periodically and when the organisation, its systems, or the legal requirements change.

How does the system link to conformity assessment?

Conformity assessment under Annex VI and Annex VII examines the quality management system as part of the assessment, checking that it complies with Article 17 and that the design, development and post-market processes are consistent with the technical documentation. The assessor will sample procedures and records, interview staff, and trace a system through the quality processes from design to monitoring. A provider should therefore prepare for assessment by carrying out internal audits, addressing findings, and keeping the audit and corrective action records in the file. The quality system should also include a procedure for handling conformity assessment itself, including how findings are addressed, how changes are notified to a notified body where one is involved, and how the declaration and registration follow from a successful assessment.

How is the system maintained and improved?

A quality management system must be maintained and improved through the lifecycle, using internal audits, management review, post-market data, incident findings, and changes in requirements or guidance. Management review should be periodic, documented, and should lead to decisions on resources, procedures and improvements, with actions tracked to completion. Staff should be trained in the procedures that affect their work, and training should be recorded. Suppliers and subprocessors whose work affects compliance should be controlled through the quality system, with their roles and records defined. A system that is documented once and never reviewed will drift from practice, and the drift will surface in conformity assessment or market surveillance as a gap between the file and the reality.

Continue with Internal control under Annex VI.

What does this guide not decide?

This guide does not decide whether a particular quality management system meets Article 17, whether its form is proportionate for a specific provider, or whether it would pass conformity assessment. It does not design a quality system or assess an audit finding. Those questions depend on the provider's size and activities, the systems it provides, the documented procedures and records, and the consolidated legal text. A provider should have its quality system reviewed by a competent reviewer, carry out internal audits, and confirm the position with a competent authority, a notified body where involved, or a legal adviser where contested.

Frequently asked questions

Continue through this AI Act cluster

• Conformity assessment and CE marking overview
• Internal control under Annex VI
• Third-party assessment under Annex VII
• High-risk requirements overview
• Provider responsibilities
• Which conformity assessment route applies under Article 43?