Article 17 — Quality Management System

WHAT THE ARTICLE IS ABOUT

The organisational framework behind technical compliance

Article 17 moves from what the AI system must do to how the organisation behind it must be structured to ensure ongoing compliance. A quality management system (QMS) is not a one-off audit — it is a living, documented framework that governs how the provider develops, tests, monitors and improves their high-risk AI system throughout its entire lifecycle.

WHAT IT SAYS

A documented system covering twelve key aspects

• Providers must put a quality management system in place that ensures compliance with the AI Act — documented in the form of written policies, procedures and instructions
• The QMS must cover at minimum: regulatory compliance strategy, design and development procedures, testing and validation processes, technical specifications, data management procedures, risk management, post-market monitoring, incident reporting, communication procedures with authorities, record-keeping, resource management, and an accountability framework
• The QMS must be proportionate to the size of the provider — SMEs and startups are not expected to implement enterprise-scale systems, but must have something documented and functional
• Providers already subject to QMS requirements under other EU sectoral law — such as medical devices or financial services — can integrate their AI Act QMS obligations into their existing system
• Financial institutions specifically are deemed to have fulfilled the QMS obligation if they comply with their internal governance requirements under EU financial services law, with some exceptions

WHO IS AFFECTED

All providers of high-risk AI systems

• All providers of high-risk AI systems — this is a mandatory organisational requirement, not optional
• Quality assurance, compliance and legal teams responsible for governance frameworks
• Startups and SMEs building high-risk AI — the proportionality clause is specifically relevant here
• Providers already operating under ISO 9001 or similar quality management standards — the Act does not require starting from scratch

WHAT IT MEANS FOR SMES

Start lean but start documented

• The proportionality principle is your friend — the Act explicitly acknowledges that a startup cannot implement the same QMS as a multinational; what matters is that your system is appropriate for your size and context
• If you already use ISO 9001 or any equivalent quality framework, you are much of the way there — map your existing procedures to the twelve aspects listed in Article 17 and document the gaps
• The QMS is essentially a collection of written policies — start with the most critical ones: how you test the system, how you manage data, how you handle incidents, and how you monitor post-deployment performance
• Think of the QMS as your internal compliance manual for AI — it is what you show an auditor or a regulator if your system is ever investigated
• The twelve aspects of Article 17 map directly onto the technical requirements in Articles 9 through 15 — your QMS is the organisational wrapper around those technical obligations

Related Articles

• Article 16 — Provider obligations (QMS is one of the twelve listed obligations)
• Article 9 — Risk management system (must be reflected in the QMS)
• Article 18 — Documentation keeping (the QMS itself must be kept as documentation)
• Article 43 — Conformity assessment (the QMS may be assessed by a notified body)