EU AI Act Art. 17 — Quality management system
Article 17 requires providers of high-risk AI to run a documented quality management system covering design, development, data, risk management, post-market monitoring, and incident reporting — the operational engine that makes compliance repeatable.
At a glance
What this article requires
- Providers must implement a documented quality management system covering regulatory compliance, design control, and verification and validation.
- It must cover data management, risk management (Art. 9), post-market monitoring (Art. 72), and incident reporting (Art. 73).
- It must include communication with authorities, record-keeping, resource management, and an accountability framework.
- Financial-sector providers align with sectoral rules (e.g. DORA) — the Act allows proportionate adjustments.
Scope
Who this applies to
Providers of high-risk AI. Deployers should audit a vendor's QMS before procurement — it predicts how seriously the vendor takes the Act.
Obligations
What you must actually do
Write it down
A QMS has to be documented and current: policies, procedures, and records that a regulator can follow from design to post-market.
Connect it to risk and monitoring
The QMS must feed the risk management system (Art. 9) and the post-market monitoring plan (Art. 72), so field findings loop back into design.
Own accountability
Assign clear roles for compliance decisions inside the organisation, not a one-person documentation job.
Action plan
Practical first steps
- 1
Adopt an ISO 9001-style skeleton and extend it with AI-specific controls (data governance, model testing, incident handling).
- 2
Map every Article 16 obligation to a QMS procedure and an owner.
- 3
Run an internal audit of the QMS before the external conformity assessment.
Penalty exposure
Quality-management failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 17
Can I reuse my ISO 9001 or ISO 42001 certification?
Yes, with work. ISO 9001 (quality) and ISO 42001 (AI management) map well onto Article 17's requirements — the Act wants the substance, not a specific certification.
Does every provider need a full QMS?
Yes, for high-risk providers — scaled proportionately to size and complexity. The requirement is real even for smaller companies, though enforcement expectations are lighter for SMEs in practice.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.