{"slug":"ai-quality-management-system","id":"AIPT-CTL-0007","title":"Quality management system for AI development and supply","kind":"policy","kind_label":"Policy","purpose":"Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.\n","description":"Building on an existing quality or information-security management system, the organisation documents the procedures that cover the AI lifecycle: how regulatory requirements are identified, how systems are designed, built, tested and released, how data and documentation are managed, how post-market monitoring and incidents are run, how suppliers are controlled and how corrective action is tracked. Roles and resources are assigned, internal audits check that procedures are followed, and management reviews the system's performance at least annually. Records of the system itself are retained for the period authorities expect.\n","owner_role":"Quality lead","frequency":"annual","frequency_label":"Annual","risk_subdomains":["6.5","7.3"],"evidence":[{"type":"policy_document","title":"AI quality management system manual","description":"Scope, procedures, roles and records that make up the management system."},{"type":"audit_report","title":"Internal audit of the AI management system","description":null},{"type":"meeting_record","title":"Management review minutes","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4 to 10","note":"The management-system structure as a whole; certification is optional.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4, 1.5, 1.7","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","relationship":"supports","note":"The QMS is where most Article 16 duties are operated.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"satisfies","note":"A documented management system covering the required elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","relationship":"supports","note":"Internal-control assessment relies on the documented management system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration"}],"related_controls":["ai-governance-policy-and-accountability","technical-documentation-and-model-cards","model-release-and-change-management-gate","conformity-assessment-and-registration"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-quality-management-system","context_url":"https://aipolicytracker.org/controls/ai-quality-management-system.md"}