Quality management system for AI development and supply
Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 6 sections
- Duties satisfied
- 1
- done properly, does the work
- Duties supported
- 2
- contributes; the duty needs more
- Jurisdictions
- 1
- Evidence items
- 3
In brief
Quality management system for AI development and supply is a policy, owned by the quality lead and run every year. 3 recorded duties in 1 jurisdiction rely on it, and it satisfies 1 of them outright. Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.
How is it implemented?
Building on an existing quality or information-security management system, the organisation documents the procedures that cover the AI lifecycle: how regulatory requirements are identified, how systems are designed, built, tested and released, how data and documentation are managed, how post-market monitoring and incidents are run, how suppliers are controlled and how corrective action is tracked. Roles and resources are assigned, internal audits check that procedures are followed, and management reviews the system's performance at least annually. Records of the system itself are retained for the period authorities expect.
Which legal duties does it serve?
Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.
European Union 3 duties
-
satisfies Legal requirement confidence highOperate a quality management system
EU AI Act · Article 17 · applies from 2 Dec 2027
A documented management system covering the required elements.
-
supports Legal requirement confidence highProviders must meet the full set of provider duties for high-risk AI
EU AI Act · Article 16 · applies from 2 Dec 2027
The QMS is where most Article 16 duties are operated.
-
supports Legal requirementComplete conformity assessment, CE marking and EU database registration
EU AI Act · Articles 43, 47, 48 and 49; Annex VIII · applies from 2 Dec 2027
Internal-control assessment relies on the documented management system.
What evidence shows it is operating?
| Evidence | Type | What it shows |
|---|---|---|
| AI quality management system manual | Policy document | Scope, procedures, roles and records that make up the management system. |
| Internal audit of the AI management system | Audit or assurance report | |
| Management review minutes | Governance meeting record |
Owner: Quality lead. Frequency: annual.
Which risks does it address?
Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.
- 6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
- 7.3 Lack of capability or robustness AI system safety, failures, & limitations305 incidents · 126 risk entries
Which standards clauses does it correspond to?
Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001 | Clause 4 to 10 | The management-system structure as a whole; certification is optional. | high |
| NIST AI RMF | GOVERN 1.4, 1.5, 1.7 | medium |
Cite this record
AIPolicyTracker (2026). “Quality management system for AI development and supply” [AIPT-CTL-0007, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0007 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-CTL-0007: it never changes or gets reused, and its address keeps working if this page moves.
BibTeX
@misc{aipolicytracker2026_qualitymanagementsystemf,
author = {{AIPolicyTracker}},
title = {{Quality management system for AI development and supply}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/controls/ai-quality-management-system}},
url = {https://aipolicytracker.org/controls/ai-quality-management-system},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Which legal duties does "Quality management system for AI development and supply" satisfy?
It is recorded as satisfying 1 and supporting 2 duties across European Union. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?
AI quality management system manual, Internal audit of the AI management system and Management review minutes. Owner: Quality lead. Frequency: annual.