Operate a quality management system

Practical action

Extend an existing ISO 9001 or ISO/IEC 42001 management system to cover the Article 17 elements.

Who does it apply to?

Providers of high-risk AI systems; may be integrated into sector QMS requirements.

Actors

Provider / developer

Sectors

Cross-sector / all sectors

Use cases

AI in hiring and employmentAI in finance, credit and insuranceSafety-critical and infrastructure

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesPolicyQuality lead · annual
  Quality management system for AI development and supply

  Serves 3 recorded duties · evidence: AI quality management system manual, Internal audit of the AI management system, Management review minutes

  A documented management system covering the required elements.

• supportsPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  Accountability and resource allocation.

• supportsProcessRelease manager · at launch and on material change
  Model release and change-management gate

  Serves 5 recorded duties · evidence: Release or change approval record, Release and change-classification procedure

  Design, release and change procedures within the system.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• EU AI Act Role and Risk Classifier

  Checklist · XLSX · v4

• AI Governance Policy and RACI

  Policy · DOCX and XLSX · v5

• EU AI Act Article 50 Transparency Kit

  Kit · DOCX and XLSX · v32

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

All 8 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Operate a quality management system (EU AI Act)” [AIPT-OBL-0013, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0013 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0013: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

@misc{aipolicytracker2026_operateaqualitymanagemen,
  author       = {{AIPolicyTracker}},
  title        = {{Operate a quality management system (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history