{"slug":"eu-ai-act-quality-management-system","id":"AIPT-OBL-0013","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0013","title":"Operate a quality management system","short_title":"Quality management system","category":"quality_management","summary":"Providers of high-risk AI systems must put in place a documented quality management system covering regulatory-compliance strategy, design and development procedures, testing and validation, technical specifications and standards, data management, the risk-management system, post-market monitoring, incident reporting, communication with authorities, record keeping, resource management and an accountability framework.\n","practical_action":"Extend an existing ISO 9001 or ISO/IEC 42001 management system to cover the Article 17 elements.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 17","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","safety_critical"],"applicability":[{"description":"Providers of high-risk AI systems; may be integrated into sector QMS requirements.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"QMS manual and procedures","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Whole management system (Clauses 4–10)","note":"ISO/IEC 42001 is a certifiable AI management system standard; certification is not a legal presumption of conformity under the AI Act.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN function","note":"Governance structures and policies.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"Accountability and resource allocation.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"ai-quality-management-system","title":"Quality management system for AI development and supply","kind":"policy","relationship":"satisfies","note":"A documented management system covering the required elements.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-quality-management-system"},{"slug":"model-release-and-change-management-gate","title":"Model release and change-management gate","kind":"process","relationship":"supports","note":"Design, release and change procedures within the system.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}