Quality Management System: Definition under the EU AI Act
Quality management system (QMS) under EU AI Act Article 17: the documented policies a high-risk AI provider must maintain. All 13 elements clearly defined.
Under Regulation (EU) 2024/1689, a quality management system (QMS) is the documented system of policies, procedures and instructions that a provider of a high-risk AI system must put in place and maintain to ensure ongoing compliance throughout the system's lifecycle. It is the connective tissue of high-risk compliance — the framework that ties design, data management, risk management, monitoring, record-keeping and accountability into one auditable whole. This entry defines the term; the guides linked below cover how to build one.
The EU AI Act Definition
What the term means
The legal basis is Article 17. A provider must establish, document and maintain a quality management system before placing a high-risk system on the market. The obligation is owed by the provider under Article 16 and attaches to the responsible legal entity — it cannot be outsourced away. Article 17(1) requires the QMS to be documented "in a systematic and orderly manner in the form of written policies, procedures and instructions"; informal practice or tacit know-how does not satisfy the Article.
Where it sits in the Act
The QMS is the management framework inside which most other high-risk obligations live. It governs the Article 9 risk management system, Article 10 data governance, the Article 11 technical documentation process, post-market monitoring under Article 72 and serious-incident reporting under Article 73 — where any of those needs a documented procedure, the procedure belongs in the QMS.
What the QMS Must Cover
Article 17(1) gives no discretion to omit an element: each of the thirteen sub-points below must exist as a documented policy, procedure or instruction.
The Article 17(1) elements at a glance
| Art 17(1) | Element | Linked |
|---|---|---|
| (a) | Regulatory-compliance strategy, incl. conformity assessment and modifications | Art 43 |
| (b) | Design, design-control and verification techniques | — |
| (c) | Development, quality-control and assurance techniques | — |
| (d) | Examination, test and validation procedures | — |
| (e) | Technical specifications and standards applied | Arts 40–41 |
| (f) | Data management systems and procedures | Art 10 |
| (g) | The risk management system | Art 9 |
| (h) | Post-market monitoring | Art 72 |
| (i) | Serious-incident reporting procedures | Art 73 |
| (j) | Communication with authorities and notified bodies | — |
| (k) | Record-keeping systems and procedures | Art 12 |
| (l) | Resource management, incl. security-of-supply | — |
| (m) | Accountability framework for management and staff | — |
This is a scope summary, not the full walkthrough — the Article 17 guide treats each element one at a time.
QMS vs the Article 9 Risk Management System
The QMS is the whole; Article 9 is a part
The most common confusion is treating the QMS and the Article 9 risk management system as alternatives. They are not. The QMS is the container; the risk management system is one component inside it, incorporated by Article 17(1)(g). Article 9 is the continuous, iterative process for identifying, evaluating and mitigating risks to health, safety and fundamental rights across the lifecycle. The QMS is the broader framework that also governs design, data, testing, monitoring, records and accountability. The two must be consistent and cross-referenced, but they are not the same obligation — an auditor will expect both.
Not the same as the technical documentation
A second confusion is conflating the QMS with the Article 11 / Annex IV technical documentation. The QMS owns and governs the procedures; the technical file is a point-in-time record those procedures produce — distinct obligations, kept separate.
Proportionate to the Provider's Size
The proportionality rule
Article 17(2) requires the QMS to be proportionate to the size of the provider's organisation: a small provider may document it more leanly than a large enterprise. But proportionality governs how thoroughly each element is documented, not whether it appears — all thirteen Article 17(1) aspects remain mandatory regardless of headcount; they can simply be shorter.
Under Article 17(3), providers already subject to QMS obligations under other sectoral Union law may integrate the AI-specific aspects into that existing system rather than build a parallel one.
Frameworks that help
ISO/IEC 42001 — the AI management system standard — is a useful structural baseline that aligns with many Article 17 elements, but it is not, on its own, evidence of Article 17 compliance: certification creates no presumption of conformity, and the AI Act requirements still govern. Use it as scaffolding, not a substitute — see ISO/IEC 42001 AI management system for how the two map.
Deadline and Penalties
When the obligation applies
The QMS obligation applies when the high-risk obligations apply. As enacted, high-risk Annex III systems (Article 6(2)) apply from 2 August 2026 and Annex I product-embedded systems (Article 6(1)) from 2 August 2027. The Digital Omnibus, adopted in June 2026 (European Parliament 16 June, Council 29 June), sets these at 2 December 2027 and 2 August 2028.
That deferral is now adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026 — so plan against the adopted dates; only Official Journal publication, expected before 2 August 2026, remains outstanding, as a formality. The standards-contingent "stop the clock" mechanism was rejected.
Cost of non-compliance
Breach of Article 17 sits in the Article 99(4) tier: fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, Article 99(6) caps each fine at the lower of the fixed amount or the percentage.
How Confir helps
Confir's structured assessment maps directly to the Article 17(1) elements, so you can see which of the thirteen aspects are documented, which are thin and which are missing. It assembles the Annex IV technical documentation those procedures produce. The synthesis engine is deterministic and rule-based — no model inference, no hallucination.
Frequently asked questions
What is a quality management system under the EU AI Act?
Under Article 17 of Regulation (EU) 2024/1689, a quality management system (QMS) is the documented system of written policies, procedures and instructions a provider of a high-risk AI system must put in place and maintain to ensure compliance throughout its lifecycle. It covers the regulatory-compliance strategy, design and testing, data management, the Article 9 risk management system, post-market monitoring, record-keeping, resource management and an accountability framework. It must exist before the system is placed on the market.
What must an Article 17 quality management system include?
Article 17(1) lists thirteen aspects the QMS must address in writing: a regulatory-compliance strategy including conformity assessment and modifications; design, development and testing techniques; technical specifications and standards applied; data management procedures; the Article 9 risk management system; post-market monitoring under Article 72; serious-incident reporting under Article 73; communication with authorities and notified bodies; record-keeping; resource management including security-of-supply; and an accountability framework for management and staff. None of them may be omitted.
Is the QMS the same as the Article 9 risk management system?
No. The QMS is the broader management framework; the Article 9 risk management system is one component inside it, incorporated by Article 17(1)(g). Article 9 is the continuous, iterative process for identifying and mitigating risks to health, safety and fundamental rights across the lifecycle. The QMS wraps that process together with design controls, data management, testing, monitoring and accountability. Article 9 is the part; the QMS is the whole, and both must be documented and cross-referenced.
Does the QMS have to be the same size for every provider?
No. Article 17(2) requires the QMS to be proportionate to the size of the provider's organisation, so a smaller provider can document it more concisely than a large enterprise. Proportionality governs how thoroughly each element is documented, not whether it appears: all thirteen Article 17(1) aspects remain mandatory. Article 17(3) also lets providers already subject to a sectoral QMS under other Union law integrate the AI-specific aspects into it rather than build a parallel system.
Who has to have a quality management system and by when?
The obligation falls on the provider of a high-risk AI system (Article 16), and the QMS must be in place before the system is placed on the market. As enacted, high-risk Annex III obligations apply from 2 August 2026, deferred to 2 December 2027 under the Digital Omnibus, now adopted (European Parliament 16 June 2026, Council 29 June 2026); plan against the adopted 2 December 2027 date. Breach sits in the Article 99(4) tier: up to €15 million or 3% of worldwide turnover.
Related terms
- Article 17 quality management system requirements
- How to build an AI quality management system
- The Article 9 risk management system
- High-risk AI system
- ISO/IEC 42001 AI management system
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →