Quality management system (AI)

Article 17 requires providers of high-risk systems to have a quality management system, documented in an orderly way as policies, procedures and instructions.

It must cover, among other things: the regulatory compliance strategy; design, development, control and validation techniques; testing procedures; technical specifications and standards applied; data management (collection, analysis, labelling, storage); risk management; post-market monitoring; serious incident reporting; communication with authorities; record-keeping; and an accountability framework setting out who does what.

It must be proportionate to the size of the organisation. If you already have an ISO 9001 or ISO/IEC 42001 system, you can integrate it there instead of creating a new one.