Is this a completely new document, or does it reuse what I already have?

Neither entirely: it connects and cross-references the documentation you already have (risk management, post-market monitoring, incident reporting) into a single framework, and adds a starter template for the 3 elements almost no company has covered yet (design, development/quality, resource management).

Does it only apply to high-risk systems?

Art. 17 applies to providers of high-risk AI systems, and also to certain obligations for general-purpose systems. If your system isn't high-risk, it may not be mandatory, but it's still good governance practice.

Does this replace legal advice?

No. It's a working template that organizes Art. 17 compliance, but it doesn't constitute legal advice or guarantee compliance — see the included Legal Notice.

What format is it delivered in?

An Excel file with 3 tabs (the 13 elements, a starter template for the 3 uncovered elements, self-assessment log), a PDF guide, and a Legal Notice.

AI Act Quality Management System Checklist: The 13 Elements

What's included

Excel file with the 13 elements of Art. 17, the exact legal text for each, and which of your existing documents already covers it
Starter template (concrete questions) for the 3 elements with no product yet: design, development/quality assurance, resource management
Self-assessment log — owner and review date for each element
PDF guide with the full table of the 13 elements
Legal Notice

Why this document exists

Art. 17 of Regulation (EU) 2024/1689 requires providers of high-risk AI systems to establish a documented quality management system with at least 13 elements. AESIA's own guide points this out clearly: most of those elements should already be developed in other pieces of your documentation — risk management (Art. 9), post-market monitoring (Art. 72), incident reporting (Art. 73). This document doesn't repeat that work — it connects it into a single framework, and adds what's missing.

The 13 elements, at a glance

a) Regulatory compliance — conformity strategy and change management.
b) Design and verification — no product yet, template included.
c) Development and quality assurance — no product yet, template included.
d) Examination, testing and validation — connects to system accuracy and robustness.
e) Harmonized standards — connects to your frameworks mapping.
f) Data management — connects to your Art. 10 Pack and Data Catalog.
g) Risk management (Art. 9) — connects to ISO 23894 and your Art. 10 Pack.
h) Post-market monitoring (Art. 72) — connects to your existing template.
i) Incident reporting (Art. 73) — connects to your existing template.
j) Communication with authorities — connects to your Inspection Response Kit.
k) Record keeping — connects to your AI Systems Registry.
l) Resource management and supply — no product yet, template included.
m) Accountability framework — connects to your Charter and RACI.

Proportionate to your company's size

Art. 17 itself establishes that applying these elements should be proportionate to the size of the organization — an SME doesn't need the same level of formalization as a large company. The document includes this consideration explicitly, so you don't over-build a heavier system than your organization needs.