Article 17: Quality Management System

Official Statutory Text

Article 17 Quality management system 1. Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documentedin a systematic and orderly manner in the form of written policies, procedures andinstr uctions, and shall include at least the following aspects: (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the managementof modifications to the high-risk AI system; (b) te chniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system; (c) te chniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system; (d) examination, testand validation procedures to be carried out before, during and after the developmentof the high-risk AI system, and the frequency with which they have to be carried out ; (e) technical specifications, including standards, to be applied and, where the relevant harmonised standards are not appliedin full or do not cover all of the relevant requirements setout in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements; (f) systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filt ration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purpose of the placing on the mark etor the putting into service of high-risk AI systems; (g) the risk management system referred to in Article 9; (h) the setting-up, implementation and maintenance of a post-mark et monitoring system, in accordance with Article 72; (i) procedures related to the reporting of a serious incident in accordance with Article 73; (j) the handling of communication with national competent author ities, other relevant author ities, including those providing or supporting the access to data, notified bodies, other operators, customers or other interested par ties; (k) systems and procedures for record-keeping of all relevant documentation andinformation; (l) resource management, including secur ity-of-supply related measures; (m) an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listedin this paragraph. 2. The implementation of the aspects refer red to in paragraph 1 shall be proportionate to the size of the provider ’s org anisation. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation. 3. Providers of high-risk AI systems that are subject to obligations regarding quality management systems or an equivalent function under relevant sectoral Uni on law may include the aspects listedin paragraph 1 as par tof the quality management systems pursuant to that law . 4. For providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Uni on financial services law , the obligation to put in place a quality management system, with the exception of paragraph 1, points (g), (h) and (i) of this Article, shall be deemed to be fulfilled by complying with the rules on internal governance arrangements or processes pursuant to the relevant Uni on financial services law . To that end, any harmonised standards referred to in Article 40 shall betaken into account.