EU AI Act Article 17: Quality Management System
The 13 aspects of the quality management system under EU AI Act Article 17, proportionality for SMEs, the link to conformity assessment and the fines under Article 99(4).
Providers of high-risk AI systems must run a quality management system (QMS) covering 13 aspects (Article 17).
It applies to providers placing such systems on the EU market. The dates are 2 December 2027 for Annex III systems (listed uses such as hiring) and 2 August 2028 for Annex I systems. The effort may match company size, but the protection level may not drop (Article 17(2)). A missing QMS breaches Article 16(c). Fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: compare your quality system with the 13 aspects below.
Article 17 lists 13 aspects a QMS must cover
The QMS must be documented in a systematic and orderly way as written policies, procedures and instructions. It includes at least these aspects (Article 17(1)).
A strategy for regulatory compliance, including conformity assessment procedures and the management of modifications to the system.
Techniques, procedures and systematic actions for the design, design control and design verification of the system.
Techniques, procedures and systematic actions for development, quality control and quality assurance of the system.
Examination, test and validation procedures before, during and after development, and how often they run.
The technical specifications and standards to apply and, where harmonised standards are not applied in full, the means to meet the Section 2 requirements.
Systems and procedures for data management, from data acquisition and labelling to storage and retention, covering every data operation before the system is placed on the market or put into service.
The risk management system of Article 9.
Setting up, implementing and maintaining a post-market monitoring system (Article 72).
Procedures for reporting a serious incident (Article 73).
Handling of communication with national competent authorities, other relevant authorities, notified bodies, other operators, customers and other interested parties.
Systems and procedures for record-keeping of all relevant documentation and information.
Resource management, including measures for security of supply.
An accountability framework that sets out the responsibilities of management and other staff for all these aspects.
The effort may match the company’s size, but not lower the protection
The implementation of the aspects must be proportionate to the size of the provider’s organisation, in particular for SMEs, including start-ups, and small mid-caps (SMCs). Providers must still respect the degree of rigour and the level of protection needed to make their high-risk systems comply (Article 17(2), as amended by Regulation (EU) 2026/1744).
SMEs, including start-ups, may meet certain QMS elements in a simplified way if they have no partner or linked enterprises within the meaning of Recommendation 2003/361/EC. The Commission develops guidelines on which elements qualify. The simplification does not exempt anyone from other requirements, including Articles 9 to 15, 72 and 73 (Article 63).
Other quality systems can carry the Article 17 aspects
A provider that already has to run a QMS under other Union sector law may include the 13 aspects in that system (Article 17(3)). Financial institutions that follow Union rules on internal governance meet the QMS duty by complying with those rules. The exceptions are the risk management system, post-market monitoring and serious incident reporting (Article 17(4)).
The conformity assessment checks the QMS
For Annex III systems in points 2 to 8, the provider checks its own QMS against Article 17 (internal control, Annex VI, point 2). For biometric systems (Annex III, point 1), the provider may choose internal control or a notified body in some cases and must use a notified body in others (Article 43(1) and (2)). A notified body examines the QMS under Annex VII. For Annex I Section A products, the QMS assessment is part of the product’s conformity assessment (Article 43(3)).
How Scanara supports your QMS work
Scanara runs a guided quality management assessment based on the 13 aspects of Article 17(1). Its rule-based document scan, generated from the Regulation’s own text, checks the documents you upload against Article 17. You write and run the QMS and decide what is sufficient.
Common questions about the QMS
Does ISO 9001 certification satisfy Article 17?
The Act does not say so: it names no ISO standard. Article 17(1) lists 13 aspects your QMS must cover, including the risk management system of Article 9, post-market monitoring (Article 72) and serious incident reporting (Article 73). An existing quality system can serve as a base if you extend it to all 13 aspects.
Is a QMS required for AI systems that are not high-risk?
No. Article 17 applies to providers of high-risk AI systems, so other AI systems need no QMS under the Act. A provider that decides an Annex III system is not high-risk must instead document that assessment before placing the system on the market (Article 6(4)).
How detailed must the QMS be for a small team?
The implementation must be proportionate to the size of the provider (Article 17(2)), but all 13 aspects must be covered. SMEs, including start-ups, without partner or linked enterprises may simplify certain elements (Article 63(1)). The Commission develops guidelines on which elements qualify.
What happens if the QMS is missing or inadequate?
A provider without a QMS that complies with Article 17 breaches Article 16(c). The fine can reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(a)). For SMEs, including start-ups, and small mid-caps the fine is capped at the lower amount (Article 99(6) and (6a)).
Can one QMS cover several AI systems?
Article 17 requires the provider to put a QMS in place and does not limit it to one system. The technical documentation under Article 11 is drawn up for each high-risk AI system.
Read the detail behind each aspect
Article 9: risk management system
Covers the risk management system, which is aspect (g) of your QMS.
Article 72: post-market monitoring
Covers the post-market monitoring system, which is aspect (h) of your QMS.
Article 16: provider obligations
Covers the 12 duties of providers, including the QMS in point (c).
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.