Article 17 for Healthcare AI: Quality Management System

The system must be documented in a systematic and orderly manner as written policies, procedures and instructions. The Act lists 13 aspects, (a) to (m); the rows below show (a), (g), (h) and (i) first, then the other nine.

• Art. 17(1)(a)
  Regulatory compliance strategy

  A strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for managing modifications to the system.

• Art. 17(1)(g)
  Risk management system

  The risk management system referred to in Article 9.

• Art. 17(1)(h)
  Post-market monitoring

  Setting up, implementing and maintaining a post-market monitoring system under Article 72.

• Art. 17(1)(i)
  Serious incident reporting

  Procedures for reporting a serious incident under Article 73.

• Art. 17(1)(b)–(f), (j)–(m)
  The other nine aspects

  Design and design control; development, quality control and quality assurance; examination, test and validation procedures; technical specifications and standards; data management; communication with authorities, notified bodies and others; record-keeping; resource management; and an accountability framework.

• Art. 17(2)
  Proportionate to size, not to protection

  Implementation must be proportionate to the size of the provider’s organisation, in particular for an SME, including a start-up, or a small mid-cap enterprise. Providers must still respect the degree of rigour and the level of protection needed for compliance of their high-risk systems.

Article 17 binds providers of high-risk AI systems only. The rows below show where healthcare AI becomes high-risk.

• Healthcare is not a category in the Act

  The Act has no healthcare category. This site uses the word for AI that reaches the Act through three kinds of hook: medical devices (Annex I, Section A), Annex III points 5(a) and 5(d), and Annex III point 1(c) on emotion recognition.

• Medical devices: Annex I, Section A, items 11 and 12

  Annex I, Section A lists Regulation (EU) 2017/745 on medical devices (item 11) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (item 12). An AI system is high-risk under Article 6(1) when it is, or is a safety component of, a product under that legislation and the product must undergo a third-party conformity assessment under that legislation. The device Regulations decide which products need one. Article 2(2), which limits Annex I Section B products, does not apply to Section A.

• Annex III points 1(c), 5(a) and 5(d)

  Annex III point 5(a) covers systems used by or on behalf of public authorities to evaluate whether people are eligible for essential public assistance benefits and services, including healthcare services, and to grant, reduce, revoke or reclaim them. Point 5(d) covers systems that evaluate and classify emergency calls or dispatch emergency first response services or set priorities in dispatching them, including by police, firefighters and medical aid, and emergency healthcare patient triage systems. Point 1(c) covers AI systems intended to be used for emotion recognition, in so far as their use is permitted under relevant Union or national law. If a system is both a Section A product and in Annex III, the provider follows the conformity assessment procedure of the Section A legislation (Article 43(3)).

• Provider and deployer

  The provider develops the AI system, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)). For a safety component of a Section A product, the product manufacturer is the provider if the system is placed on the market with the product under its name or trademark, or put into service under its name after the product was placed on the market (Article 25(3)). A hospital, clinic or laboratory that uses a system under its authority is a deployer. A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that leaves the system high-risk, or changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)).

• Dates

  Device AI under Annex I applies from 2 August 2028. Annex III points 1(c), 5(a) and 5(d) apply from 2 December 2027 (Article 113, third paragraph, point (c)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards; in any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)). Article 113 does not say which date governs a system that fits both Annex I and Annex III; ask counsel.

• Fines

  Breaches of provider obligations under Article 16 and of deployer obligations under Article 26 can be fined up to EUR 15 million or, for an undertaking, up to 3% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is capped at whichever is lower (Article 99(6)). The same cap applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)).

• Delegated acts may limit some requirements

  For systems under Article 6(1), the Act allows specific requirements of Articles 9 to 15 and 17 to 25 to be limited where and to the extent that Section A legislation lays down equivalent or higher protection and the limitation does not reduce the overall level of protection (Article 2(13)). The Commission is to adopt delegated acts specifying the systems, requirements and conditions by 2 August 2027. Check them before relying on a limit.

• Sectoral quality management systems

  Providers that are subject to obligations regarding quality management systems or an equivalent function under sectoral Union law may include the aspects of Article 17(1) as part of the quality management system under that law (Article 17(3)).

• Conformity assessment covers the quality management system

  For systems under Section A legislation, the provider follows the conformity assessment procedure of that legislation. The requirements of Chapter III, Section 2 are part of that assessment, and the quality management system under Article 17 is assessed as well (Article 43(3)). Notified bodies notified under Section A legislation must apply for designation under the Act by 28 January 2028.

• Post-market monitoring can use existing systems

  Where a post-market monitoring system and plan already exist under Section A legislation, providers may integrate the necessary elements into them, provided this achieves an equivalent level of protection (Article 72(4)).

• Which authority enforces

  For high-risk systems related to Section A products, the market surveillance authority under the Act is the authority designated under that legislation. A Member State may designate another authority in appropriate circumstances (Article 74(3)).

• No named standard for the system

  The Act itself names no standard or certification for the quality management system and gives no mapping between a device-law system and the 13 aspects. Article 17(1), point (e), asks the system to set out the technical specifications, including standards, to be applied. The Commission is to publish guidelines on Article 17(3) by 1 August 2027 (Article 96(1), point (g)). The provider checks each aspect against its own system.

• The deemed-fulfilment rule is for financial institutions

  Article 17(4) deems the quality management system obligation fulfilled, except for aspects (g), (h) and (i), by complying with financial-services governance rules. It covers financial institutions only, not device manufacturers or hospitals.

• Ten-year retention is Article 18

  The duty to keep the quality management system documentation for ten years after the system was placed on the market or put into service is in Article 18(1), not in Article 17.

• Example: a gap table

  Example, not an Act requirement: a provider with an existing device quality system could list the 13 aspects in a table, mark the document that covers each, and add documents where a gap remains.

• EU AI Act Article 17: Quality Management System

  Article 17 for all sectors: the 13 aspects, proportionality and fines.

• EU AI Act Compliance for Healthcare AI

  The healthcare overview: how the Act reaches medical-device and clinical AI.

• Article 15 for Healthcare AI: Accuracy, Robustness and Cybersecurity

  Healthcare AI and Article 15: accuracy, robustness, cybersecurity, dates and roles.

• Annex I High-Risk AI Systems: The Product-Safety Route

  How products such as medical devices become high-risk AI systems under Article 6(1).