Article 17 for HR Tech: Quality Management System

The system must be documented in a systematic and orderly manner as written policies, procedures and instructions. The Act lists 13 aspects, (a) to (m); the rows below show (a), (g), (h) and (i) first, then the other nine.

• Art. 17(1)(a)
  Regulatory compliance strategy

  A strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for managing modifications to the system.

• Art. 17(1)(g)
  Risk management system

  The risk management system referred to in Article 9.

• Art. 17(1)(h)
  Post-market monitoring

  Setting up, implementing and maintaining a post-market monitoring system under Article 72.

• Art. 17(1)(i)
  Serious incident reporting

  Procedures for reporting a serious incident under Article 73.

• Art. 17(1)(b)–(f), (j)–(m)
  The other nine aspects

  Design and design control; development, quality control and quality assurance; examination, test and validation procedures; technical specifications and standards; data management; communication with authorities, notified bodies and others; record-keeping; resource management; and an accountability framework.

• Art. 17(2)
  Proportionate to size, not to protection

  Implementation must be proportionate to the size of the provider’s organisation, in particular for an SME, including a start-up, or a small mid-cap enterprise. Providers must still respect the degree of rigour and the level of protection needed for compliance of their high-risk systems.

Article 17 binds providers of high-risk AI systems only. The rows below show where HR-tech AI becomes high-risk.

• HR tech is not a category in the Act

  The Act has no HR-tech category. This site uses the word for AI that reaches the Act through Annex III point 4 (employment, workers’ management and access to self-employment), and through the ban in Article 5(1)(f) on inferring emotions in the workplace.

• Annex III point 4: employment and workers’ management

  Annex III point 4(a) lists AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Point 4(b) lists AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships. An Annex III system is treated as not high-risk only under Article 6(3), and the provider must document that assessment before the system is placed on the market or put into service (Article 6(4)). Article 6(3) never applies where the system performs profiling of natural persons. A provider that concludes its Annex III system is not high-risk is subject to the registration obligation in Article 49(2).

• Provider and deployer

  The provider, for example an HR-software vendor, develops the AI system, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)). An employer, recruitment agency or other body that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that leaves the system high-risk, or changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). The Act does not apply to the obligations of deployers who are natural persons using AI systems in a purely personal non-professional activity (Article 2(10)).

• Dates

  Annex III point 4 systems must meet these duties from 2 December 2027 (Article 113, third paragraph, point (c)(i)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards; in any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)). The ban in Article 5(1)(f) has applied since 2 February 2025; the carve-out in Article 113, third paragraph, point (a) does not concern it.

• Fines

  Breaches of provider obligations under Article 16 and of deployer obligations under Article 26 can be fined up to EUR 15 million or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is up to whichever is lower (Article 99(6)); the same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State decides to what extent fines may be imposed on public authorities and bodies established there (Article 99(8)).

• Conformity assessment by internal control

  For high-risk systems under Annex III points 2 to 8, which include point 4, the provider follows the conformity assessment procedure based on internal control in Annex VI; it does not provide for the involvement of a notified body (Article 43(2)). In that procedure the provider verifies that its quality management system complies with Article 17 (Annex VI, point 2).

• Scope limits

  The Act does not apply to areas outside the scope of Union law (first sentence of Article 2(3)), to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before a system is placed on the market or put into service; testing in real world conditions is not covered by that exclusion (Article 2(8)). It does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or fall under Article 5 or 50 (Article 2(12)).

• No named standard for the system

  The Act itself names no standard or certification for the quality management system. Article 17(1), point (e), asks the system to set out the technical specifications, including standards, to be applied. The presumption of conformity in Article 40(1) covers the requirements of Section 2, not Article 17. The provider checks each aspect against its own system.

• Existing quality systems under other Union law

  Providers that are subject to obligations regarding quality management systems or an equivalent function under relevant sectoral Union law may include the aspects of Article 17(1) as part of the quality management system under that law (Article 17(3)).

• Ten-year retention is Article 18

  The duty to keep the quality management system documentation for ten years after the system was placed on the market or put into service is in Article 18(1), not in Article 17.

• Example: a gap table

  Example, not an Act requirement: a provider with an existing quality system could list the 13 aspects in a table, mark the document that covers each, and add documents where a gap remains.

• EU AI Act Article 17: Quality Management System

  Article 17 for all sectors: the 13 aspects, proportionality and fines.

• EU AI Act Compliance for HR Tech

  The HR-tech overview: how the Act reaches recruitment and worker-management AI.

• Article 15 for HR Tech: Accuracy, Robustness and Cybersecurity

  HR-tech AI and Article 15: accuracy, robustness, cybersecurity, dates and roles.

• Annex III Deep Dive: All 8 High-Risk Categories

  How Annex III makes AI systems high-risk, including employment and workers’ management.