European UnionAI Act, Article 17 (quality management system)
Regulation (EU) 2024/1689, Article 17
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance
- Audit expectation
- periodic
- Who audits it
- Self
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the provider of a high-risk AI system, put in place a quality management system that ensures compliance with the Regulation, documented in a systematic and orderly manner as written policies, procedures and instructions.NIST AI RMFGOVERN 1.4
- Cover at least: a regulatory compliance strategy, including conformity assessment and the management of modifications; design, design control and design verification; development, quality control and quality assurance; examination, test and validation procedures before, during and after development, and how often they run; the technical specifications and standards you apply; data management; the Article 9 risk management system; a post-market monitoring system under Article 72; procedures for reporting serious incidents under Article 73; communication with authorities, notified bodies, other operators, customers and other interested parties; record-keeping of all relevant documentation and information; resource management, including security of supply; and an accountability framework for management and other staff.NIST AI RMFGOVERN 1.4
- Implement those aspects in proportion to the size of your organization, in particular if you are an SME, including a start-up, or a small mid-cap enterprise, while keeping the degree of rigor and level of protection your systems need to comply.
- If you are an SME, including a start-up, with no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC, you may comply with certain elements of the quality management system in a simplified manner under Article 63(1); that does not exempt you from any other requirement or obligation of the Regulation, including Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.
- If you are already subject to quality management system obligations, or an equivalent function, under relevant sectoral Union law, you may include these aspects in that quality management system.
- If you are a financial institution subject to internal-governance requirements under Union financial services law, you meet this duty by complying with those internal-governance rules, except that you must still have the risk management system, the post-market monitoring system and the serious-incident reporting procedures of Article 17(1), points (g), (h) and (i); harmonised standards referred to in Article 40 are taken into account to that end.NIST AI RMFGOVERN 1.4NIST AI RMFMANAGE 4.1
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16, point (c), requires a provider to have a quality management system in place which complies with Article 17, the duty this row states; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Which elements of the Article 17 quality management system may an SME, including a start-up, comply with 'in a simplified manner' under Article 63(1), as replaced by Regulation (EU) 2026/1744, when Article 63(2) keeps every other requirement and obligation of the Regulation in force?
What it makes you log
Logging duty
Point (k) names systems and procedures for record-keeping of all relevant documentation and information as a required aspect of the quality management system, and Article 17(1) requires the system itself to be documented as written policies, procedures and instructions. Article 17 does not say how long the records must be kept or who may see them: the provider keeps the quality management system documentation at the national competent authorities' disposal for 10 years under Article 18(1), point (b).
- Kind
- Explicit
- As of
- Provision
- Article 17(1), point (k)
- Trigger
- high_risk_systems
Why the legislator wanted it
Recital 81, first sentence.
- As of
- Quote
- The provider should establish a sound quality management system, ensure the accomplishment of the required conformity assessment procedure, draw up the relevant documentation and establish a robust post-market monitoring system.
- Source link
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
- oversight_and_correction
What this law does
Providers of a high-risk AI system must put a quality management system in place that ensures compliance with the Regulation, documented in a systematic and orderly manner in the form of written policies, procedures and instructions.
The quality management system must include at least a strategy for regulatory compliance, covering conformity assessment and the management of modifications to the system, the techniques and procedures for design, design control and design verification and for development, quality control and quality assurance, examination, test and validation procedures before, during and after development with their frequency, the technical specifications and standards applied, systems and procedures for data management, the Article 9 risk management system, a post-market monitoring system under Article 72, procedures for reporting a serious incident under Article 73, the handling of communication with authorities, notified bodies, other operators, customers and other interested parties, systems and procedures for record-keeping of all relevant documentation and information, resource management, including security-of-supply measures, and an accountability framework for management and other staff.
As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), Article 17(2) requires the aspects listed in Article 17(1) to be implemented in proportion to the size of the provider's organization, in particular where the provider is an SME, including a start-up, or a small mid-cap enterprise, and providers must in any event respect the degree of rigor and the level of protection needed for their systems to comply.
Article 63(1), as replaced by the same Regulation, lets an SME, including a start-up, that has no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC comply with certain elements of the quality management system in a simplified manner, under guidelines the Commission is to develop.
The 2024 text of Article 63(1) allowed only microenterprises within the meaning of Recommendation 2003/361/EC to comply with certain elements of the quality management system in a simplified manner. Article 63(2) provides that Article 63(1) does not exempt the operators it covers from any other requirement or obligation of the Regulation, including those in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.
A provider already subject to quality management system obligations, or an equivalent function, under relevant sectoral Union law may include the aspects listed in Article 17(1) in the quality management system under that law.
For a provider that is a financial institution subject to internal-governance requirements under Union financial services law, complying with those internal-governance rules is deemed to fulfill the duty to put a quality management system in place, except for the risk management system, the post-market monitoring system and the serious-incident reporting procedures of paragraph 1, points (g), (h) and (i), and harmonised standards referred to in Article 40 are taken into account to that end.
Article 17 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 17 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.