# Quality Management System Manual: [Provider name], [High-risk AI system or system family]

> Quality management system (QMS) manual for the provider of one or more
> high-risk AI systems, organised on the thirteen points of Article 17(1)
> of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, as
> amended by Regulation (EU) 2026/1744, the "Digital Omnibus on AI", OJ L of
> 24 July 2026). The amended Act asks for a documented system of policies,
> procedures and instructions, implemented in proportion to the size of the
> provider, with simplification open to SMEs (including start-ups) and,
> since the amendment, small mid-cap enterprises (SMCs). Under the amended
> Article 113 the high-risk requirements apply from 2 December 2027 for
> Annex III systems and from 2 August 2028 for Annex I systems; check the
> consolidated text for the dates that apply to you. Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice; check the current official text
> and a qualified professional.

<!--
Guidance: How to use this template
- This manual is the top document of the QMS. It states how each point of
  Article 17(1) is met and points to the procedures, records and owners.
  Keep the procedures themselves as separate controlled documents (see the
  index in section 17).
- Decide your size category first (section 1.3). It changes how much
  formality is proportionate, but not the level of protection the system
  must reach (Article 17(2)).
- If you already run a QMS under sector law (for example medical devices)
  or ISO 9001 or ISO/IEC 42001, map onto it rather than building a second
  system (Article 17(3)). Use the "Existing process" column.
- Financial institutions covered by Union financial services law: Article
  17(4) treats the internal governance rules of that law as meeting the
  obligation, except points (g), (h) and (i). Fill sections 9 to 11 in any
  case.
- The worked example is a fictional provider of a creditworthiness model.
  The same fictional system appears in `ai-data/ai-act-risk-management-system`.
-->

## Document control

<!-- Guidance: The manual is a controlled document. Authorities and notified bodies will ask which version applied when a system version was released. -->

| Field | Value |
|---|---|
| Document ID | [QMS-AISYS-001] |
| Provider | [Legal name, address] *(Example: Quillmere Analytics, a fictional provider)* |
| Authorised representative (if provider outside the EU) | [Name, address] |
| Systems in scope | [System names and versions] *(Example: Quillmere Affordability Scorer 3.x)* |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@qms-manager] |
| Approvers / reviewers | [@ceo], [@head-of-ai], [@legal], [@security-lead] |
| Classification | [Internal] |
| Last updated | YYYY-MM-DD |
| Next management review | YYYY-MM-DD |
| Retention | *Example:* 10 years after the last system in scope is placed on the market or put into service (Article 18) |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Chief executive (management responsibility) | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| QMS manager | [@name] | [Decision] | YYYY-MM-DD |
| Head of AI engineering | [@name] | [Decision] | YYYY-MM-DD |
| Legal and regulatory affairs | [@name] | [Decision] | YYYY-MM-DD |

## Revision history

<!-- Guidance: Record each change to the manual and why. Changes to procedures are tracked in the procedure index (section 17). -->

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft mapping Article 17(1) |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved for first release of the system in scope |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Gap check against EN 18286:2026 added to section 7 |

## Contents

<!-- Guidance: Sections 3 to 15 follow Article 17(1)(a) to (m) in order, so a reviewer can find each point quickly. -->

1. [Scope, applicability and proportionality](#1-scope-applicability-and-proportionality)
2. [Quality policy and objectives](#2-quality-policy-and-objectives)
3. [Regulatory compliance strategy (point a)](#3-regulatory-compliance-strategy-point-a)
4. [Design, design control and design verification (point b)](#4-design-design-control-and-design-verification-point-b)
5. [Development, quality control and quality assurance (point c)](#5-development-quality-control-and-quality-assurance-point-c)
6. [Examination, test and validation (point d)](#6-examination-test-and-validation-point-d)
7. [Technical specifications and standards (point e)](#7-technical-specifications-and-standards-point-e)
8. [Data management (point f)](#8-data-management-point-f)
9. [Risk management (point g)](#9-risk-management-point-g)
10. [Post-market monitoring (point h)](#10-post-market-monitoring-point-h)
11. [Serious incident reporting (point i)](#11-serious-incident-reporting-point-i)
12. [Communication with authorities and other parties (point j)](#12-communication-with-authorities-and-other-parties-point-j)
13. [Record-keeping (point k)](#13-record-keeping-point-k)
14. [Resource management and security of supply (point l)](#14-resource-management-and-security-of-supply-point-l)
15. [Accountability framework (point m)](#15-accountability-framework-point-m)
16. [Internal audit, management review and improvement](#16-internal-audit-management-review-and-improvement)
17. [Procedure index and traceability matrix](#17-procedure-index-and-traceability-matrix)
18. [Glossary and references](#18-glossary-and-references)

## 1. Scope, applicability and proportionality

<!-- Guidance: State which systems, sites and activities the QMS covers, which legal regime applies, and which simplifications you rely on, with the reasoning. Pitfall: claiming a simplification without recording why the provider qualifies. -->

### 1.1 Scope

| Item | Description |
|---|---|
| Provider role | [Provider / Product manufacturer placing the AI system under its name / Provider by substantial modification] |
| Systems in scope | [List with intended purposes and high-risk basis] |
| Sites and teams | [Locations and teams that design, develop, test, release and support the systems] |
| Outsourced activities | *Example:* Cloud hosting, data labelling vendor, third-party general-purpose AI model |
| Excluded activities | [Activities outside the QMS, with the reason] |

### 1.2 Integration with existing management systems

| Existing system | Basis | How this manual relates |
|---|---|---|
| *Example:* ISO 9001 certified QMS (2015 or 2026 edition) | Voluntary certification | AI procedures added as a module; shared document control, audit and review |
| *Example:* ISO/IEC 42001 AI management system | Voluntary certification | AI policy and impact assessment reused; Article 17 points mapped in section 17 |
| [Sector QMS, for example medical devices] | [Union sector law] | [Article 17(3): AI aspects included in that system] |
| [Financial services internal governance] | [Union financial services law] | [Article 17(4): governance rules relied on; points (g), (h), (i) kept here] |

### 1.3 Size category and simplification

| Question | Answer |
|---|---|
| Size category | [Microenterprise / Small or medium-sized enterprise (SME), including start-up / Small mid-cap (SMC) / Larger enterprise] |
| Definition applied and date checked | [Article 3 as amended, and the Commission Recommendation it refers to; date of check] |
| Partner or linked enterprises considered | [Yes / No, with result] |
| Article 17(2) proportionality relied on | [Yes / No: which points are implemented in a lighter form] |
| Article 63 simplified QMS option relied on | [Yes / No: which elements, per current Commission guidance] (the consolidated Article 63(1) names SMEs, including start-ups, without partner or linked enterprises; it does not name SMCs, so check the Official Journal text) |
| Elements never simplified | Level of protection and rigour needed for compliance; obligations in Articles 9 to 15, 72 and 73 |

*Example:* "Quillmere Analytics has about 400 staff and is not an SME. It
qualifies as an SMC under the amended Article 3 (checked YYYY-MM-DD against
the thresholds in force). It uses proportionality for design review
formality (single cross-functional review instead of staged gates) and for
management review frequency (twice a year). Risk management, post-market
monitoring and incident reporting are run in full."

## 2. Quality policy and objectives

<!-- Guidance: Article 17 does not list a policy as a point, but a short policy and measurable objectives give the procedures a purpose and give management review something to check. Keep objectives tied to the requirements of the Act. -->

[Quality policy statement, signed by top management. Example: "We place on
the market only AI systems that meet the requirements for high-risk AI
systems, that are safe for the people they affect, and that our deployers
can oversee. We test before release, monitor in use, report incidents
promptly and correct problems at the root."]

| Objective ID | Objective | Measure | Target | Owner |
|---|---|---|---|---|
| QO-01 *(Example)* | Release only tested versions | Releases with complete test evidence | 100% | [@head-of-ai] |
| QO-02 *(Example)* | Report serious incidents on time | Reports within the Article 73 deadlines | 100% | [@regulatory-lead] |
| QO-03 *(Example)* | Close corrective actions | Actions closed by due date | at least 90% | [@qms-manager] |
| QO-04 *(Example)* | Keep deployers informed | Instructions for use updated within 30 days of a relevant change | 100% | [@product] |
| [QO-nn] | [Objective] | [Measure] | [Target] | [@owner] |

## 3. Regulatory compliance strategy (point a)

<!-- Guidance: Point (a) covers the strategy for regulatory compliance, including the conformity assessment procedures and the procedures for managing modifications to the high-risk system. Show the route to market and how a change is assessed. -->

### 3.1 Route to compliance

| Step | Article | How it is done | Procedure |
|---|---|---|---|
| Classification and high-risk confirmation | Article 6, Annex III or Annex I | Intake and classification record | QMS-PR-01 |
| Technical documentation | Article 11, Annex IV | Technical file per system version | QMS-PR-01 |
| Conformity assessment | Article 43 | *Example:* internal control (Annex VI) for the Annex III point 5 system; notified body route (Annex VII) where required | QMS-PR-01 |
| EU declaration of conformity | Article 47 | Drawn up and signed per version | QMS-PR-01 |
| CE marking | Article 48 | Applied to the system or documentation | QMS-PR-01 |
| Registration | Article 49 | EU database entry before placing on the market | QMS-PR-01 |
| Corrective action and information duties | Article 20 | Withdraw, disable or recall; inform distributors, deployers, authorities | QMS-PR-11 |

### 3.2 Management of modifications

| Change class | Example | Assessment | Approval |
|---|---|---|---|
| Within predetermined change plan | *Example:* quarterly retraining, same features, thresholds met | Regression tests in section 6; risk record review | System owner |
| Change needing new assessment | *Example:* new input data source or new deployer sector | Substantial modification check; risk management restart; conformity assessment repeated if substantial | Change board and QMS manager |
| Documentation-only change | *Example:* clarification in instructions for use | Review by product and legal | Product owner |

```mermaid
flowchart TD
  A["Change request"] --> B{"Within predetermined change plan?"}
  B -- "Yes" --> C["Regression tests and risk review"]
  C --> D{"Thresholds met?"}
  D -- "Yes" --> E["Release, update technical file"]
  D -- "No" --> F["Treat as change needing new assessment"]
  B -- "No" --> F
  F --> G{"Substantial modification?"}
  G -- "Yes" --> H["New conformity assessment, new declaration"]
  G -- "No" --> I["Documented assessment, release, update technical file"]
```

## 4. Design, design control and design verification (point b)

<!-- Guidance: Point (b) asks for the techniques, procedures and systematic actions used for design, design control and design verification. Show design inputs (requirements), reviews and verification that outputs meet inputs. -->

| Activity | Method | Output | Procedure |
|---|---|---|---|
| Design inputs | Requirements from intended purpose, risk controls, Articles 10 to 15 | Requirements specification | QMS-PR-02 |
| Design review | *Example:* one cross-functional review per release (engineering, risk, legal, product) | Review minutes with decisions | QMS-PR-02 |
| Design verification | Trace each requirement to a test or analysis | Verification matrix | QMS-PR-02 |
| Human oversight design | Oversight measures designed with deployer input | Oversight design record | QMS-PR-02 |
| Design change control | Changes to requirements go through 3.2 | Change log | QMS-PR-02 |

Related template: `ai-data/human-oversight-design`, `ai-data/ml-system-design`.

## 5. Development, quality control and quality assurance (point c)

<!-- Guidance: Point (c) covers the techniques, procedures and systematic actions for development, quality control and quality assurance. Describe how code, models and pipelines are built and checked, and who checks independently. -->

| Activity | Practice | Evidence | Procedure |
|---|---|---|---|
| Source and configuration control | All code, configuration and pipeline definitions in version control; protected main branch | Repository settings, review records | QMS-PR-03 |
| Model and data versioning | Every trained model linked to data snapshot, code commit and parameters | Model registry entries | QMS-PR-03 |
| Peer review | Two-person review for model and pipeline changes | Pull request records | QMS-PR-03 |
| Quality control gates | Automated checks before merge: tests, lint, data validation | Pipeline logs | QMS-PR-03 |
| Quality assurance | Independent QA review of release evidence | Release checklist sign-off | QMS-PR-03 |
| Third-party components | Supplier and component checks, including general-purpose AI models | Component register, supplier documentation | QMS-PR-12 |

## 6. Examination, test and validation (point d)

<!-- Guidance: Point (d) asks for the examination, test and validation procedures before, during and after development, and the frequency at which they are carried out. Frequency is often forgotten: state it. -->

| Test type | When | Frequency | Pass criteria source | Procedure |
|---|---|---|---|---|
| Data validation | Before each training run | Every run | Data specification | QMS-PR-04 |
| Model validation (accuracy, group performance, calibration) | Before release | Every release | Predefined metrics in risk record | QMS-PR-04 |
| Robustness and security testing | Before release | Every major release, and *Example:* at least yearly | Threat model and robustness criteria | QMS-PR-04 |
| Usability and oversight testing | Before first release and after interface changes | Per change | Oversight design | QMS-PR-04 |
| Real-world testing | Where planned under Article 60 | Per plan | Testing plan | QMS-PR-04 |
| Post-release validation | On the market | *Example:* monthly indicators, quarterly sample audit | Post-market monitoring plan | QMS-PR-08 |

Each test report is dated, signed by the responsible person and stored as
a controlled record (section 13).

## 7. Technical specifications and standards (point e)

<!-- Guidance: Point (e) asks which technical specifications, including standards, are applied and, where harmonised standards are not applied in full or do not cover every requirement, the means used to ensure compliance. Keep the status of each standard current; publication and citation in the Official Journal are different steps. -->

| Standard or specification | Status (checked YYYY-MM-DD) | Applied | Requirements covered | Gap handling |
|---|---|---|---|---|
| EN 18286:2026, AI quality management system for EU AI Act regulatory purposes (CEN-CENELEC JTC 21) | Published July 2026; reference cited in the Official Journal by Commission Implementing Decision (EU) 2026/2274, published 14 October 2026, as reported by law firms and test bodies (check the OJ) | *Example:* Partial | Article 17(1), and reported also Article 11(1) | Own procedures for points not covered or not applied |
| prEN 18228, AI risk management (draft) | *Example:* In comment resolution as of September 2026 | Used as guidance | Article 9 | Risk procedure QMS-PR-07 |
| ISO/IEC 42001:2023 | Published | Partial | Management system elements | Mapping in section 17 |
| ISO/IEC 23894:2023 | Published | Partial | Risk management guidance | QMS-PR-07 |
| Common specifications (Article 41) | [None adopted for this area / reference] | [Yes / No] | [Requirement] | [Note] |
| [Other] | [Status] | [Full / Partial] | [Requirement] | [Gap handling] |

Only harmonised standards cited in the Official Journal give a presumption
of conformity (Article 40), and only for the requirements they cover.

## 8. Data management (point f)

<!-- Guidance: Point (f) covers systems and procedures for data management: acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation, retention and any other operation before and for the placing on the market. Link to Article 10 data governance. -->

| Data operation | Control | Evidence | Procedure |
|---|---|---|---|
| Acquisition and collection | Lawful basis and licence checked; provenance recorded | Data source register | QMS-PR-05 |
| Analysis and examination for bias | Representation and bias checks before training | Datasheet, bias report | QMS-PR-05 |
| Labelling | Written guidelines, inter-annotator agreement measured | Annotation guidelines, agreement report | QMS-PR-05 |
| Storage and access | Encrypted storage; role-based access; access reviews | Access review log | QMS-PR-05 |
| Filtration, aggregation and transformation | Versioned pipelines with validation | Pipeline logs | QMS-PR-05 |
| Retention and deletion | Retention schedule per dataset | Retention schedule | QMS-PR-05 |
| Special categories for bias detection | Only where strictly necessary, with safeguards, as allowed by the amended Act and data protection law | Necessity record, DPIA | QMS-PR-05 |

Related templates: `ai-data/datasheet-for-datasets`, `ai-data/annotation-guidelines`, `ai-data/bias-profile-7003`.

## 9. Risk management (point g)

<!-- Guidance: Point (g) brings the Article 9 risk management system into the QMS. Here describe the procedure; the risk record per system lives in its own document. This point stays in your QMS even for financial institutions using Article 17(4). -->

| Item | Description |
|---|---|
| Procedure | QMS-PR-07 Risk management for high-risk AI systems |
| Record per system | *Example:* RMS-AISYS-001 (template `ai-data/ai-act-risk-management-system`) |
| Criteria owner | [@risk-owner] |
| Acceptance authority | *Example:* Medium by risk owner; High by accountable executive; Critical never accepted |
| Review frequency | *Example:* every 6 months and on the triggers in the risk record |
| Inputs | Design, test results, post-market data, incidents, complaints |

## 10. Post-market monitoring (point h)

<!-- Guidance: Point (h) requires the setting-up, implementation and maintenance of the post-market monitoring system under Article 72. State the plan per system and how results return to risk management and design. -->

| Item | Description |
|---|---|
| Procedure | QMS-PR-08 Post-market monitoring |
| Plan per system | *Example:* PMM-QAS-01, part of the technical documentation |
| Data collected | Logs shared by deployers, complaints, appeals, deployer feedback, incidents |
| Analysis frequency | *Example:* monthly indicators, quarterly management summary |
| Feedback loop | Threshold breaches open a risk review (section 9) and, where needed, a corrective action (section 16) |
| Commission template | Check for the Commission template for post-market monitoring plans and align the plan when it is adopted |

Related template: `ai-data/ai-post-market-monitoring`.

## 11. Serious incident reporting (point i)

<!-- Guidance: Point (i) covers procedures for reporting a serious incident under Article 73. The clocks run from awareness, so the procedure must say who decides that the provider is aware. -->

| Situation | Deadline after becoming aware (Article 73) | Owner |
|---|---|---|
| Serious incident, general case | Immediately after establishing a causal link or its reasonable likelihood, and no later than 15 days | [@regulatory-lead] |
| Widespread infringement or serious and irreversible disruption of critical infrastructure | Immediately, and no later than 2 days | [@regulatory-lead] |
| Death of a person | Immediately after establishing or suspecting a causal relationship, and no later than 10 days | [@regulatory-lead] |

| Step | Description |
|---|---|
| Intake | Deployer reports, monitoring alerts and complaints reach the incident inbox within one working day |
| Triage | *Example:* incident lead, legal and system owner decide on seriousness and record the awareness date |
| Report | Initial report to the market surveillance authority of the Member State where the incident occurred; complete report later if needed |
| Investigation | Root cause analysis without altering the system in a way that affects later evaluation, before informing the authority |
| Closure | Corrective action, risk record update, deployer communication |

Related templates: `ai-data/ai-incident-report`, `ai-data/llm-incident-postmortem`.

## 12. Communication with authorities and other parties (point j)

<!-- Guidance: Point (j) covers communication with national competent authorities, other relevant authorities including those that provide or support access to data, notified bodies, other operators, customers and other interested parties. Name a contact and a channel for each. -->

| Party | Purpose | Channel | Owner | Response target |
|---|---|---|---|---|
| Market surveillance authorities | Requests for documentation, incident reports, corrective actions | [Official channel] | [@regulatory-lead] | *Example:* acknowledge in 2 working days |
| Notified body (if used) | Assessment, surveillance, change notifications | [Contact] | [@qms-manager] | Per contract |
| Deployers | Instructions for use, change notices, field safety information | Customer portal, account managers | [@product] | *Example:* change notice 30 days before release |
| Distributors and importers | Conformity information, corrective action | [Channel] | [@regulatory-lead] | [Target] |
| Suppliers of components and models | Information needed for compliance | Supplier contracts | [@procurement] | Per contract |
| Affected persons | Complaints and questions | Public contact form via deployers | [@support] | [Target] |

## 13. Record-keeping (point k)

<!-- Guidance: Point (k) asks for systems and procedures for record-keeping of all relevant documentation and information. Article 18 sets a 10-year keeping period for the listed documents; Article 19 covers automatically generated logs under the provider's control. -->

| Record | Legal anchor | Retention | Location | Owner |
|---|---|---|---|---|
| Technical documentation | Articles 11, 18(1)(a) | 10 years after placing on the market or putting into service | [Document system] | [@head-of-ai] |
| QMS documentation | Article 18(1)(b) | 10 years | [Location] | [@qms-manager] |
| Changes approved by notified bodies | Article 18(1)(c) | 10 years | [Location] | [@qms-manager] |
| Notified body decisions and documents | Article 18(1)(d) | 10 years | [Location] | [@qms-manager] |
| EU declaration of conformity | Articles 18(1)(e), 47 | 10 years | [Location] | [@regulatory-lead] |
| Automatically generated logs under provider control | Article 19 | At least 6 months, longer where other law requires | [Log store] | [@ops] |
| Test reports, risk records, incident files | Article 17(1)(k) | *Example:* 10 years | [Location] | [Owner] |

## 14. Resource management and security of supply (point l)

<!-- Guidance: Point (l) covers resource management, including measures related to security of supply. Think of people, compute, data and third-party models, and what happens if a supplier fails. -->

| Resource | Need | Security of supply measure | Owner |
|---|---|---|---|
| Competent staff | *Example:* ML engineers, risk analysts, regulatory lead, QA | Competence matrix, training plan, deputies for key roles | [@hr] |
| Compute | Training and serving capacity | *Example:* two cloud regions in the EU; capacity reservation for retraining | [@ops] |
| Data | Training refresh and monitoring data | Contracts with data suppliers including notice periods | [@data-lead] |
| Third-party general-purpose AI model | *Example:* parsing of uploaded payslips and bank statements | Pinned version, exit plan, documentation from the model provider | [@procurement] |
| Tooling | Model registry, monitoring, document control | Backup and restore tested | [@ops] |

## 15. Accountability framework (point m)

<!-- Guidance: Point (m) asks for an accountability framework setting out the responsibilities of management and other staff for every aspect listed in Article 17(1). A RACI per point is the simplest way to show it. -->

R = responsible, A = accountable, C = consulted, I = informed.

| Article 17(1) point | Chief executive | QMS manager | Head of AI engineering | Risk owner | Regulatory lead | Product owner |
|---|---|---|---|---|---|---|
| (a) Compliance strategy | A | R | C | C | R | I |
| (b) Design | I | C | A, R | C | I | R |
| (c) Development and QA | I | C | A, R | I | I | C |
| (d) Test and validation | I | C | A, R | C | I | C |
| (e) Standards | I | A, R | C | C | C | I |
| (f) Data management | I | C | A, R | C | I | I |
| (g) Risk management | I | C | C | A, R | C | C |
| (h) Post-market monitoring | I | C | R | C | C | A, R |
| (i) Incident reporting | I | C | C | C | A, R | C |
| (j) Communication | I | C | C | I | A, R | R |
| (k) Record-keeping | I | A, R | C | I | C | I |
| (l) Resources | A | R | C | I | I | C |
| (m) Accountability framework | A | R | I | I | I | I |

## 16. Internal audit, management review and improvement

<!-- Guidance: Article 17 does not list internal audit or management review as points, but a QMS that is never checked drifts. Harmonised standards and ISO-based systems expect both. Keep corrective actions linked to their trigger. -->

| Activity | Frequency | Inputs | Outputs | Owner |
|---|---|---|---|---|
| Internal audit of QMS procedures | *Example:* each procedure at least once a year | Audit plan, previous findings | Audit report, nonconformities | [@internal-auditor] |
| Management review | *Example:* twice a year (proportionate for the SMC example) | Objectives in section 2, audit results, post-market data, incidents, standards status | Decisions, resource changes | [@ceo] |
| Corrective and preventive action | On each nonconformity or incident | Root cause analysis | Action plan, effectiveness check | [@qms-manager] |

| CAPA ID | Source | Description | Root cause | Action | Due | Status |
|---|---|---|---|---|---|---|
| CAPA-001 *(Example)* | Internal audit | Two test reports unsigned | Release checklist did not require signature | Add signature gate to release pipeline | YYYY-MM-DD | Closed |
| [CAPA-nnn] | [Source] | [Description] | [Cause] | [Action] | YYYY-MM-DD | [Status] |

Related templates: `compliance/management-review`, `compliance/capa-nonconformity`, `compliance/internal-audit-program`.

## 17. Procedure index and traceability matrix

<!-- Guidance: One row per Article 17(1) point. Every point needs a procedure, an owner and evidence. If you rely on an existing management system, name the existing process in the last column. -->

| Point | Topic | Procedure | Owner | Evidence | Existing process (if integrated) |
|---|---|---|---|---|---|
| (a) | Compliance strategy and modifications | QMS-PR-01 | [@regulatory-lead] | Route-to-market record, change log | *Example:* ISO 9001 clause 8.5.6 change control (2015 numbering; confirm in ISO 9001:2026) |
| (b) | Design, design control, verification | QMS-PR-02 | [@head-of-ai] | Requirements, review minutes, verification matrix | *Example:* ISO 9001 clause 8.3 (2015 numbering; confirm in ISO 9001:2026) |
| (c) | Development, QC, QA | QMS-PR-03 | [@head-of-ai] | Repository and registry records | [Process] |
| (d) | Examination, test, validation | QMS-PR-04 | [@qa-lead] | Signed test reports | [Process] |
| (e) | Technical specifications and standards | QMS-PR-06 | [@qms-manager] | Standards register (section 7) | [Process] |
| (f) | Data management | QMS-PR-05 | [@data-lead] | Data source register, datasheets | *Example:* ISO/IEC 42001 Annex A data controls |
| (g) | Risk management | QMS-PR-07 | [@risk-owner] | Risk record per system | *Example:* ISO/IEC 23894 based process |
| (h) | Post-market monitoring | QMS-PR-08 | [@product] | Monitoring plan and reports | [Process] |
| (i) | Serious incident reporting | QMS-PR-09 | [@regulatory-lead] | Incident files | [Process] |
| (j) | Communication | QMS-PR-10 | [@regulatory-lead] | Communication log | [Process] |
| (k) | Record-keeping | QMS-PR-13 | [@qms-manager] | Records register (section 13) | *Example:* ISO 9001 clause 7.5 (documented information) |
| (l) | Resources and security of supply | QMS-PR-12 | [@ops] | Competence matrix, supplier register | [Process] |
| (m) | Accountability framework | This manual, section 15 | [@ceo] | Signed RACI | [Process] |
| Article 20 | Corrective actions and duty of information | QMS-PR-11 | [@regulatory-lead] | Corrective action log | [Process] |

## 18. Glossary and references

<!-- Guidance: Define terms as used in this manual and list the sources with the date they were checked. -->

| Term | Meaning in this manual |
|---|---|
| Provider | The organisation that develops a high-risk AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark |
| SME | Micro, small or medium-sized enterprise as defined in the amended Act |
| SMC | Small mid-cap enterprise as defined in the amended Act |
| Substantial modification | A change not foreseen or planned in the initial conformity assessment that affects compliance or changes the intended purpose |
| Predetermined change plan | Changes to the system and its performance described in advance in the technical documentation |
| CAPA | Corrective and preventive action |

References (checked October 2026; check the current versions):

- Regulation (EU) 2024/1689, Articles 3, 9, 11, 17 to 20, 40, 43, 47 to 49,
  60, 63, 72, 73: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L of 24 July 2026,
  in force 27 July 2026; it extends the Article 17(2) proportionality to
  SMCs. The amended Article 63(1) simplified QMS option, as reproduced in
  consolidated form, covers SMEs including start-ups but not SMCs; check
  the Official Journal text: http://data.europa.eu/eli/reg/2026/1744/oj
- EN 18286:2026, Artificial intelligence, Quality management system for EU
  AI Act regulatory purposes (CEN and CENELEC, July 2026), cited by name
  only; reference cited in the Official Journal by Commission Implementing
  Decision (EU) 2026/2274 (14 October 2026, as reported by Orrick:
  https://www.orrick.com/en/Insights/2026/10/First-Harmonised-Technical-Standard-Published-Under-the-EU-AI-Act). Official text: CEN-CENELEC through national standards bodies,
  purchase or licensed access: https://www.cencenelec.eu (national members'
  catalogues).
- ISO 9001:2026 (published September 2026; the 2015 edition is withdrawn): https://www.iso.org/standard/88464.html
- ISO/IEC 42001:2023: https://www.iso.org/standard/81230.html
- ISO/IEC 23894:2023: https://www.iso.org/standard/77304.html

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 17,
quality management system, with links to Articles 18 to 20, 43, 63, 72 and
73. EU legislative texts are free to reuse; this template summarises the
points in original wording and reproduces no text of the Regulation. EN
18286:2026, ISO 9001:2026, ISO/IEC 42001:2023 and ISO/IEC 23894:2023 are paid standards
cited by name, status and scope only. Official text: CEN-CENELEC national
standards bodies and ISO, purchase or licensed access:
https://www.iso.org/standard/81230.html. The provider, the system and every
figure in the examples are fictional. Check the consolidated text on
EUR-Lex and current Commission guidance; this is a documentation format, not
legal advice. Template licence: MIT.