Home / The Act / Chapter III / Article 17

Article 17 — Quality management system

APPLIES DEC 2, 2027 WAS 2026-08-02 AMENDED BY OMNIBUS

Chapter III · High-risk tier
Source: EUR-Lex · CELEX 32024R1689
Verified 2026-07-16

PLAIN-LANGUAGE SUMMARY — ORIGINAL INTERPRETATION, NOT THE OFFICIAL TEXT

Providers must run a documented quality management system that keeps their high-risk systems compliant. Written policies should cover the compliance strategy, design and development controls, testing, data governance, risk management, post-market monitoring, incident reporting, record-keeping, resourcing, and accountability. The effort can scale to the organisation's size while keeping the necessary rigour. Providers meeting equivalent duties under sectoral Union law may fold these elements in, and financial institutions can rely on their internal-governance rules for most parts.

AMENDED BY THE DIGITAL OMNIBUS ON AI

This provision's application date moved under the Omnibus. It now applies from 2027-12-02 (originally 2026-08-02). Source: Omnibus final text (OJ pending) · verified 2026-07-16

OFFICIAL TEXT Read verbatim on EUR-Lex ↗

The authoritative wording lives on EUR-Lex, quoted there in all 24 languages. We deep-link to the paragraph level rather than reproducing the full text. The consolidated post-Omnibus version will be linked the day its CELEX publishes.

AT A GLANCE

Chapter: III — High-risk AI systems

Applies: Dec 2, 2027

Tier: High-risk tier

Provider obligations →Harmonised standards →Compliance guidance →

PENALTY EXPOSURE

€15M or 3%

of worldwide turnover — see Art. 99 penalties framework.

← PREVIOUS · ART. 16 Obligations of providers of high-risk AI systems NEXT · ART. 18 → Documentation keeping

ELSEWHERE IN CHAPTER III — High-risk AI systems

Art. 6 Classification rules for high-risk AI systems Art. 7 Amendments to Annex III Art. 8 Compliance with the requirements Art. 9 Risk management system Art. 10 Data and data governance Art. 11 Technical documentation Art. 12 Record-keeping Art. 13 Transparency and provision of information to d