Article 17
Quality management system

 

1. Providers of high-risk AI systems shall put have a quality management system in place that ensures compliance with this Regulation. That system It shall be documented in a systematic and orderly manner in the form of written policies, procedures and or instructions, and can be incorporated into an existing quality management system under Union sectoral legislative acts. It shall include at least the following aspects: [This change has been provisionally agreed on subject to final check by the EP.]

(a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system; [This deletion has been provisionally agreed subject to final check by the EP.]

(b) techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system;

(c) techniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system;

(d) examination, test and validation procedures to be carried out before, during and after the development of the high-risk AI system, and the frequency with which they have to be carried out;

(e) technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full, or do not cover all of the relevant requirements, the means to be used to ensure that the high-risk AI system complies with the requirements set out in Chapter 2 of this Title; [This change has been provisionally agreed with the EP at the technical level.]

(f) systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purposes of the placing on the market or putting into service of high-risk AI systems; [This change has been provisionally agreed with the EP at the technical level.]

(g) the risk management system referred to in Article 9;

(h) the setting-up, implementation and maintenance of a post-market monitoring system, in accordance with Article 61;

(i) procedures related to the reporting of serious incidents and of malfunctioning in accordance with Article 62;

(j) the handling of communication with national relevant competent authorities, competent authorities, including sectoral ones, providing or supporting the access to data, notified bodies, other operators, customers or other interested parties; [This change has been provisionally agreed subject to final check by the EP.]

(k) systems and procedures for record keeping of all relevant documentation and information;

(l) resource management, including security of supply related measures;

(m) an accountability framework setting out the responsibilities of the management and other staff with regard to all aspects listed in this paragraph.

2. The implementation of aspects referred to in paragraph 1 shall be proportionate to the size of the provider’s organisation. Providers shall in any event respect the degree of rigour and the level of protection required to ensure compliance of their AI systems with this Regulation. [This clause has been provisionally agreed with the EP at the technical level.]

2a. For providers of high-risk AI systems that are subject to obligations regarding quality management systems under relevant sectorial Union law, the aspects described in paragraph 1 may be part of the quality management systems pursuant to that law. [The Council added this clause, and it has been provisionally agreed on subject to final check by the EP.]

3. For providers that are credit financial institutions regulated by Directive 2013/36/ EU  subject to requirements regarding their internal governance, arrangements or processes under Union financial services legislation, the obligation to put in place a quality management system in place with the exception of paragraph 1, points (g), (h) and (i) shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms or processes pursuant to the relevant Union financial services legislation Article 74 of that Directive. In that context, any harmonised standards referred to in Article 40 of this Regulation shall be taken into account. [The Council amended this clause, and it has been provisionally agreed on subject to final check by the EP.]