EU AI Act Art. 17: quality management system

Quality management system

By Jorge García Aibar Reviewed 2026-09-24

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART17. Drawn from chapter 08.

Text alternative

Clause: EU AI Act, Art. 17.
Duty holder: Provider.
Applies from: 2027-12-02, Deferred.
Artefact: QMS-as-code.
Layers: Layer 01, Layer 05.
Evidence record: Go/no-go decision, +3 more.
Record schemas: Go/no-go decision , Policy card , Evidence record , Control observation .
The same topic in 20 other frameworks; the crosswalk section below links each clause.

When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.

Data table: the dates

Dates of AIGE-OBL-EUAIA-ART17
Date	Step	Detail
2027-12-02	Deferred	Annex III
2028-08-02	High-risk (Annex I)	Applies to Annex I embedded (product safety-component) systems
2030-08-02	Later step	Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

Id

AIGE-OBL-EUAIA-ART17

Instrument

EU AI Act (post-Omnibus) law

Compared side by side

ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act

Clause

Art. 17

Duty holder

Provider

Authority

National MSA

Applies from

2027-12-02 Deferred · Annex III

Later dates

2028-08-02 Applies to Annex I embedded (product safety-component) systems
2030-08-02 Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

System class

High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

QMS-as-code; versioned policies; pipeline controls and change management.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-EUAIA-ART17
Family	Item	Relation
Patterns	Machine-Readable Evidence (OSCAL)	Direct
Open controls	AIGE-CTL-ASSURE-004 Common Signed Evidence Record	Direct
Open controls	AIGE-CTL-ASSURE-006 Control Observations Filed Against Control Ids	Direct
Open controls	AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL	Direct
Same crosswalk topic	AI Verify 9.1.1, 9.5.2	Core clause
Same crosswalk topic	CSA AICM GRC-01, GRC-06	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 7	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 7	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 9	Core clause
Same crosswalk topic	GAO AI Accountability 1.2, 1.1, 1.3	Core clause
Same crosswalk topic	GDPR Art. 5(2)	Core clause
Same crosswalk topic	ISO 42001 5.1, 5.2, 5.3, A.2, A.3, 9.3, 7.2, 9.2, 10.1	Core clause
Same crosswalk topic	NIST AI RMF GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 5	Core clause
Same crosswalk topic	OECD AI Principles OECD 1.5	Core clause
Same crosswalk topic	Singapore Agentic Agentic 2.2.1	Core clause
Same crosswalk topic	Singapore GenAI GenAI 1	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 4, TC260 5.3.12	Core clause
Same crosswalk topic	UK ATRS ATRS 2.1	Core clause
Same crosswalk topic	CoE Convention CoE Art. 9	Related clause
Same crosswalk topic	EN 18286 EN 18286	Related clause
Same crosswalk topic	EU AI Act Art. 4, Art. 87	Related clause
Same crosswalk topic	G7 Code G7 Action 5	Related clause
Same crosswalk topic	GPAI Code Safety C8	Related clause
Same crosswalk topic	Korea AI Act Art. 36	Related clause

Patterns that build it

Machine-Readable Evidence (OSCAL) (layer 5)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Governance and accountability

ISO 42001 5.1 Leadership and commitment (core)
ISO 42001 5.2 AI policy (core)
ISO 42001 5.3 Roles, responsibilities and authorities (core)
ISO 42001 A.2 Policies related to AI (core)
ISO 42001 A.3 Internal organization (core)
NIST AI RMF GOVERN 1 GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively (core)
NIST AI RMF GOVERN 2 GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained (core)
TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
GDPR Art. 5(2) Accountability (core)
ISO 42001 9.3 Management review (core) (clause not verified)
CSA AICM GRC-01 Governance Program Policy and Procedures (core)
CSA AICM GRC-06 Governance Responsibility Model (core)
UK ATRS ATRS 2.1 Owner and responsibility (core)
Singapore GenAI GenAI 1 Accountability (core)
Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
OECD AI Principles OECD 1.5 Accountability (core)
GAO AI Accountability 1.2 Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system (core)
AI Verify 9.1.1 Accountability: establish policies on the development and use of AI aligned with other organisational policies (core)
AI Verify 9.5.2 Accountability: clear internal governance mechanisms and roles, including a cross-departmental AI governance committee (core)
EU AI Act Art. 4 AI literacy
EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
ISO 42001 7.2 Competence (clause not verified)
ISO 42001 9.2 Internal audit (clause not verified)
ISO 42001 10.1 Continual improvement (clause not verified)
NIST AI RMF GOVERN 4 GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk
NIST AI RMF GOVERN 5 GOVERN 5: Processes are in place for robust engagement with relevant AI actors
GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
Korea AI Act Art. 36 Domestic representative
CoE Convention CoE Art. 9 Accountability and responsibility
G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
GAO AI Accountability 1.1 Clear goals: define clear goals and objectives for the AI system
GAO AI Accountability 1.3 Values: demonstrate a commitment to values and principles established by the entity

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-ASSURE-004 Common Signed Evidence Record (Assurance and evidence profile)
AIGE-CTL-ASSURE-006 Control Observations Filed Against Control Ids (Assurance and evidence profile)
AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL (Assurance and evidence profile)

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-euaia-art17.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 17: quality management system (AIGE-OBL-EUAIA-ART17). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art17. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 17: quality management system (AIGE-OBL-EUAIA-ART17)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art17},
  note         = {Version 0.5.0}
}