High-Risk AI Quality Management System

What this control does

Maintain a documented QMS integrating regulatory strategy, lifecycle controls, data, risk, monitoring, incidents, records and accountability.

How to implement

For a high-risk AI provider, document how the quality management system (QMS) controls the actual lifecycle of its AI systems. Assign responsibilities for design, changes, data, testing, regulatory communication, records and resources. Connect these procedures to risk management, post-market monitoring and serious-incident reporting. Use reviews to track unresolved gaps and test whether procedures are followed. Coordinate with an existing sectoral QMS where permitted, but verify the conditions for any simplified or equivalent arrangements. The accessibility mapping supports governance of applicable requirements, not technical accessibility certification.

Suggested timing and triggers

Continuous operation; at lifecycle and change decisions; periodic management review, with an annual cycle as a suggested starting point.

Evidence examples

QMS procedures and responsibility matrix Lifecycle approval and change records Links to risk, data, testing and monitoring processes Review findings, corrective actions and closure evidence Documented basis for any permitted integration or simplification

How to check this control

Select a released or changed system and trace it through the QMS procedures. Check that responsible people completed required reviews and that an identified gap led to action. Do not treat possession of a QMS manual as proof of operation.