> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/mica.wtf/ai-act/chapter-iii-high-risk-ai-systems-art.-6-49/17.md). # Art. 17 — Quality management system 1. Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects: 1. a strategy for regulatory compliance, including compliance with [conformity assessment](https://headlesslaw.com/definitions/ai-act/conformity-assessment/) procedures and procedures for the management of modifications to the high-risk [AI system](https://headlesslaw.com/definitions/ai-act/ai-system/); 2. techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system; 3. techniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system; 4. examination, test and validation procedures to be carried out before, during and after the development of the high-risk AI system, and the frequency with which they have to be carried out; 5. technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements; 6. systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purpose of the [placing on the market](https://headlesslaw.com/definitions/ai-act/placing-on-the-market/) or the [putting into service](https://headlesslaw.com/definitions/ai-act/putting-into-service/) of high-risk AI systems; 7. the risk management system referred to in [Article 9](/mica.wtf/ai-act/chapter-iii-high-risk-ai-systems-art.-6-49/9.md); 8. the setting-up, implementation and maintenance of a [post-market monitoring system](https://headlesslaw.com/definitions/ai-act/post-market-monitoring-system/), in accordance with [Article 72](/mica.wtf/ai-act/chapter-ix-post-market-monitoring-information-sharing-and-market-surveillance-art.-72-94/72.md); 9. procedures related to the reporting of a [serious incident](https://headlesslaw.com/definitions/ai-act/serious-incident/) in accordance with [Article 73](/mica.wtf/ai-act/chapter-ix-post-market-monitoring-information-sharing-and-market-surveillance-art.-72-94/73.md); 10. the handling of communication with national competent authorities, other relevant authorities, including those providing or supporting the access to data, notified bodies, other operators, customers or other interested parties; 11. systems and procedures for record-keeping of all relevant documentation and information; 12. resource management, including security-of-supply related measures; 13. an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listed in this paragraph. 2. The implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the [provider](https://headlesslaw.com/definitions/ai-act/provider/)’s organisation. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation. 3. Providers of high-risk AI systems that are [subject](https://headlesslaw.com/definitions/ai-act/subject/) to obligations regarding quality management systems or an equivalent function under relevant sectoral Union law may include the aspects listed in paragraph 1 as part of the quality management systems pursuant to that law. 4. For providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the obligation to put in place a quality management system, with the exception of paragraph 1, points (g), (h) and (i) of this Article, shall be deemed to be fulfilled by complying with the rules on internal governance arrangements or processes pursuant to the relevant Union financial services law. To that end, any harmonised standards referred to in [Article 40](/mica.wtf/ai-act/chapter-iii-high-risk-ai-systems-art.-6-49/40.md) shall be taken into account. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/mica.wtf/ai-act/chapter-iii-high-risk-ai-systems-art.-6-49/17.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.