EU regulatory register · AI Act
Article 17Quality management system
CELEX 32024R1689 · Read on 2026-08-18 · Chapter III
Short answer
1. Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects:
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/ai-act-2024-1689/artikel-17 · Short answer as data · Official text
AI Act in short
Some AI uses are banned, high-risk AI requires risk management and human oversight, and deployers must ensure AI literacy.
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects:
(a)
a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system;
(b)
techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system;
(c)
techniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system;
(d)
examination, test and validation procedures to be carried out before, during and after the development of the high-risk AI system, and the frequency with which they have to be carried out;
(e)
technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements;
(f)
systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purpose of the placing on the market or the putting into service of high-risk AI systems;
(g)
The article continues in the official text.
Follow-up questions
Other articles in this chapter
Knowledge card
- Applies
- provider: Operate a quality management system.
- Risk if ignored
- high
- What to do
- Operate a quality management system.
- Deadline
- Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).
card:eu:article:ai-act--art-17 · sha256 6fa4bc992bc3 · Source: NovaCopilot
Obligations, actions and sanctions
Article 17 · Role: provider
Operate a quality management system.
Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).
Decision chain (JSON)
Sanction: Administrative fine: prohibited practices up to EUR 35 million or 7 % of worldwide annual turnover; other obligations up to EUR 15 million or 3 %; incorrect information up to EUR 7.5 million or 1 %. For general-purpose AI models the Commission (AI Office) decides, up to EUR 15 million or 3 %.
Summary of the obligation in the register; the official language versions on EUR-Lex are authoritative. Source: NovaCopilot
Risk, sanction and outcome
Art. 17 · provider
Risk: high · Sanction: administrative_fine, högst EUR 15 000 000 · Authority: Market surveillance authority
Decisions applying the provision: none in the register
Full chain (JSON)
Outcomes are counted from stored judgments that cite the provision verbatim. Source: NovaCopilot
Recitals that carry the interpretation
The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.
Skäl 97 · Article 17
Quality management systems for providers: documentation, allocation of responsibility and compliance control.
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit