EN 18286 and Article 17 as a Management System

Article 17 of the EU AI Act requires providers of high-risk SI systems to put a quality management system in place, documented in a systematic and orderly manner as policies, procedures and instructions. EN 18286:2026 is the European standard written for that system. Cited in the Official Journal, conformity with the standard can support a presumption of conformity with the Article 17 requirements it covers. The duty is a system. It is not a document pack. Organisations outside the Union meet this duty only where they place systems on the Union market or are otherwise in scope. ISO/IEC 42001 is the international SI management system standard and travels with the organisation wherever it chooses to use it.

What the duty asks for

The person who must operate the QMS is the provider: the person who develops an SI system, or has one developed, and places it on the market or puts it into service under their own name or trademark. That includes a non-EU provider who places systems on the Union market, who must also appoint an authorised representative, and anyone who becomes a provider by branding, by a change of intended purpose, or by a substantial modification.

EN 18286 is product- and lifecycle-centric. The processes it requires control how a high-risk SI system is designed, built, tested, changed, released and monitored. Quality in this standard is not customer satisfaction. It is conformity with the applicable regulatory requirements, health, safety and fundamental rights, at the point the system is placed on the market or put into service, and throughout its subsequent life.

Clause 8.1 asks the provider to run the system through defined, documented processes at every stage of the life cycle. Those processes have to keep the system compliant with regulation, keep it meeting its own requirements, and carry out the actions planned in Clause 6. Annex VI, the internal-control route used by most Annex III providers, requires three things before the declaration is signed: that the QMS conforms to Article 17, that the technical documentation demonstrates the essential requirements, and that the design, development and post-market processes are consistent with that documentation.

What a document pack leaves unbuilt

A file that describes design control, validation, data management, change control and post-market monitoring, written after the system was built and without those processes having run, fails the consistency test. Declining the standard does not open a path in which documents alone are accepted. It leaves the provider to demonstrate the same operational system directly against the Act, without the presumption, and with the full burden of proof.

The processes live in the engineering function that produces the system. A compliance function can interpret the standard, map requirements and check that evidence exists. It cannot execute the design, verification, data and change controls that generate that evidence. A QMS completed only by the compliance function will not demonstrate the lifecycle control the Act and the standard require.

How a management system meets it

The system puts the life cycle into the work. Each SI system is recorded once, with its intended purpose and its key characteristics. Risk, data governance, design records, technical documentation and monitoring belong to that system. Each stage has a gate. The gate checks that the stage's records exist, that verification and validation are done, and that the right roles have signed off. Separation of duties is built in. Quality objectives and the actions from planning are tracked work, with an owner, a due date and a link to the stage where they take effect. Monitoring, incidents and nonconformities feed corrective action, and an approved corrective action creates its own record.

AICOB is the process model underneath. Article 17 and EN 18286 are mapped onto it where the organisation is in scope of them. The platform is the environment the processes run in. For Annex III systems the high-risk duties apply from 2 December 2027. For Annex I products, from 2 August 2028. A system that is substantially modified after those dates without a compliant QMS and a new conformity assessment cannot lawfully stay on the market. Organisations that do not place systems on the Union market are not in scope of these dates.

The IT Governance platform for this system is available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so a selected record can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both forms. Nextcloud is the environment the record stays in.