SI QMS Management as a Service

The service

This is a service for providers of high-risk SI systems that place systems on the EU market and need the Article 17 quality management system in place, prepared for conformity assessment. IT Governance project-manages the process of completing the EN 18286 QMS with the organisation's own people. The work runs on the EN 18286 software platform.

Article 17 of the EU AI Act requires a documented quality management system that ensures compliance with the Regulation. EN 18286:2026 is the European standard written for that system. Now cited in the Official Journal, conformity with the standard can support a presumption of conformity with Article 17. The service is an experienced partner for that work: the regulatory requirements around Article 17 and EN 18286, applied through the process model the platform is built on. Organisations outside the Union use this service where they place systems on the Union market or are otherwise in scope.

What the service does

IT Governance does not take the provider's accountability. It manages the process, trains the people who have to perform the duties, and advises the people who have to direct and oversee the system.

• Project management of the QMS - the sequence of work from the start of the lifecycle through to a file that is ready for conformity assessment. Scope, intended purpose, classification, design and design control, development and quality control, examination and testing, data management, the Article 9 risk management system, post-market monitoring, serious-incident reporting, record-keeping and the accountability framework.
• Prepared for conformity assessment - the work is organised so that the provider can verify that the quality management system conforms to Article 17, that the technical documentation demonstrates the essential requirements, and that the design, development and post-market processes are consistent with that documentation. Those are the Annex VI checks. The service prepares the record. It does not sign the declaration of conformity.
• Training staff to fulfil their duties - the people who own the steps are trained in the duties the QMS assigns to them, and in how those duties are performed on the platform.
• Advising the board - the governing body is advised on what it has to evaluate, direct and monitor: residual-risk appetite, the regulatory strategy, the accountability framework, and the evidence it should see before a system is placed on the market or put into service.
• Assisting managers with the accountability framework - roles, responsibilities and authorities are planned and recorded against the lifecycle and against the processes. A named owner is not a department. The framework is what an assessor will ask for when ownership is unclear.

How the engagement runs

• Start - the high-risk systems, their intended purpose, and the current state of the QMS are recorded on the platform.
• Plan - the work is sequenced against Article 17 and EN 18286. Owners are assigned. Gates are set.
• Build - the organisation's people complete the processes on the platform. IT Governance project-manages the sequence, trains the owners, and advises where a duty is incomplete.
• Prepare - the technical documentation, the risk management file, the accountability framework and the post-market arrangements are brought to the point at which the provider can examine them for conformity assessment.
• Hand over - the QMS stays with the organisation. The platform remains the environment the processes run in. Ongoing operation, management review and change control stay with the named owners.

Who it is for

• Providers of high-risk SI systems that place systems on the EU market and must put an Article 17 QMS in place
• Teams that need the process project-managed, and their own staff trained to perform the duties
• Boards and managers that need advice on residual risk, the accountability framework, and the evidence a conformity assessment will examine

The service uses the EN 18286 software platform. The platform is the environment the processes run in. The service is the project management, the training and the advice that get the QMS completed and prepared for conformity assessment. IT Governance does not certify the organisation and does not declare it compliant. Those decisions sit with the assessor, the notified body or the authority.