A process-based QMS built to EN 18286, from inception through deployment and post-market monitoring.
Providers of high-risk AI systems must have a quality management system under Article 17 of the EU AI Act (Regulation (EU) 2024/1689). That system has to protect health, safety and fundamental rights across the life of the system. EN 18286 is that QMS written as a European standard: processes, procedures and instructions that run along the lifecycle, not a list of forms.
The AI Quality Management System is built to operate that requirement. It is a process-based QMS. Conformity assessment is the test. Regulatory conformity is an outcome of running the processes, not a separate paperwork exercise.
For a South African organisation the duty only arises if you are a provider placing a high-risk system on the Union market, or putting one into service there. POPIA still governs any personal information in the same system. This page is the QMS that Article 17 asks for. It is not a substitute for the POPIA file.
Templates, toolkits and instant downloads still have a place. So do guided workflows, document control and generated files. Those are how the system records work. They are not a substitute for the work.
The Act does not ask the provider to possess a pack of completed templates. It asks for a QMS documented in a systematic and orderly manner as written policies, procedures and instructions, and then used. Those procedures have to cover design and development, data, risk (Article 9), testing and validation, technical documentation, post-market monitoring, serious-incident reporting, resources, and an accountability framework that assigns responsibility.
EN 18286 turns that duty into lifecycle processes. The QMS must establish and maintain the processes that are necessary. It must reference them. They must run. A manual that does not point at named processes is not the QMS the standard describes.
Health, safety and fundamental rights are the outcomes those processes are there to produce and protect. Seven essential requirements sit inside that operation: risk management, data and data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity.
The EN 18286 QMS is a single environment in which those processes are assigned, run, reviewed and evidenced for high-risk AI systems.
The system covers the EN 18286 QMS in full: from inception of an AI system, through design, development, testing and deployment, to post-market monitoring.
It covers quality management under EN 18286, AI risk management under Article 9 and prEN 18228, and AI cybersecurity under prEN 18282.
Inside that operation the platform still does the practical work people expect:
That is compliance work in the ordinary sense. It is not the definition of the product. The product is the operating QMS. The files are work products of the processes. An assessor samples those processes and those work products. A checklist samples neither.
Quality management (EN 18286). Alignment with the provider's regulatory strategy. Operational processes for design, development, testing and deployment. Traceability from task to policy and objective. Management review.
AI risk management (Article 9 and prEN 18228). Hazard identification and risk scenarios. Acceptability criteria with justification. The risk-control hierarchy with traceability. Residual risk and fundamental-rights impact. The Risk Management File as the record of that work, not as a downloaded blank.
AI cybersecurity (prEN 18282). Threat and vulnerability work specific to AI. Acceptance criteria. Prevent, detect, respond, resolve and control. Support for poisoning resistance, adversarial, confidentiality and model-flaw testing, including composite and red-team testing where that is in scope.
Onboarding records the system and its intended purpose. A current-state pass maps what already exists against the Act and EN 18286. Implementation follows the processes: QMS, risk, cybersecurity, post-market monitoring. Documentation is produced from the work as it is done. Monitoring continues after placing on the market, with feedback into the same system.
Time is saved because the workflows and generated files sit inside the processes. The burden that drops is duplicate paperwork. The burden that remains is the duty to operate the QMS.
Templates and downloads can exist inside this QMS. They do not replace it.
