Article 17: Quality management system
Article 17 addresses the quality management system for providers of high-risk AI systems. Legal counsel should confirm whether the article applies and which procedures are required.
VeriProof can support selected operating records. It does not establish the quality management system on its own.
Evidence mapping
| Procedure | Supporting VeriProof records |
|---|---|
| Post-market monitoring | Defined governance policies, thresholds, session records, and trend data |
| Record keeping | Scoped evidence exports, manifests, and configured provider proofs |
| Exception handling | Assigned work, review decisions, notes, and timestamps |
| Corrective action | Owner, status, remediation record, and decision history |
| Management review | Period summary, open work, evidence gaps, and accepted risk |
Confirm each record exists in the selected release and falls within the approved application scope.
Build the procedure
Choose a procedure and describe how it works in practice. Then document the responsibilities and records:
- Name the accountable owner and reviewer.
- Define the trigger, evidence, and decision criteria.
- Set the review frequency and escalation path.
- Record exceptions and corrective actions.
- Retain the approved evidence package and review outcome.
Investigate an exception
Open the assigned work item and confirm its application, source, and scope. Review the linked session or evidence record when your role permits access.
Record the decision, rationale, owner, and follow-up action in the workflow. Add external analysis when the product record does not contain it.
Prepare evidence
Export the application and period required by the review. Verify the manifest and configured provider proofs before delivery.
Add the customer-owned procedure, approvals, root-cause analysis, corrective action, and submission record. VeriProof does not determine the reporting authority or deadline.