Download Framework
EU AI Act / Article 17 (EN 18286:2026)
EU AI Act obligation for providers of high-risk AI systems to put in place a quality management system (QMS) under Article 17. EN 18286:2026 "Artificial intelligence - Quality management system for EU AI Act regulatory purposes" is the harmonised standard for this obligation: its reference was published in the Official Journal by Commission Implementing Decision (EU) 2026/2274, so under Article 40(1) a QMS that conforms with it is presumed to meet Article 17 to the extent the standard covers it.
Scope of this Atlas framework: it covers the technical evidence a QMS needs, not the QMS itself. The risks and controls are the Article 17(1) requirements that EN 18286:2026 implements, cited from the public text of the EU AI Act, and are limited to the aspects that can be supported by testing the AI system and its data: design verification, quality control, examination, test and validation, data management, risk management testing and post-market monitoring.
The organisational and procedural aspects of Article 17(1) are out of scope and are not modelled as risks: (a) the strategy for regulatory compliance and the management of modifications, (e) the technical specifications and standards applied, (i) serious incident reporting under Article 73, (j) communication with authorities, notified bodies and other parties, (k) record-keeping of documentation, (l) resource management including security of supply, and (m) the accountability framework for management and staff. These still have to be put in place as written policies, procedures and instructions.
Type:
StandardIndustry:
Cross-sector
Domain:
Accountability & GovernancePerformance & ReliabilityPrivacy & Data
Region:
EU
Content:
6 Risks11 Controls
Version: 2026
Framework Definition
Risks and controls associated with the framework
Assessment Layer
Concrete evaluations linked to controls to assess pass or fail
No evaluation mapping defined yet.
RISK
Insufficient design control and verification
Risk that the design of the high-risk AI system is not verified against its intended purpose and the requirements of the EU AI Act before it is built and released.
CONTROL
Design Verification
Verify that the system design, including its components, tools and human oversight points, behaves as specified for its intended purpose.
RISK
Insufficient development quality control and assurance
Risk that defects introduced during development of the high-risk AI system are not detected before release.
CONTROL
Development Quality Control
Apply quality control and quality assurance checks to the AI system as it is developed, including the handling of its inputs, outputs and dependencies.
RISK
Inadequate examination, test and validation
Risk that the high-risk AI system is not examined, tested and validated sufficiently, or often enough, across its lifecycle.
CONTROL
Testing During Development
Examine and test the AI system before and during its development.
CONTROL
Validation After Development
Validate the finished AI system, and repeat the validation at a defined frequency.
RISK
Inadequate data management
Risk that the data used to build the high-risk AI system is collected, prepared or kept in a way that degrades its quality, representativeness or integrity.
CONTROL
Data Acquisition and Collection
Ensure acquired and collected data is accurate, complete and free from poisoning.
CONTROL
Data Analysis and Labelling
Analyse data for representativeness, bias and drift, and ensure labels are correct.
CONTROL
Data Filtration, Mining and Aggregation
Ensure data is filtered, deduplicated and aggregated without introducing errors or sensitive content.
CONTROL
Data Storage and Retention
Ensure stored and retained data, including knowledge bases used at runtime, keeps its integrity.
RISK
Ineffective risk management testing
Risk that the risks of the high-risk AI system are not identified and measured through testing as part of the risk management system referred to in Article 9.
CONTROL
Risk-Based Testing
Test the AI system to identify the most appropriate risk management measures and confirm it performs consistently for its intended purpose.
CONTROL
Predefined Metrics and Thresholds
Test the AI system against metrics and thresholds defined in advance for its intended purpose.
RISK
Ineffective post-market monitoring
Risk that degradation of the high-risk AI system after it is placed on the market goes undetected.
CONTROL
Continuous Compliance Evaluation
Re-evaluate the deployed AI system against the requirements of the EU AI Act throughout its lifetime.