A two-day course that walks through the EN 18286:2026 clauses and how each connects to the EU AI Act
This course walks through the EN 18286:2026 clauses. For each requirement it covers what the standard asks for, how it connects to the EU AI Act, and what is needed to demonstrate effective protection and compliance.
Article 17 of the EU AI Act requires providers of high-risk AI systems to operate a quality management system. This two-day course is the map of that duty: what the Act requires a QMS to cover, and how EN 18286 turns those requirements into clauses an organisation can implement and later assess.
Day 1 is foundations and core QMS elements: the mandate, scope, the quality management system itself, leadership, planning and support. Day 2 is implementation, operations and continuous improvement: AI system realization, operations and control, and performance evaluation. The course is taught. It is written for developers, compliance teams and quality managers who have to design or run that system.
Focus: strategy, design of the QMS, risk at system level, and the support the system needs.
When Article 17 applies. What a QMS must be able to show. Regulatory requirements and the approach EN 18286 takes to the Act's essential requirements. How the standard is used as the process language for that showing.
The difference between a documented QMS and operational records. What has to exist as policy, what has to exist as procedure, and what has to exist as evidence that the procedure ran on a named system.
Governance and management of the QMS: roles, responsibilities and the accountability framework. Quality policy as a governing-body instrument that operations have to implement, not a poster.
Risk determination for the QMS itself. Quality objectives. Planning the actions that keep the system proportionate to the AI uses in scope, including substantial modification.
Competence, AI literacy, infrastructure, awareness and communication. What support looks like when the product is an AI system rather than a static device: people who can read model behaviour, infrastructure that can retain logs, and communication that reaches deployers.
Focus: execution, monitoring and post-market obligations.
Actions to address risks through the risk-management system. Life-cycle control from inception and design through development, verification, validation, data management and release. Objective evidence that those activities ran on the system that will be placed on the market.
The life-cycle stages in operation:
How the QMS collects performance in use, handles change and substantial modification, and feeds improvement. How that work joins Article 72 post-market monitoring where the system is high-risk. Incident handling as a QMS process, not an ad hoc channel.
AI developers, compliance teams and quality managers who need the whole Article 17 picture before they specialise in a single clause. The clause-specific days in this category sit under this map.
