Processes, Procedures and Activities under EN 18286

Overview

This is a one-day taught course on Clause 8 (Operation) of EN 18286. Clause 8 is the operating core of an AI quality management system. It requires the organisation to define, document, implement and control the processes that run across the AI life cycle: design, data governance, verification, deployment, monitoring and decommissioning.

Article 17 of the EU AI Act requires a quality management system for high-risk systems. EN 18286 is the process language for that system. Clause 8 is where those processes have to be real: owned, sequenced, recorded and capable of being followed by someone who was not in the room when they were written.

The day works through what those processes and procedures have to contain, how they attach to the quality policy and measurable quality objectives, and how traceability is shown from requirement to activity to record. Participants work with examples. The course covers the method. Dates are on the training calendar.

What the day covers

• the AI life-cycle processes Clause 8 requires, and how they join the Act's operational duties;
• what a documented procedure has to make operationally clear: purpose, owner, inputs, activities, outputs, records and when it is invoked;
• how each process is read against the organisation's quality policy and quality objectives;
• what a traceability matrix has to prove: end-to-end coverage of EN 18286 Clause 8 and, where it applies, Article 17;
• how process control sits with risk management, data governance and post-market monitoring, rather than as a separate file.

One-day agenda

1. Clause 8 as the engine room

Where Clause 8 sits in EN 18286 relative to leadership, planning and improvement. What "define, document, implement and control" means for a process that already exists in engineering practice. The difference between a process (the sequence of activities) and a procedure (how those activities are carried out). When an activity is in scope for the QMS and when it is only a team habit.

2. AI life-cycle processes

The life-cycle arc the clause expects to see controlled:

• design and intended-purpose definition;
• data governance for data used to build, adapt or operate the system;
• verification, validation and change before release;
• deployment and instructions for use;
• monitoring in operation, including drift and incidents;
• decommissioning and withdrawal from service.

For each stage the course asks the same questions: who owns it, what starts it, what record it leaves, and which Article 17 or Annex IV item it supports when the system is high-risk.

3. Process maps and procedure content

How to draw a process so another competent person can follow it: trigger, activities, decision points, hand-offs, records. How a procedure states competence, tools, acceptance criteria and what happens when the activity cannot be completed as written. Worked examples from design-to-release and from incident-to-corrective-action. The course uses those examples to show structure. It is not a documentation service.

4. Quality policy and quality objectives

Clause 8 processes only earn their keep if they serve the policy and the objectives the organisation has already set. The course maps process outputs to objectives that can be measured: completeness of records, cycle time of change control, coverage of monitoring, closure of nonconformities. An objective that cannot be read from process records is not yet an operational objective.

5. Traceability

What a traceability matrix has to connect: clause and article, process, procedure, activity, record, system or use case. How gaps show up: a clause with no process, a process with no record, a record that cannot be tied to a version of the system. How that matrix is used when an assessor asks how Article 17 is implemented in operation.

6. Joining risk, data and post-market monitoring

Clause 8 does not sit alone. Risk-management outputs change which controls a process must run. Data-governance outputs change which datasets a design or monitoring process may use. Post-market monitoring feeds change and corrective action. The last block of the day is how those three join the life-cycle processes so the QMS is one system, not four files.

Who it is for

• quality and compliance managers building or running an EN 18286 QMS;
• process owners for design, data, test, release, monitoring and withdrawal;
• risk, data-protection and engineering leads whose work has to appear in those processes;
• internal auditors who will test whether Clause 8 is operating.

Format: one day, taught. The course assumes familiarity with EN 18286 or with Article 17. It is not an introduction to the whole standard.