AI Assurance Institute Logo AI Assurance Institute

EN 18286 QMS

EN 18286 AI System Requirements

One-day course on Clause 4: context, scope and the QMS as a system

Overview

Clause 4 of EN 18286 is the foundation of the QMS. It requires the organisation to understand its context, determine the scope of the quality management system, set system requirements, and show how the processes relate to each other.

When the product is an AI system, those decisions are easy to get wrong. Scope that is too wide cannot be operated. Scope that is too narrow leaves a high-risk use outside the QMS. This one-day course covers how to draw the boundary and how to show process relationships across the life cycle.

Duration: one day. Format: taught course. Dates are on the training calendar.

Context of the organisation

Interested parties for an AI QMS: the governing body, users, people affected by the system, regulators, notified bodies, deployers and suppliers. Legal duties that sit next to the Act, including GDPR where personal data is processed. AI uses that belong inside the QMS and uses that sit beside it.

Scope and boundaries

Determining and documenting QMS scope. Which high-risk systems are in. Which sites, teams and suppliers are in. Where a general-purpose model, a fine-tune or a third-party component sits relative to that boundary. How a change of intended purpose forces a review of scope.

System requirements and process relationships

Requirements that stay proportionate, product-centric and life-cycle oriented. Mapping how processes interact across design, data, verification, release, monitoring and withdrawal. A process with no upstream trigger, or no downstream record, is a gap in Clause 4, not only in Clause 8.

Traceability from clause to record

How EN 18286 clauses connect to Article 17 items and then to the records those processes produce. A clause with no process, a process with no record, or a record that cannot be tied to a version of the system, is visible once that chain is drawn.

Joining risk, data and post-market monitoring

Clause 4 does not invent those processes; it requires them to appear as part of one system. The last block is how risk management, data governance and post-market monitoring are named in the scope and in the process map so they are not three parallel files.

Who it is for

Quality managers and architects of the QMS who will write the scope and the process map. Product and compliance leads who must say which AI uses sit inside that scope. Fundamentals or the two-day Overview are the usual prior days.

Register for upcoming training