A process-based quality management system, from inception to post-market monitoring, running inside a European collaboration platform
Providers of high-risk AI systems must have a quality management system under Article 17 of the EU AI Act. That system has to protect health, safety and fundamental rights across the life of the system. EN 18286:2026 is the European standard written for that duty. It is a process system: policies, procedures and instructions that run from inception, through design, development, testing and release, and on into post-market monitoring.
DP Services, in partnership with the AI Assurance Institute, delivers the EN 18286 Platform as that system in operation. It is not a document pack and it is not a checklist. It is the working QMS. The Platform now runs inside Nextcloud, so the processes, the records and the people who have to see them sit in one controlled environment rather than in a set of files that have to be emailed, copied and reconciled.
The Platform uses the Control Objectives for AI Systems (AICOB) process model. AICOB is the operating model that turns governance outcomes into assigned processes, controls, measures and assurance. EN 18286 and Article 17 land on that model. The Platform is how those control objectives are applied to a live AI system and how the evidence is kept. A platform without the process model is activity with no test of whether the work was the right work.
The Platform covers the QMS in full. A system is registered with its intended purpose. The regulatory strategy is written and approved. Design and development are controlled. Verification and validation are run against defined acceptance criteria. Data is governed. Risk is assessed and treated. The system is released on a file that matches the work. After placing on the market, performance is monitored, change is assessed, and serious incidents are reported through a procedure rather than an ad hoc channel.
That span is the point. A QMS that starts at the technical file, or that stops at go-live, does not meet Article 17. The processes have to exist while the system is being designed, and they have to keep running after it is in use. The Platform is built for that whole line.
Inside that operation the practical work is still done:
Those are the work products of the processes. An assessor samples the processes and the work products. A checklist samples neither.
EN 18286 is the spine. AICOB is the process model underneath it. It is not the only instrument the Platform has to carry.
Quality management under EN 18286 sits next to AI risk management under Article 9 and prEN 18228, and next to AI cybersecurity under prEN 18282. The essential requirements of the Act, Articles 9 to 15, are addressed through the compliance strategy the standard requires, not as a separate annex that is filled in at the end. Health, safety and fundamental rights are the outcomes those processes exist to protect.
Other Institute tools plug into the same environment rather than living as separate islands:
The product name changes with the topic. The method does not. Fields are filled by the people who own the duty. The record stays with the system. A second or third party can sample that record. The Institute does not certify the organisation and does not declare it compliant. Those decisions sit with the assessor or the authority.
Nextcloud is a European, open-source collaboration platform. It is used by governments and public institutions that have decided their files should not sit in a foreign commercial cloud. The German federal administration runs it at large scale through ITZBund. French ministries, including education, use it. The Austrian federal ministry for economic affairs uses it. The National Assembly of the Republic of Serbia uses it. Dutch research and education infrastructure uses it. The European Commission is among the public bodies that have adopted Nextcloud communication and collaboration tools. It is not a niche product. It is the platform a large part of European public administration has chosen when data has to stay under the organisation's control.
Nextcloud is not a Europe-only product. It is available for use worldwide. Its reputation and its public-sector adoption are strongest in Europe, and it is less widely known outside Europe than the large commercial clouds. That is a matter of familiarity, not of availability. A company anywhere can run it on its own infrastructure, or with a host, and take the same advantages: control of the data, an open code base that can be audited, explicit permissions, and a record that does not have to leave the organisation.
That choice is about sovereignty and scrutiny, not about fashion. Nextcloud can be run on the organisation's own infrastructure, or by a host the organisation chooses, under the organisation's administration. The code is open and can be audited. Nextcloud Files has been awarded the French ANSSI CSPN security certification. Partners operate Nextcloud inside environments certified to the German BSI IT-Grundschutz, which is built on ISO/IEC 27001. An independent reference data protection impact assessment has been published for Nextcloud deployments. None of that makes a deployment automatically compliant. It is why regulated organisations treat Nextcloud as a platform they can defend.
For the Platform, those properties are not decorative. A quality management system produces records that a market surveillance authority, a notified body or an internal auditor may ask to see. Those records should not have to be exported into a mailbox, a shared drive of uncertain provenance, or a third-party workspace the organisation does not control. On Nextcloud they stay in the same environment in which they were created. Permissions are explicit. Access is logged. A version is a version. An external party sees what it has been given, and nothing else.
The practical advantages follow from that:
Nextcloud is the environment we recommend for organisations that want the QMS inside a collaboration platform they can control, and for organisations that will have to show the file to an external party. It is not the only way the solution is delivered. DP Services, in partnership with the AI Assurance Institute, still provides the EN 18286 Platform as a standalone system, for organisations that want the QMS without the Nextcloud environment around it. The processes are the same. The choice is the environment.
A short note, ahead of a fuller article. The Platform includes a Nextcloud workspace for notified bodies. It is not a separate product and it is not a public link. It is a controlled way for a notified body to be given access to the parts of the QMS and the technical documentation it has to examine, inside the same Nextcloud environment the provider already uses.
The advantage is the security of that access. The notified body does not receive a zip file, a set of email attachments, or an account on an unrelated system. It is admitted to a defined workspace, with the permissions the provider sets, over the same Platform that holds the live record. What was shown, to whom, and when, stays in the access history. The file the body examines is the file the QMS produced, not a copy assembled for the visit.
That workspace will be set out in more detail in a separate article. The point for now is that scrutiny does not require the record to leave the system of record.
