A process-based QMS built to EN 18286, from inception through deployment and post-market monitoring
Providers of high-risk AI systems must have a quality management system under Article 17 of the EU AI Act (Regulation 2024/1689). That system has to protect health, safety and fundamental rights across the life of the system. EN 18286 is that QMS written as a European standard: processes, procedures and instructions that run along the lifecycle, not a list of forms.
The Institute's AI Quality Management System is built to operate that requirement. It is a process-based QMS. Conformity assessment is the test. Regulatory conformity is an outcome of running the processes, not a separate paperwork exercise.
The platform uses the AI Assurance Institute's Control Objectives for AI Systems (AICOB) process model. AICOB is the operating model that turns governance outcomes into assigned processes, controls, measures and assurance. EN 18286 and Article 17 land on that model. The platform is how those control objectives are applied to a live AI system and how the evidence is kept. A platform without the process model is activity with no test of whether the work was the right work. This page describes the standalone platform. It has the same functionality. It is not delivered inside a Nextcloud environment.
Templates, toolkits and instant downloads still have a place. So do guided workflows, document control and generated files. Those are how the system records work. They are not a substitute for the work.
The Act does not ask the provider to possess a pack of completed templates. It asks for a QMS documented in a systematic and orderly manner as written policies, procedures and instructions, and then used. Those procedures have to cover design and development, data, risk (Article 9), testing and validation, technical documentation, post-market monitoring, serious-incident reporting, resources, and an accountability framework that assigns responsibility.
EN 18286 turns that duty into lifecycle processes. The QMS must establish and maintain the processes that are necessary. It must reference them. They must run. A manual that does not point at named processes is not the QMS the standard describes.
Health, safety and fundamental rights are the outcomes those processes are there to produce and protect. Seven essential requirements sit inside that operation: risk management, data and data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity.
The AI Assurance Institute's EN 18286 QMS is a single environment in which those processes are assigned, run, reviewed and evidenced for high-risk AI systems.
The system covers the EN 18286 QMS in full: from inception of an AI system, through design, development, testing and deployment, to post-market monitoring.
It covers quality management under EN 18286, AI risk management under Article 9 and prEN 18228, and AI cybersecurity under prEN 18282.
Inside that operation the platform still does the practical work people expect:
That is compliance work in the ordinary sense. It is not the definition of the product. The product is the operating QMS. The files are work products of the processes. An assessor samples those processes and those work products. A checklist samples neither.
Quality management (EN 18286). Alignment with the provider's regulatory strategy. Operational processes for design, development, testing and deployment. Traceability from task to policy and objective. Management review.
AI risk management (Article 9 and prEN 18228). Hazard identification and risk scenarios. Acceptability criteria with justification. The risk-control hierarchy with traceability. Residual risk and fundamental-rights impact. The Risk Management File as the record of that work, not as a downloaded blank.
AI cybersecurity (prEN 18282). Threat and vulnerability work specific to AI. Acceptance criteria. Prevent, detect, respond, resolve and control. Support for poisoning resistance, adversarial, confidentiality and model-flaw testing, including composite and red-team testing where that is in scope.
EN 18286 is the spine. AICOB is the process model underneath it. It is not the only instrument the platform has to carry.
Quality management under EN 18286 sits next to AI risk management under Article 9 and prEN 18228, and next to AI cybersecurity under prEN 18282. The essential requirements of the Act, Articles 9 to 15, are addressed through the compliance strategy the standard requires, not as a separate annex filled in at the end. Health, safety and fundamental rights are the outcomes those processes exist to protect.
Other Institute tools plug into the same platform rather than living as separate islands:
The product name changes with the topic. The method does not. Fields are filled by the people who own the duty. The record stays with the system. A second or third party can sample that record. The Institute does not certify the organisation and does not declare it compliant. Those decisions sit with the assessor or the authority.
Onboarding records the system and its intended purpose. A current-state pass maps what already exists against the Act and EN 18286. Implementation follows the processes: QMS, risk, cybersecurity, post-market monitoring. Documentation is produced from the work as it is done. Monitoring continues after placing on the market, with feedback into the same system.
Time is saved because the workflows and generated files sit inside the processes. The burden that drops is duplicate paperwork. The burden that remains is the duty to operate the QMS.
Templates and downloads can exist inside this QMS. They do not replace it.
This is the standalone platform. The same EN 18286 solution is also available on the Nextcloud platform, for organisations that want the QMS inside a European collaboration environment they control. The processes are the same. The choice is the environment.
