ISO/IEC 42001 and Art. 17: the management system as a programme
The AI management system is the ISO/IEC 42001 programme's records, its Statement of Applicability a tab of that programme; the Art. 17 quality management system stays an obligation whose status is yours.
Where obligations live per system, a quality management system is the umbrella above them: the policies, roles and processes that Art. 17 expects a provider of a high-risk system to run, and that ISO/IEC 42001 turns into a certifiable management system. In Veritome those are two different things, kept apart on purpose.
Art. 17 is an obligation, not the programme
The quality management system is a statutory duty for providers of high-risk systems, so its obligations ship inside the plan as engine obligations — you never buy your own legal obligation back. The per-system Art. 17 obligation sits in the Build & document stage, keeps its own checklist, and its status is yours to set, like every obligation.
When the ISO/IEC 42001 programme is switched on, the Art. 17 obligation's record gains a panel — Your quality management system is documented through these records — listing the ISO/IEC 42001 records with their status, each linking to its document. It explains and pre-fills; it never changes the obligation's status, and nothing ticks an Art. 17 checklist on your behalf.
The management system is the ISO/IEC 42001 programme
The AI management system is built as the ISO/IEC 42001 programme, on its own page under Standards (/programmes/iso42001):
- Steps — the AI policy, roles, the risk and impact methods, objectives, competence, the operational records, internal audit, management review and corrective action, each a step that produces a record. See Programmes: a standard as a path, not a list.
- Statement of Applicability — the 38 Annex A rows, pre-filled from what you did; an exclusion needs a written justification. See The Statement of Applicability, generated from what you did.
- Clauses — clauses 4–10 and where each is handled, read-only.
- Certification facts — the certification body, certificate reference and next surveillance audit, entered by an admin. A certificate is granted by an accredited body, never by Veritome.
The standard's scope statement and target date are set once, on Organisation → Frameworks.
Internal audits and management reviews
They are steps of the programme — the internal audit (clause 9.2) and the management review (clause 9.3), one record shared with ISO/IEC 27001 when both run. Approving one records the review just held and schedules the next a year on; the schedule is listed on Assessments and links back to its step.
How it fits the rest
- Old links to the QMS workspace land on the programme page — on its Statement of Applicability when that is what the link asked for, and on Assessments for the old reviews link. While the standards are switched off they land on Organisation → Frameworks.
- The Act's own text lets a provider already under a sectoral Union-law quality-management duty fold Art. 17 into that system (Art. 17(3)), and deems a financial institution's internal governance rules to fulfil most of it (Art. 17(4)). Those routes are recorded on the Art. 17 obligation and never change its status — and a voluntary standard, ISO/IEC 42001 included, is not sectoral Union law.
- While the frameworks-crosswalk switch is off the programme page is absent; the Art. 17 obligation works exactly as above.