Quality Management (QMS): ISO/IEC 42001 controls and Art. 17
Stand up an AI management system on the ISO/IEC 42001 Annex A control catalog, track control status across four lifecycle groups, and let completed controls tick your Art. 17 checklists automatically.
Governance & QMS → Quality Management is the organisation-wide AI management system (AIMS) workspace. Where obligations live per system, the QMS is the umbrella above them: the policies, roles and processes that Art. 17 expects a provider of high-risk AI to run as a quality management system.
Available on Growth and above. Lower plans see the workspace locked with an upgrade prompt — nothing is hidden, just gated.
The control catalog
Veritome ships a paraphrased ISO/IEC 42001:2023 Annex A control catalog (the control keys mirror the Annex A numbering, so an auditor can follow along). Controls are grouped by where they bite in the AI lifecycle:
- Govern — scope, objectives, roles, risk criteria: how the AIMS itself is set up.
- Operate — how controls are implemented in the AI lifecycle day to day.
- Evaluate — monitoring, internal audit, impact-assessment cadence.
- Improve — nonconformities, corrective actions, continual improvement.
Each control has a status you set as you implement it, an owner, and space for notes. The matrix view shows the whole catalog at a glance — what's implemented, what's in progress, what hasn't been started.
The Art. 17 sync
The reason the QMS lives inside your compliance tool rather than in a spreadsheet: completed QMS controls tick the matching items on your Art. 17 obligation checklists, org-wide. Implement "AI policy" once at the management-system level and every high-risk system's Art. 17 checklist reflects it. The sync is deliberately tick-only — it never un-ticks work you recorded manually, so a QMS re-organisation can't silently regress a system's compliance record.
How it fits the rest
- The per-system Art. 17 obligation (Implement phase) stays the compliance record; the QMS workspace is where the underlying management system is actually built and maintained.
- QMS controls make natural evidence: an approved policy or audit report uploaded once can satisfy obligations across many systems — see The Evidence hub.
- If you're pursuing (or claiming alignment with) ISO/IEC 42001 certification, the control statuses here are your gap analysis.