Understand the high-risk provider context.
Article 17 addresses a documented quality management system for high-risk providers, covering activities such as development, testing, data management, monitoring and corrective processes. It permits relevant integration with existing sectoral quality arrangements and recognises proportionate implementation without removing the required rigour.
Determine the applicable scope before introducing a separate set of policies. Existing quality processes may provide a foundation, but their coverage needs to be examined.
Connect written procedures to real decisions.
For each process, identify who performs the work, who reviews it and which record shows the result. A design review, release approval and incident investigation are different events. Their responsibilities and evidence should be specific enough that a new team member can follow them.
Look for gaps between the documented process and actual practice. An unused policy can create false confidence if it is counted as an operating control.
Keep evidence of operation and change.
Maintain the records needed to show that the process was followed for a particular system or release. When a procedure changes, identify the reason, approver and people who need to act differently. Connect recurring findings to improvements rather than closing each issue in isolation.
- Process owners and review authority.
- Design, evaluation and release records.
- Change and exception decisions.
- Corrective actions and evidence of their effectiveness.
Build an achievable operating model.
An EUAIC scope can organise the records and workflow around the agreed quality processes. Start with the lifecycle decisions that need better evidence, then define the information model and review routes that support them. Involve the people responsible for operating the processes.
A governance application does not by itself establish a compliant quality management system or confer certification. The organisation must define, implement and maintain the substantive processes, using appropriate specialist input where needed.