qms

Quality Management System (QMS) Templates

EU AI Act Article 17 requires providers of high-risk AI systems to establish a Quality Management System. These templates provide a starting point — adapt them to your organization.

Templates

Template	EU AI Act Reference	Purpose
Model Training SOP	Art. 17(1)(b)(c)(d)	Standard procedure for fine-tuning approval, execution, and validation
Data Management SOP	Art. 17(1)(f), Art. 10	Data collection, annotation, quality assurance, and governance
Incident Response SOP	Art. 17(1)(h)(i)	Handling model failures, safety incidents, and corrective actions
Change Management SOP	Art. 17(1)(b)(c)	Versioning, review, approval, and rollback procedures
Roles & Responsibilities	Art. 17(1)(m)	AI Officer, Data Steward, ML Engineer, Compliance Officer roles
Access Control	Art. 17(1)(c) + ISO A.5.15-A.8.5	Operator identity + secret rotation (Wave 4 / Faz 23)
Encryption at Rest	Art. 17(1)(c) + ISO A.5.33 + A.8.10 + A.8.24	Substrate-side encryption guidance (Wave 4 / Faz 23)
Risk Treatment Plan	Art. 17(1)(c) + ISO A.5.7-A.8.30	ISO 27005 risk register template (Wave 4 / Faz 23)
Statement of Applicability	Art. 17(1)(c) + ISO 6.1.3 d)	93-control applicability matrix (Wave 4 / Faz 23)

How to Use

1. Copy these templates to your internal documentation system
2. Replace [YOUR ORGANIZATION] with your company name
3. Assign real names to each role
4. Review and approve with your legal/compliance team
5. Reference ForgeLM's automated artifacts as evidence

See also

• Compliance summary — concise EU AI Act + ISO + SOC 2 evidence map.
• ISO / SOC 2 deployer guide — Wave 4 audit cookbook.
• Audit event catalog — full event vocabulary.

ForgeLM Automated Artifacts (Maps to QMS)

QMS Requirement	ForgeLM Artifact	Generated By
Training records	compliance_report.json	forgelm --config job.yaml
Data provenance	data_provenance.json	Automatic per run
Evaluation evidence	benchmark_results.json, safety_results.json	Automatic per run
Model identity	model_integrity.json	Automatic per run
Audit trail	audit_log.jsonl	Automatic per run
Risk assessment	risk_assessment.json	From config risk_assessment: section
Deployer instructions	deployer_instructions.md	Automatic per run