ANNEX VII
Compliance based on an assessment of the quality management system and a review of the technical documentation
1. Introduction
Conformity based on an assessment of the quality management system and an assessment of the technical documentation is the conformity assessment procedure based on points 2 to 5.
2. Overview
The quality management system approved under Article 17 for the design, development and testing of AI systems shall be assessed in accordance with point 3 and shall be subject to the supervision referred to in point 5. The technical documentation of the AI system shall be assessed in accordance with point 4.
3. Quality management system
|
3.1. |
The provider's application includes:
|
|
3.2. |
The quality management system shall be assessed by the notified body, which shall determine whether the requirements referred to in Article 17 are met.
The decision shall be communicated to the provider or the provider's agent. This notification includes the conclusions of the quality management system assessment and the reasoned assessment decision. |
|
3.3. |
The approved quality management system shall be implemented and maintained by the provider in such a way that it remains adequate and efficient. |
|
3.4. |
Intended changes to the approved quality management system or the list of AI systems to which the management system applies shall be communicated by the provider to the notified body.
The proposed changes shall be assessed by the notified body, which shall decide whether the modified quality management system continues to satisfy the requirements referred to in Section 3.2 or whether a reassessment is necessary. The notified body shall notify the provider of its decision. This notification shall include the conclusions of the assessment of the changes and the reasoned assessment decision. |
4. Review of technical documentation.
|
4.1. |
In addition to the application referred to in point 3, an application shall be submitted to a notified body of the provider's choice for the assessment of the technical documentation relating to the AI system that the provider intends to place on the market or put into service and to which the quality management system referred to in point 3 applies. |
|
4.2. |
The application includes:
|
|
4.3. |
The technical documentation shall be reviewed by the notified body. When relevant and limited to what is necessary to perform its tasks, the Notified Body shall be granted full access to the training, validation and test data sets used, including, where appropriate and subject to security safeguards, through APIs or other relevant technical means and tools enabling remote access. |
|
4.4. |
In assessing the technical documentation, the notified body may require the provider to provide further evidence or to carry out further tests in order to carry out an appropriate conformity assessment to verify the compliance of the AI system with the requirements of Chapter III, Section 2. If the notified body is not satisfied with the tests carried out by the provider, the notified body shall carry out adequate tests itself, as appropriate. |
|
4.5. |
If necessary to assess the compliance of the high-risk AI system with the requirements of Chapter III, Section 2, after all other reasonable means to verify compliance have been exhausted or proved insufficient, and following a reasoned request, the notified body shall also have access to the training and trained models of the AI system, including its relevant parameters. Such access shall be subject to existing Union law on the protection of intellectual property and trade secrets. |
|
4.6. |
The decision of the notified body shall be notified to the provider or his authorized representative. This notification shall include the conclusions of the assessment of the technical documentation and the reasoned assessment decision.
If the AI system meets the requirements of Chapter III, Section 2, the notified body shall issue a Union Technical Documentation Assessment Certificate. The certificate shall contain the name and address of the provider, the inspection findings, any conditions for the validity of the certificate and the necessary data for the identification of the AI system. The certificate and its annexes contain all relevant information for evaluating the conformity of the AI system and allow the AI system in use to be verified, if applicable. If the AI system does not meet the requirements of Chapter III, Section 2, the notified body shall refuse to issue a Union Technical Documentation Assessment Certificate and shall inform the applicant accordingly, stating the exact reasons for the refusal. If the AI system does not meet the requirement regarding the training data used, the AI system must be re-trained prior to the application for a new conformity assessment. In this case, the notified body's reasoned assessment decision denying the Union Technical Documentation Assessment Certificate shall include the specific considerations regarding the quality data used for training the AI system, in particular on the reasons why they do not comply. |
|
4.7. |
Any changes to the AI system that may affect the AI system's compliance with the requirements or its intended purpose shall be assessed by the notified body that issued the Union Technical Documentation Assessment Certificate. The provider shall inform that notified body of its intention to implement any of the aforementioned changes or when it otherwise becomes aware of the existence of such changes. The notified body shall assess the intended changes and decide whether they require a new conformity assessment in accordance with Article 43(4) or whether an addition to the Union Technical Documentation Assessment Certificate is sufficient. In the latter case, the notified body shall assess the changes, inform the provider of its decision and, if the changes are accepted, issue him with a supplement to the Union Technical Documentation Assessment Certificate. |
5. Monitoring the approved quality management system.
|
5.1. |
The purpose of the surveillance carried out by the notified body referred to in point 3 is to ensure that the provider duly complies with the general conditions of the approved quality management system. |
|
5.2. |
The provider shall enable the notified body to have access for assessment purposes to the site where the design, development and testing of the AI systems takes place. The provider shall further share all necessary information with the notified body. |
|
5.3. |
The notified body shall conduct periodic audits to verify that the provider maintains and applies the quality management system and shall provide the provider with an audit report. As part of these audits, the notified body may conduct additional tests of the AI systems for which a Union Technical Documentation Assessment Certificate has been issued. |
