E013—Implement quality management system

>Control Description

Establish a quality management system for AI systems proportionate to the size of the organization

Application

Optional

Frequency

Every 12 months

Capabilities

Universal

>Controls & Evidence (5)

Operational Practices

E013.1

Documentation: Quality objectives and risk management

Core - This should include:

- Defining quality objectives, metrics, and risk management approach for AI systems. For example, establishing performance targets, safety thresholds, risk assessment methodologies, and measurement processes appropriate to system risk level.

Typical evidence: Documentation showing quality objectives, metrics, and risk management approach - may include quality metrics dashboard or reports, risk assessment documentation for AI systems, performance targets and safety thresholds, or measurement methodologies defining how quality is evaluated.

Location: Internal policies

E013.2

Documentation: Change management procedures

Core - This should include:

- Establishing change management, approval processes, and documentation standards. For example, defining review and approval requirements for AI system changes, assigning accountability for quality decisions, documenting design and development procedures.

Typical evidence: Documentation showing change management and approval processes - may include change approval workflows or procedures, RACI matrix assigning accountability for quality decisions, design and development procedure documents, or documentation standards and templates for AI systems. May be fulfilled by evidence submitted to E004: Assign accountability.

Location: Internal policies

E013.4

Documentation: Data management procedures

Supplemental - This may include:

- Establishing data management and record-keeping systems. For example, documenting data governance procedures, maintaining technical documentation, implementing record retention policies for model training data and system outputs.

Typical evidence: Documentation showing data management and record-keeping practices - may include data governance policies, technical documentation standards, record retention procedures, or data lineage tracking systems for training data and system outputs.

Location: Internal policies

E013.5

Documentation: Stakeholder communication procedures

Supplemental - This may include:

- Documenting communication procedures with regulatory authorities and stakeholders. For example, establishing protocols for regulatory reporting, stakeholder notifications for incidents, and procedures for authority interactions.

Typical evidence: Procedures document or communication protocols - may include incident reporting templates or protocols to regulatory authorities, stakeholder notification procedures for serious incidents, guidelines for interacting with competent authorities or notified bodies, or escalation procedures for regulatory communications.

Location: Internal processes

Technical Implementation

E013.3

Config: Issue tracking and monitoring

Core - This should include:

- Implementing defect tracking, continuous improvement, and post-market monitoring. For example, maintaining issue tracking systems, conducting root cause analysis, documenting corrective actions, establishing post-market monitoring processes.

Typical evidence: Screenshot of issue tracking system or monitoring records - may include issue tracker (Jira, Linear, GitHub) with defects and corrective actions, root cause analysis reports, post-market monitoring logs or dashboards, or continuous improvement documentation showing lessons learned.

Location: Engineering Tooling

>Cross-Framework Mappings

NIST AI RMF

GOVERN-4.2

MAP-5.1

MANAGE-4.3

Ask AI

Configure your API key to use AI features.