EU AI Act Article 17 requires providers of high-risk AI systems to establish a Quality Management System. These templates provide a starting point — adapt them to your organization.
| Template | EU AI Act Reference | Purpose |
|---|---|---|
| Model Training SOP | Art. 17(1)(b)(c)(d) | Standard procedure for fine-tuning approval, execution, and validation |
| Data Management SOP | Art. 17(1)(f), Art. 10 | Data collection, annotation, quality assurance, and governance |
| Incident Response SOP | Art. 17(1)(h)(i) | Handling model failures, safety incidents, and corrective actions |
| Change Management SOP | Art. 17(1)(b)(c) | Versioning, review, approval, and rollback procedures |
| Roles & Responsibilities | Art. 17(1)(m) | AI Officer, Data Steward, ML Engineer, Compliance Officer roles |
| Access Control | Art. 17(1)(c) + ISO A.5.15-A.8.5 | Operator identity + secret rotation (Wave 4 / Faz 23) |
| Encryption at Rest | Art. 17(1)(c) + ISO A.5.33 + A.8.10 + A.8.24 | Substrate-side encryption guidance (Wave 4 / Faz 23) |
| Risk Treatment Plan | Art. 17(1)(c) + ISO A.5.7-A.8.30 | ISO 27005 risk register template (Wave 4 / Faz 23) |
| Statement of Applicability | Art. 17(1)(c) + ISO 6.1.3 d) | 93-control applicability matrix (Wave 4 / Faz 23) |
- Copy these templates to your internal documentation system
- Replace
[YOUR ORGANIZATION]with your company name - Assign real names to each role
- Review and approve with your legal/compliance team
- Reference ForgeLM's automated artifacts as evidence
- Compliance summary — concise EU AI Act + ISO + SOC 2 evidence map.
- ISO / SOC 2 deployer guide — Wave 4 audit cookbook.
- Audit event catalog — full event vocabulary.
| QMS Requirement | ForgeLM Artifact | Generated By |
|---|---|---|
| Training records | compliance_report.json |
forgelm --config job.yaml |
| Data provenance | data_provenance.json |
Automatic per run |
| Evaluation evidence | benchmark_results.json, safety_results.json |
Automatic per run |
| Model identity | model_integrity.json |
Automatic per run |
| Audit trail | audit_log.jsonl |
Automatic per run |
| Risk assessment | risk_assessment.json |
From config risk_assessment: section |
| Deployer instructions | deployer_instructions.md |
Automatic per run |