The provider: Art 16 and the quality management system

Lesson 2 of 5 in The Value Chain: Providers, Deployers, Importers, Distributors.

Art 16 is the provider’s table of contents. It does not add new substance so much as gather every provider duty into one enforceable checklist — the list a market surveillance authority will walk down when it knocks. A high-risk provider must:

  1. Ensure Arts 8–15 compliance — the seven requirements you already know (Art 16(a)).
  2. Mark its identity on the system, packaging or documentation: name, trademark, contact address (Art 16(b)).
  3. Run a quality management system (Art 17, via 16(c)).
  4. Keep documentation — technical documentation, QMS documentation, declaration of conformity, notified-body decisions — at the authorities’ disposal for 10 years after placement (Art 18, via 16(d)).
  5. Keep automatically generated logs under its control (Art 19, via 16(e)).
  6. Undergo conformity assessment before placement (Art 43, via 16(f)), draw up a declaration of conformity (Art 47, 16(g)) and affix the CE marking (Art 48, 16(h)).
  7. Register the system in the EU database (Art 49, via 16(i)).
  8. Take corrective action and inform the chain when things go wrong (Art 20, via 16(j)).
  9. Demonstrate compliance on reasoned request of an authority (Art 21, via 16(k)) and meet accessibility requirements (16(l)).

The pivot of the whole list is Art 17. The Act does not trust one-off compliance heroics; it demands a quality management system — written policies, procedures and instructions that make compliance systematic. Its required components read like an ISO management standard, because that is the model: a regulatory-compliance strategy; design and development procedures; testing and validation procedures run before, during and after development; technical standards applied; data management systems covering the full Art 10 pipeline; the Art 9 risk management system; a post-market monitoring system (Art 72); serious-incident reporting procedures (Art 73); communication procedures with authorities and other operators; record-keeping; resource management including security of supply; and an accountability framework naming who is responsible for what.

Two proportionality valves keep this workable. Art 17(2) scales implementation to the provider’s size — and Art 63 lets microenterprises satisfy parts of the QMS in simplified form. Neither valve lowers the substantive Arts 8–15 bar; they only ease how the management shell around it is built. If you are already running an ISO/IEC 42001 management system, you will recognise nearly every Art 17 component — that mapping is the fastest route to Art 17 readiness, and the crosswalk module walks it.

Art 20 — corrective actions: what exactly must a provider do?

A provider that considers or has reason to consider a marketed high-risk system is non-conforming must immediately take corrective action — bring it into conformity, withdraw it, disable it, or recall it — and inform the distributors, and where applicable the deployers, the authorised representative and importers. If the system presents a risk within the meaning of Art 79(1), the provider must immediately investigate (including with the reporting deployer) and inform the market surveillance authorities. Note the trigger: reason to consider, not certainty — waiting for proof is itself a breach.

Art 21 — cooperation: how far does it reach?

On a reasoned request from a competent authority, the provider must supply all information and documentation needed to demonstrate conformity, in an official EU language the authority indicated — and give access to the Art 19 logs under its control. Confidentiality is protected (Art 78), but ‘trade secret’ is not a refusal card: under Art 74 market surveillance authorities can go as deep as source code, conditionally, where documentation fails to resolve the question.

Art 22 — the authorised representative’s real job

Non-EU providers of high-risk systems must appoint an EU-based authorised representative by written mandate before making systems available. The representative verifies the conformity assessment was carried out and the technical documentation drawn up, keeps documentation and contact details at the authorities’ disposal for 10 years, cooperates with authorities, and — the clause with teeth — must terminate the mandate and inform the market surveillance authority if it has reason to consider the provider is acting contrary to the Act. The representative is the Act’s answer to unreachable foreign providers: someone in the Union always answers the door.

Key terms: quality management system (Art 17), CE marking, EU declaration of conformity, post-market monitoring, corrective action

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.