{
 "$id": "https://sebbi.pro/en-18286.json",
 "title": "EN 18286:2026 evidence record (sebbi.pro open format)",
 "version": "1.2.0",
 "standard": "EN 18286:2026 Artificial intelligence - Quality management system for EU AI Act regulatory purposes",
 "cited_by": "Commission Implementing Decision (EU) 2026/2274",
 "official_journal": "2026-10-14",
 "source": "https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj",
 "presumption_of_conformity": [
  "AI Act Article 17(1)",
  "AI Act Article 11(1), first sentence"
 ],
 "how_to_use": "Build one JSON object whose keys are the 'field' values below. POST {\"org\": \"...\", \"record\": {...}} to https://sebbi.pro/x/en18286/assess for a sealed score, or run sebbi_run_framework with framework=en18286 from any MCP client connected to https://sebbi.pro/mcp.",
 "publisher": "Monop Content (sebbi.pro)",
 "licence": "Free to use and implement.",
 "controls": [
  {
   "id": "sebbi_en18286_001",
   "ref": "Cl.4",
   "control": "quality management system established and documented",
   "field": "qms_documented",
   "passes_when": "true / yes",
   "good_evidence": "A written quality management system for your high-risk AI, approved and in use."
  },
  {
   "id": "sebbi_en18286_002",
   "ref": "Cl.4",
   "control": "applicable AI Act requirements identified",
   "field": "regulatory_requirements",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A register of the AI Act requirements that apply to each system (Articles 8 to 15, 17, 72, 73)."
  },
  {
   "id": "sebbi_en18286_003",
   "ref": "Cl.4",
   "control": "QMS scope defined",
   "field": "qms_scope",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A scope statement: which AI systems, sites and life-cycle stages the QMS covers."
  },
  {
   "id": "sebbi_en18286_004",
   "ref": "Cl.4 / Art.17(1)(a)",
   "control": "regulatory compliance strategy incl. conformity assessment",
   "field": "compliance_strategy",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Your route to conformity: which conformity assessment you use and how changes are re-assessed."
  },
  {
   "id": "sebbi_en18286_005",
   "ref": "Cl.4",
   "control": "documented information controlled",
   "field": "document_control",
   "passes_when": "true / yes",
   "good_evidence": "Version control for QMS documents: owner, approval, date, and where the current copy lives."
  },
  {
   "id": "sebbi_en18286_006",
   "ref": "Cl.5",
   "control": "top management commitment",
   "field": "leadership_commitment",
   "passes_when": "true / yes",
   "good_evidence": "Signed top-management commitment to the QMS and AI Act compliance."
  },
  {
   "id": "sebbi_en18286_007",
   "ref": "Cl.5",
   "control": "quality policy",
   "field": "quality_policy",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A short quality policy for AI that names compliance with the AI Act as an objective."
  },
  {
   "id": "sebbi_en18286_008",
   "ref": "Cl.5",
   "control": "roles, responsibilities and authorities assigned",
   "field": "qms_roles",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Named people for each QMS role, with what they are responsible and accountable for."
  },
  {
   "id": "sebbi_en18286_009",
   "ref": "Cl.5 / Art.17(1)(m)",
   "control": "accountability framework",
   "field": "accountability_framework",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Who signs off what: an accountability chart for management and staff (Art. 17(1)(m))."
  },
  {
   "id": "sebbi_en18286_010",
   "ref": "Cl.6",
   "control": "risks to the QMS itself addressed",
   "field": "qms_risks",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A list of risks to the QMS working as intended, with owners and actions."
  },
  {
   "id": "sebbi_en18286_011",
   "ref": "Cl.6",
   "control": "quality objectives set",
   "field": "quality_objectives",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Measurable quality objectives with targets and review dates."
  },
  {
   "id": "sebbi_en18286_012",
   "ref": "Cl.7 / Art.17(1)(l)",
   "control": "resource management incl. security of supply",
   "field": "resource_management",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Resource plan including security of supply for data, compute and key suppliers."
  },
  {
   "id": "sebbi_en18286_013",
   "ref": "Cl.7",
   "control": "staff competence evidenced",
   "field": "competence_records",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Training and competence records for staff working on the AI system."
  },
  {
   "id": "sebbi_en18286_014",
   "ref": "Cl.7 / Art.17(1)(j)",
   "control": "communication with authorities and notified bodies",
   "field": "authority_communication",
   "passes_when": "true / yes",
   "good_evidence": "A procedure for dealing with market surveillance authorities and notified bodies."
  },
  {
   "id": "sebbi_en18286_015",
   "ref": "Cl.8.1",
   "control": "AI system life cycle defined",
   "field": "lifecycle_stage",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A defined AI life cycle (design to retirement) with the current stage recorded."
  },
  {
   "id": "sebbi_en18286_016",
   "ref": "Cl.8.2 / Art.17(1)(g)",
   "control": "life-cycle risk management system",
   "field": "risk_management",
   "passes_when": "true / yes",
   "good_evidence": "A risk management system that runs across the whole life cycle (Art. 9)."
  },
  {
   "id": "sebbi_en18286_017",
   "ref": "Cl.8.3 / Art.17(1)(b)",
   "control": "design and design control",
   "field": "design_controls",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Design inputs, reviews and design-change control for the AI system."
  },
  {
   "id": "sebbi_en18286_018",
   "ref": "Cl.8.4 / Art.17(1)(d)",
   "control": "verification and validation before release",
   "field": "verification_validation",
   "passes_when": "true / yes",
   "good_evidence": "Test, verification and validation done before release, with results and acceptance criteria."
  },
  {
   "id": "sebbi_en18286_019",
   "ref": "Cl.8.5 / Art.17(1)(f)",
   "control": "data management procedures",
   "field": "data_management",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Data management procedures: collection, labelling, storage, filtering, retention (Art. 10)."
  },
  {
   "id": "sebbi_en18286_020",
   "ref": "Cl.8.6",
   "control": "retirement plan and deployer measures",
   "field": "retirement_plan",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A retirement plan, including what each deployer must do when the system is withdrawn."
  },
  {
   "id": "sebbi_en18286_021",
   "ref": "Cl.8.7",
   "control": "unique reference for each assessed version",
   "field": "version_reference",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A unique reference for every version that went through conformity assessment."
  },
  {
   "id": "sebbi_en18286_022",
   "ref": "Cl.8.8",
   "control": "pre-determined changes documented",
   "field": "predetermined_changes",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Changes planned at design time for continuous learning, documented with how each is validated."
  },
  {
   "id": "sebbi_en18286_023",
   "ref": "Cl.8.9 / Art.11(1)",
   "control": "technical documentation before market",
   "field": "technical_documentation",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "Technical documentation (Annex IV) drawn up before release and kept up to date."
  },
  {
   "id": "sebbi_en18286_024",
   "ref": "Cl.9.1",
   "control": "unique identifier for each system placed on the market",
   "field": "system_identifier",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A unique identifier on every system placed on the market, traceable through distribution."
  },
  {
   "id": "sebbi_en18286_025",
   "ref": "Cl.9.2",
   "control": "deployer support and risk feedback channel",
   "field": "feedback_channel",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A support and feedback channel where deployers and users can report risks."
  },
  {
   "id": "sebbi_en18286_026",
   "ref": "Cl.9.3",
   "control": "supply chain controls",
   "field": "supplier_register",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A supplier register with controls on third-party components, data and models."
  },
  {
   "id": "sebbi_en18286_027",
   "ref": "Cl.9.4 / Art.17(1)(a)",
   "control": "modification management",
   "field": "change_management",
   "passes_when": "true / yes",
   "good_evidence": "A modification procedure: how changes are assessed, approved and recorded."
  },
  {
   "id": "sebbi_en18286_028",
   "ref": "Cl.9.5 / Art.17(1)(h)",
   "control": "post-market monitoring",
   "field": "post_market_monitoring",
   "passes_when": "true / yes",
   "good_evidence": "A post-market monitoring plan with the data collected and how it feeds back (Art. 72)."
  },
  {
   "id": "sebbi_en18286_029",
   "ref": "Cl.9.6 / Art.17(1)(i)",
   "control": "serious incident reporting procedure",
   "field": "incident_reporting",
   "passes_when": "true / yes",
   "good_evidence": "A serious-incident procedure with the 2, 10 and 15-day reporting clocks (Art. 73)."
  },
  {
   "id": "sebbi_en18286_030",
   "ref": "Cl.9.6",
   "control": "serious incident reported within 15 days",
   "field": "incident_report_days",
   "passes_when": "a number from 0 to 15",
   "good_evidence": "Your longest time to report a serious incident, in days. 15 or fewer passes."
  },
  {
   "id": "sebbi_en18286_031",
   "ref": "Cl.9.7",
   "control": "non-compliance action (comply, withdraw, disable or recall)",
   "field": "corrective_action",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A non-compliance procedure: bring into compliance, withdraw, disable or recall, and inform authorities."
  },
  {
   "id": "sebbi_en18286_032",
   "ref": "Art.17(1)(k)",
   "control": "record-keeping system",
   "field": "record_keeping",
   "passes_when": "true / yes",
   "good_evidence": "A record-keeping system for all QMS documentation and records (Art. 17(1)(k))."
  },
  {
   "id": "sebbi_en18286_033",
   "ref": "Art.12",
   "control": "automatic logging feeding QMS records",
   "field": "logging_enabled",
   "passes_when": "true / yes",
   "good_evidence": "Automatic event logging switched on in the AI system itself (Art. 12), feeding your records."
  },
  {
   "id": "sebbi_en18286_034",
   "ref": "Art.18",
   "control": "QMS documentation kept >= 10 years",
   "field": "record_retention_years",
   "passes_when": "a number >= 10",
   "good_evidence": "How many years QMS documentation is kept. 10 or more passes (Art. 18)."
  },
  {
   "id": "sebbi_en18286_035",
   "ref": "Cl.10.1",
   "control": "last management review date",
   "field": "management_review_date",
   "passes_when": "an ISO-8601 date",
   "good_evidence": "The date of your last management review of the QMS."
  },
  {
   "id": "sebbi_en18286_036",
   "ref": "Cl.10.2",
   "control": "change planning recorded",
   "field": "change_planning",
   "passes_when": "any non-empty value (a document link, name or summary)",
   "good_evidence": "A record of planned changes to the QMS and how they will be carried out."
  }
 ]
}