Skip to content
spilma
FREN

AI Act: EN 18286 is the first harmonised standard cited

updated 16 Oct 20267 min read

The AI Act has its first harmonised standard. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, published in the Official Journal L series on 14 October 2026, publishes the reference of EN 18286:2026, "Artificial intelligence - Quality management system for EU AI Act regulatory purposes". The decision entered into force on the day of its publication. The presumption of conformity it opens is narrow: it concerns the quality management system that providers of high-risk AI systems must run under Article 17 of Regulation (EU) 2024/1689. The exact clauses it supports are mapped in the standard's own Annex ZA, which is sold by the standards bodies and is not reproduced in the decision.

In short:

  • One standard, one subject. The annex of the decision lists a single entry, EN 18286:2026, with no restriction or note attached.
  • It answers point 9 of the standardisation request C(2025) 3871: quality management systems for providers of AI systems, including post-market monitoring processes.
  • Presumption runs from 14 October 2026, the date the reference was published, which is why the decision entered into force that same day.
  • It is not a standard for risk management, data governance, logging, transparency, human oversight, accuracy, robustness or cybersecurity. No harmonised standard dedicated to those Section 2 requirements is cited yet.
  • The obligation itself is still deferred. Article 17 sits in Chapter III, Section 3, which applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

What the decision says

Section titled “What the decision says”

The decision is short: six recitals, two articles and a one-line annex. It is adopted under Article 10(6) of Regulation (EU) No 1025/2012 on European standardisation, the provision under which the Commission publishes references of harmonised standards.

The recitals trace the chain. By Implementing Decision C(2025) 3871 of 23 June 2025, which repealed the earlier request C(2023) 3215, the Commission asked CEN and Cenelec to draft harmonised standards in support of the AI Act (recital 2). CEN and Cenelec completed the work requested under point 9 of Annex I to that request, on "quality management systems for providers of AI systems, including post-market monitoring processes", which resulted in the adoption of EN 18286:2026 (recital 3). The Commission, together with CEN and Cenelec, assessed the standard against the request (recital 4) and concluded that it "satisfies the requirements which it aims to cover" (recital 5).

Article 1 publishes the reference. Article 2 reads: "This Decision shall enter into force on the day of its publication in the Official Journal of the European Union." Recital 6 gives the reason: a harmonised standard confers a presumption of conformity from the date its reference is published.

The title of the decision speaks of "harmonised standards" in the plural, while its annex holds one entry numbered 1. Later standards from the same request would be expected to follow as further decisions; this one does not announce any.

What the presumption covers, and what it does not

Section titled “What the presumption covers, and what it does not”

The decision does not say which article of the AI Act the standard covers: the only article it names is Article 40, in recital 1. It identifies the standard by the request item it answers, quality management systems, and that subject is Article 17. Article 17(1) requires providers of high-risk AI systems to put in place a documented quality management system that ensures compliance with the Regulation, covering at least 13 aspects, points (a) to (m). Among them:

  • a strategy for regulatory compliance, including conformity assessment and the management of modifications;
  • design, design control, development, quality control and test procedures;
  • data management systems and procedures;
  • the risk management system of Article 9;
  • the post-market monitoring system of Article 72, and serious incident reporting under Article 73;
  • an accountability framework for management and staff.

Two textual points frame how far the presumption reaches. Article 40(1) presumes conformity "to the extent that those standards cover those requirements or obligations", so the presumption follows the content of the standard, not the whole Regulation. And Article 40(1), which Regulation (EU) 2026/1744 left unchanged, words the presumption around the requirements of Chapter III, Section 2, and the obligations of Chapter V, Sections 2 and 3, while Article 17 sits in Chapter III, Section 3. The subparagraph that Regulation (EU) 2026/1744 added to Article 40(2) is a mandate to the Commission, not a presumption rule: it must request standards "to facilitate the joint compliance and presumption of conformity with the requirements or obligations set out in Chapter III, Sections 2 and 3", together with the relevant requirements of the Annex I legislation. The Commission has now published a quality management system standard under Article 40 anyway, and recital 5 states that it satisfies the requirements "set out in Regulation (EU) 2024/1689"; the wording of Article 40(1) has not caught up with that.

Listing Article 9 and Article 72 in the quality management system does not make EN 18286 a standard for them. Article 17 requires the system to include the risk management system and the post-market monitoring system; how the risk management itself meets Article 9 is a Section 2 requirement, and no harmonised standard dedicated to it is cited yet. The same goes for Articles 10 and 12 to 15. Some commentators report that Annex ZA also maps the standard to the first sentence of Article 11(1) on technical documentation; check Annex ZA itself before relying on that.

Requirement Article Harmonised standard cited
Quality management system 17 EN 18286:2026, since 14 October 2026
Risk management system 9 None yet
Data and data governance 10 None yet
Technical documentation 11 No dedicated standard yet (check Annex ZA of EN 18286)
Record-keeping 12 None yet
Transparency and information to deployers 13 None yet
Human oversight 14 None yet
Accuracy, robustness and cybersecurity 15 None yet

For Article 15 cybersecurity, a separate route exists: under Article 42(3), added by Regulation (EU) 2026/1744, a high-risk AI system within the scope of the Cyber Resilience Act that meets the conditions of Article 12(1) of that Regulation is deemed to comply with the Article 15 cybersecurity requirements.

A presumption ahead of the obligation

Section titled “A presumption ahead of the obligation”

The timing is unusual. Article 40 sits in Chapter III, Section 5, which is named in none of the derogations of Article 113, so the presumption mechanism has applied since 2 August 2026, and EN 18286:2026 is usable under it from 14 October 2026. Article 17 does not yet bind anyone: as amended by Regulation (EU) 2026/1744, Article 113 applies Chapter III, Sections 1 to 3, from 2 December 2027 for AI systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those under Article 6(1) and Annex I. The AI Act deferral article sets out that timeline.

The practical effect is lead time. A provider can build its quality management system to a cited standard more than a year before the obligation applies, and know in advance which part of its conformity assessment the standard will support.

Where the quality management system is assessed

Section titled “Where the quality management system is assessed”

The quality management system is checked in each conformity assessment route the Regulation sets for high-risk AI systems:

  • Internal control (Annex VI): point 2 has the provider verify that its quality management system complies with Article 17.
  • Notified body assessment (Annex VII): point 3.2 has the notified body determine whether the quality management system satisfies Article 17.
  • Products in Section A of Annex I: Article 43(3), as amended by Regulation (EU) 2026/1744, adds that the assessment of the Article 17 quality management system is also undertaken within the sectoral conformity assessment, with points 3, 4.3, 4.4 and 4.5, the fifth paragraph of point 4.6, and point 5 of Annex VII applying.

Article 17(3) still lets a provider already subject to a quality management system under sectoral Union law include the Article 17 aspects in that existing system. Article 17(2) makes implementation proportionate to the size of the organisation, and Article 63(1), as amended by Regulation (EU) 2026/1744, lets SMEs, including start-ups, that have no partner or linked enterprises within the meaning of Recommendation 2003/361/EC comply with certain elements of the quality management system in a simplified manner, on the basis of Commission guidelines.

Products in Section B of Annex I, machinery included since Regulation (EU) 2026/1744, are a different case: Article 17 does not apply to them directly, and for machinery the AI requirements are to be written into Annex III of Regulation (EU) 2023/1230 by delegated acts.

What to do

Section titled “What to do”
  1. Map your quality management system to EN 18286:2026 if you place, or plan to place, a high-risk AI system on the market. Where the AI sits in a product that already has a quality system under sectoral law, use Article 17(3) to extend that system rather than build a second one.
  2. Claim presumption only for what the standard covers. In the technical documentation, cite EN 18286:2026 against the quality management system, within the clauses its Annex ZA maps, and justify the Section 2 requirements (Articles 9 to 15) requirement by requirement until standards for them are cited.
  3. Keep the deferred dates in view. The standard is citable now; the obligation applies from 2 December 2027 or 2 August 2028, depending on how the system is classified as high-risk.
  4. Watch for the next decisions. Further references for the AI Act would come as further implementing decisions in the Official Journal L series.

Going further

Section titled “Going further”

Sources & references

  1. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689 (OJ L, 14 October 2026), Publications Office of the European Union data.europa.eu/eli/dec_impl/2026/2274/oj
  2. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, EUR-Lex eur-lex.europa.eu/eli/reg/2024/1689/oj
  3. Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230, EUR-Lex eur-lex.europa.eu/eli/reg/2026/1744/oj