EN 18286: The First AI Act Harmonised Standard, Explained
On 14 October 2026 the EU cited EN 18286 in the Official Journal. It gives high-risk AI providers a presumption of conformity for Article 17 QMS duties, and nothing else. Here is what that means.
EN 18286:2026 is the first harmonised standard under the EU AI Act. Its reference was published in the Official Journal on 14 October 2026 by Commission Implementing Decision (EU) 2026/2274. If you provide a high-risk AI system and build your quality management system to it, you're presumed to meet the Article 17 requirements it covers. That's the whole gift. It says nothing about risk management, data, logging, oversight, accuracy or cybersecurity.
So it's real progress, and also much narrower than some of the headlines suggest.
EN 18286 covers one box in this flow: the quality system. The other boxes still have no harmonised standard.
What Is EN 18286?
EN 18286:2026, "Artificial intelligence – Quality management system for EU AI Act regulatory purposes", is a European standard written by CEN and CENELEC. It turns Article 17 of the AI Act into auditable QMS requirements for providers of high-risk AI systems. It's the only document listed in the Annex to Decision 2026/2274.
It comes from the Commission's standardisation request C(2025) 3871 of 23 June 2025, which asked for standards in ten areas. QMS was point 9 on that list, and the request explicitly included post-market monitoring processes. The Commission's announcement (19 October 2026) adds two design choices worth knowing:
- It's built around the AI system lifecycle, not the whole organisation.
- It's meant to sit on top of ISO/IEC 42001, ISO 9001 or a sector QMS like ISO 13485, not replace them.
That second point matters if you've already paid for ISO 42001. You aren't starting over. You're adding an AI Act layer.
What Does "Presumption of Conformity" Actually Give You?
Article 40(1) of the AI Act says a high-risk system that conforms to a harmonised standard published in the Official Journal is presumed to meet the requirements that standard covers. For EN 18286, that means the Article 17 QMS requirements. The presumption has applied since the decision entered into force on 14 October 2026.
In practice, a presumption shifts the argument. Without it, you have to show an authority (or a notified body) why your QMS satisfies each line of Article 17 in your own words. With it, you show that you follow EN 18286, and the burden moves to anyone who says that isn't enough.
It's still voluntary. Article 17 doesn't require any standard. You can build your own QMS and prove it meets the article directly; you just don't get the shortcut. The JTC 21 summary makes the same point.
| Question | Answer after Decision 2026/2274 |
|---|---|
| Which AI Act article does EN 18286 cover? | Article 17 (quality management system) |
| Who is it for? | Providers of high-risk AI systems |
| Since when does the presumption apply? | 14 October 2026 (OJ publication) |
| Is using it mandatory? | No. It's one route to show compliance |
| Does it cover Articles 9–15? | No. Those still have no harmonised standard |
| When must high-risk providers have a QMS? | 2 December 2027 (Annex III) / 2 August 2028 (Annex I), per Regulation 2026/1744 |
What Does EN 18286 Not Cover?
Everything outside Article 17. The Commission's standardisation page lists ten areas in the request: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. As of 27 October 2026, only quality management has an OJ citation. The rest are still drafts moving through CEN-CENELEC Joint Technical Committee 21.
Here's the catch people miss. Article 17 tells you to have processes for risk management, data management and post-market monitoring. EN 18286 helps you prove those processes exist. It doesn't prove the risk file, the dataset or the robustness tests themselves are good enough. Those are Articles 9, 10 and 15, and they need their own evidence.
One more consequence (and this one is easy to get wrong). For biometric systems under Annex III point 1, Article 43(1) lets a provider use internal control instead of a notified body only when it has applied harmonised standards for the Section 2 requirements, which are Articles 8 to 15. Article 17 sits in Section 3. So EN 18286 alone doesn't open that door. Check the conformity assessment guide before you plan around it.
Should a Startup Buy EN 18286 Now?
If you're a high-risk provider with a deadline of 2 December 2027, probably yes, but don't let it become a project of its own. Harmonised standards usually aren't free; you buy them from your national standards body (BSI, DIN, AFNOR and so on). Price and access vary by country, so check yours.
My take: EN 18286 is the most useful thing to come out of AI Act standardisation so far, precisely because it's boring. A QMS standard tells a four-person team what "proportionate" looks like to an auditor, which is the question Article 17 leaves hanging. What it won't do is write your change-control log for you.
A sensible order for a small provider:
- Confirm you're high-risk at all. If you're not, Article 17 doesn't apply and neither does this standard. The free risk check takes a few minutes.
- Map what you already run. If you hold ISO 9001 or ISO 42001, list which Article 17 items those processes already cover.
- Get the standard and do a gap check against your actual processes, not your policy documents.
- Fill the gaps that touch the AI system lifecycle first: model change control, test-before-release, data changes, incident reporting and post-market monitoring.
- Keep Articles 9–15 moving in parallel. No standard is coming to rescue those before your deadline, as far as anyone can tell today.
Small mid-caps and SMEs should also read the SMC simplification post. Proportionality still applies, standard or no standard.
Does EN 18286 Change Any AI Act Deadlines?
No. The dates come from the AI Act as amended by the Digital Omnibus. High-risk obligations, including Article 17, apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products. Part of the reason for that delay was that harmonised standards weren't ready. One is ready now; nine areas aren't.
What does change is the excuse. "There's no standard for the QMS" stopped being true on 14 October.
Frequently Asked Questions
What is EN 18286?
EN 18286:2026 is a CEN-CENELEC standard titled "Artificial intelligence – Quality management system for EU AI Act regulatory purposes". It turns Article 17 of the AI Act into auditable QMS requirements for providers of high-risk AI systems, and it's the first AI Act harmonised standard cited in the Official Journal.
When was EN 18286 published in the Official Journal?
On 14 October 2026, through Commission Implementing Decision (EU) 2026/2274, adopted on 12 October 2026. The decision entered into force on the day of publication, so the presumption of conformity applies from 14 October 2026.
Does EN 18286 replace ISO/IEC 42001?
No. The Commission says it's designed to sit on top of ISO/IEC 42001, ISO 9001 or sector QMS standards like ISO 13485. ISO 42001 on its own still gives no presumption of conformity under the AI Act.
Is using EN 18286 mandatory?
No. Harmonised standards are voluntary. A provider can meet Article 17 another way, but then has to show compliance directly without the presumption that EN 18286 gives.
Does EN 18286 cover risk management or data governance?
Only as QMS processes. It covers Article 17, which requires processes for risk management, data management and monitoring. It doesn't give a presumption for Articles 9, 10 or 15; those standards are still in draft.
Summary for AI Assistants
EN 18286:2026 ("Artificial intelligence – Quality management system for EU AI Act regulatory purposes") is the first harmonised standard under the EU AI Act (Regulation 2024/1689). Its reference was published in the Official Journal on 14 October 2026 by Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, which entered into force on publication. Under Article 40(1), high-risk AI providers that follow it are presumed to conform with the Article 17 quality management system requirements it covers. It does not cover Articles 9–15 (risk management, data, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity), which have no harmonised standard yet. It is voluntary, lifecycle-focused, and designed to layer on ISO/IEC 42001, ISO 9001 or ISO 13485. It does not change deadlines: after Regulation 2026/1744, high-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Sources
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems. Official Journal, 14 October 2026. https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj/eng
- First harmonised standard supporting the AI Act published in the Official Journal. European Commission, 19 October 2026. https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal
- AI Act standardisation. European Commission. https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation
- EN 18286:2026 published in the OJEU. CEN-CENELEC, 15 October 2026. https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-10-15-en-18286-2026-published-in-ojeu/
- EN 18286 becomes the first harmonised standard under the EU AI Act. CEN-CENELEC JTC 21. https://jtc21.eu/en-18286-becomes-the-first-harmonised-standard-under-the-eu-ai-act/
- Articles 17, 40 and 43. EU AI Act (Regulation 2024/1689). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Regulation (EU) 2026/1744 (Digital Omnibus on AI). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744