EU publishes the first harmonised standard for the AI Act
EN 18286:2026, a quality-management standard from CEN and CENELEC, gives providers of high-risk AI systems a presumption of conformity with Article 17; the Official Journal entry is dated 14 October.
- Government & policy
- Minor
The European Commission published the reference to the first harmonised standard supporting the AI Act in the Official Journal. The standard, EN 18286:2026, is titled “Artificial intelligence – Quality management system for EU AI Act regulatory purposes” and was drafted by the standards bodies CEN and CENELEC. The Commission’s announcement is dated 19 October, but the legal act it describes, Implementing Decision (EU) 2026/2274, was adopted on 12 October and appeared in the Official Journal on 14 October. It entered into force on the day of publication.
Harmonised standards matter in the AI Act because Article 40 says high-risk AI systems that conform to them, once their references are published in the Official Journal, are presumed to comply with the requirements those standards cover. This standard covers the quality-management-system requirements of Article 17, which apply to providers of high-risk systems and include post-market monitoring. A provider that implements it gets a presumption of conformity with those requirements, though not with the Act’s other obligations. The decision records that the Commission, with CEN and CENELEC, assessed the standard against its standardisation request of 2025 and found it met the requirements it aims to cover.
The Commission says the standard is built around the AI system’s lifecycle rather than the organisation, and is designed to sit on top of existing management-system standards such as ISO/IEC 42001, ISO 9001 or a sector standard like ISO 13485, rather than replace them. It describes it as the only AI quality-management standard with a presumption of conformity, and says organisations without ISO/IEC 42001 can use it to build or extend a management system.
The announcement says further harmonised standards are expected to follow. This one’s practical weight depends on the compliance timetable: the Digital Omnibus, adopted by the Council in June, moved obligations for standalone high-risk systems to December 2027 and for embedded ones to August 2028, so providers have time before the requirements bite.