EU publishes EN 18286, the first harmonised standard under the AI Act

EU publishes EN 18286, the first harmonised standard under the AI Act

19 October 2026: The European Commission has published the reference of EN 18286:2026, "Artificial intelligence: Quality management system for EU AI Act regulatory purposes", in the Official Journal, making it the first harmonised standard under the AI Act. A provider of a high-risk AI system that implements it is presumed to meet the quality management requirements of Article 17 that the standard covers.

Not yet independently verified. We read the Commission announcement and its AI Act pages, not the text of Implementing Decision (EU) 2026/2274 on EUR-Lex, which did not load for us. We will update this when it can be confirmed, and remove this note.

What the presumption buys a provider

Article 17 requires every provider of a high-risk AI system to run a documented quality management system: design and development controls, testing, data management, risk management, post-market monitoring, incident reporting and record keeping. Without a harmonised standard, a provider has to show a regulator or notified body how its own system meets each obligation. With one, following the standard shifts the burden: the provider is presumed compliant for the parts the standard covers unless someone shows otherwise.

The publication went through Commission Implementing Decision (EU) 2026/2274. EN 18286 was written by CEN and CENELEC in their joint technical committee JTC 21, and its draft became the first AI standard to enter public enquiry on 30 October 2025. The Commission calls it "the only AI QMS standard with a presumption of conformity".

How it fits with ISO/IEC 42001 and sector systems

The standard is organised around the lifecycle of each AI system rather than around the organisation, and it is meant to sit on top of systems a company already runs, such as ISO/IEC 42001, ISO 9001 or a sector standard like ISO 13485 for medical devices. The Commission says it "explicitly allows providers in regulated sectors to integrate management systems, rather than run separate ones".

That answers a question many compliance teams had parked: whether an ISO/IEC 42001 certificate would be enough. It is not, on its own, because 42001 is not a harmonised standard; EN 18286 is the layer that maps onto Article 17. A company without 42001 can use EN 18286 to extend an existing quality system or to build one from scratch.

The dates it is working towards

Following the political agreement on the AI Omnibus, the Commission's own timeline has the high-risk rules for systems used in areas such as biometrics, critical infrastructure, education, employment, migration and border control applying from 2 December 2027. For AI built into products such as robotics and industrial machinery, they apply from 2 August 2028. EN 18286 therefore arrives with more than a year of runway for the first group, and the Commission says further harmonised standards are expected to follow.

For a buyer, the practical use is in procurement. A vendor selling a system that falls into a high-risk area can now be asked a precise question: does its quality management system follow EN 18286, and if not, how will it demonstrate Article 17 compliance by the date that applies to it? Our quality management software category lists 15 products and our GRC category seven; none yet claims EN 18286 alignment on its listing.

Sources

• European Commission, Shaping Europe's digital future: First harmonised standard supporting the AI Act published in the Official Journal, 19 October 2026
• European Commission: Standardisation of the AI Act (read 2026-10-19), 19 October 2026
• European Commission: Guidelines on high-risk AI systems (read 2026-10-19), 19 October 2026