EU names its first harmonized standard for the AI Act, covering quality management

EN 18286:2026 has become the first harmonized standard under the EU's Artificial Intelligence Act to be referenced in the Official Journal of the European Union, after the European Commission published its reference there. The Commission announced the step on October 19, 2026. The standard describes how a provider of a high-risk AI system can set up the quality management system that Article 17 of the act requires.

The reference was published through Commission Implementing Decision (EU) 2026/2274. Providers that apply the standard “will benefit from a presumption of conformity with the Article 17 requirements covered by the standard,” the Commission said. In practice, that gives companies a recognized route to show that their quality system meets the law.

What the standard covers

EN 18286 was developed by CEN and CENELEC, the two European standardization organizations whose joint technical committee, JTC 21, is drafting the AI Act standards. Its full title is “Artificial intelligence – Quality management system for EU AI Act regulatory purposes.” CEN and CENELEC announced the standard's publication at the end of July 2026. The Official Journal reference is the step that brings the legal presumption.

According to the Commission, the standard is built around the AI system's lifecycle rather than around the organization. It is designed to sit on top of existing management standards, such as ISO/IEC 42001, ISO 9001 or a sector-specific system such as ISO 13485, rather than replace them. Providers in regulated sectors can combine their management systems instead of running separate ones.

CEN and CENELEC said the standard translates the Article 17 requirements “into practical, auditable requirements” that providers of high-risk AI systems can apply.

What it does and does not settle

Using the standard is voluntary. Providers may choose another framework to demonstrate compliance, the Commission says, but standards referenced in the Official Journal provide legal certainty.

The presumption is also narrow. It applies only to the Article 17 requirements that EN 18286 covers. The AI Act's other duties for high-risk systems, from risk management and data quality to record keeping, human oversight and cybersecurity, are the subject of further standards that have not yet been referenced. The Commission asked CEN and CENELEC for standards in ten areas:

• Risk management
• Governance and quality of datasets
• Record keeping
• Transparency
• Human oversight
• Accuracy
• Robustness
• Cybersecurity
• Quality management, now covered by EN 18286
• Conformity assessment

Each standard must be assessed by the Commission against the act's objectives and legal requirements before its reference appears in the Official Journal.

Why the timing matters

The act's obligations for high-risk AI systems used in areas such as biometrics, critical infrastructure, education, employment, migration and border control apply from December 2, 2027. Rules for AI built into regulated products, such as elevators (lifts, in the Commission's wording) or toys, apply from August 2, 2028. Both dates were extended by the EU's “AI Omnibus” amendments, which entered into force on July 27, 2026. The Commission says the aim is for the rules to apply when companies have support tools such as standards.

That leaves a little over 13 months between the standard's announcement and the first high-risk deadline. The Commission says companies that do not yet run an ISO/IEC 42001 system, but intend to bring high-risk AI systems to the EU market or put them into service there, can use EN 18286 either to extend a quality system they already have or to build a new one. CEN and CENELEC say the standard is not specific to any sector.

What comes next

The Commission says further harmonized standards are expected to follow before the high-risk requirements apply. The AI Act's separate transparency rules for AI-generated content already apply; we explain how AI content labels and watermarks work.