The EU AI Act now has its first harmonised standard. With Commission Implementing Decision (EU) 2026/2274, the reference to EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, is published in the Official Journal of the European Union (OJEU).
Providers of high-risk AI systems that build their quality management system on EN 18286 now benefit from a presumption of conformity with the quality management requirements in Article 17 of the AI Act. The standard was developed by CEN-CENELEC JTC 21, the joint European committee for artificial intelligence.
Why harmonisation matters
A published European standard and a harmonised standard are not the same thing. CEN and CENELEC publish the standard; the European Commission then assesses it and, if it meets the standardisation request, cites its reference in the OJEU. Only that citation gives the standard legal effect under Article 40 of the AI Act.
EN 18286 was published in July 2026. Until now it was a well-built voluntary document. With the OJEU citation, following it becomes a recognised route to show compliance with Article 17.
The presumption is voluntary. Providers can still meet Article 17 in other ways, but then they must show on their own how they comply.
What EN 18286 covers
EN 18286 sets out requirements and guidance for a quality management system (QMS) for organisations that place high-risk AI systems on the EU market. It is written specifically for the regulatory purposes of the AI Act, not as a general management system standard.
- Scope: the QMS that Article 17 requires from providers of high-risk AI systems.
- Built to fit existing systems: informative annexes map the standard to EN ISO 9001 and EN ISO/IEC 42001, so organisations already certified to either can build on what they have.
- Link to the law: an Annex ZA shows which AI Act requirements each clause supports. Check that annex and the Implementing Decision for the exact scope of the presumption.
What it means in practice
- Providers of high-risk AI systems get a clear, recognised route to meet Article 17. A QMS built on EN 18286 is presumed to conform, which lowers legal uncertainty and the cost of proving compliance.
- Notified bodies and market surveillance authorities get a common reference point for assessing quality management. That supports consistent decisions across Member States.
- Organisations already using ISO 9001 or ISO/IEC 42001 can extend their existing system rather than start over, using the mappings in the standard.
The application dates for the high-risk rules now depend on support measures such as harmonised standards being available. Each citation like this one moves the AI Act from legal text to practical implementation.
What comes next
EN 18286 is the first deliverable under standardisation request M/613, not the last. JTC 21 continues work on the other standards the AI Act needs, including risk management, data governance and quality, logging, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment.
The amended standardisation request runs until 28 February 2027. Several of the core drafts are being revised after their public enquiries, and each will follow the same path: adoption by CEN and CENELEC, assessment by the Commission and, finally, citation in the OJEU.