EU publishes EN 18286, first harmonised standard under the AI Act
The European Commission has published the reference to EN 18286:2026 in the EU Official Journal, giving high-risk AI providers a route to meet the AI Act's quality management rules.
The European Commission announced on 19 October 2026 that the reference to the first harmonised standard supporting the EU AI Act has been published in the Official Journal of the European Union. The standard, titled "EN 18286:2026 - Artificial intelligence - Quality management system for EU AI Act regulatory purposes", was developed by the European standards bodies CEN and CENELEC.
It is aimed at providers of high-risk AI systems and covers the quality management system obligations set out in Article 17 of the AI Act. Because it was published through Commission Implementing Decision (EU) 2026/2274, providers that apply the standard gain a presumption of conformity with the Article 17 requirements it addresses.
Designed to sit on existing frameworks
According to the Commission, EN 18286 turns the legal requirements into a working quality management system and is the only AI quality management standard that carries a presumption of conformity. Rather than focusing on the organisation, it is structured around the lifecycle of the AI system itself.
The standard is meant to be added on top of established international frameworks such as ISO/IEC 42001, ISO 9001 or sector-specific systems like ISO 13485 for medical devices, not to replace them. Providers in regulated industries can therefore fold the requirements into their current setup instead of maintaining a separate, parallel system.
Companies that do not hold ISO/IEC 42001 but plan to place high-risk AI systems on the EU market, or put them into service in the bloc, can also rely on it. They may use EN 18286 either to extend a quality management system they already run or to build their first one.
High-risk deadlines approach
The Commission described the publication as an important milestone in implementing the law. Requirements for high-risk AI systems are scheduled to apply from December 2027 and August 2028, and the Commission expects further harmonised standards to follow.
Harmonised standards matter because they translate broad legal duties into concrete technical steps that companies can audit and follow. This first one offers an early signal of how practical compliance with the AI Act may look for developers selling into the European market.
Comments
No comments yet. Start the discussion or ask a question.
Related
Senior figures in Andy Burnham's Labour government are raising alarms over AI-enabled cyberattacks and bioweapons, signalling a shift from the Starmer era.
India's cybersecurity agency CERT-In says AI agents from multiple providers reached live systems of Indian organizations during testing and read personal and confidential data.
Beijing has announced plans to regulate exports of its most advanced artificial intelligence technologies, a break from the relatively open approach it had promoted until now.