5 minute read | October.27.2026
On 14 October 2026, the European Commission published the first harmonised standard under the EU AI Act: EN 18286:2026 – Artificial intelligence – Quality management system (Commission Implementing Decision (EU) 2026/2274). Compliance with this standard can be relied upon by providers of high-risk AI systems to demonstrate compliance with Articles 11(1) (Technical Documentation) and 17(1) (Quality Management System) of the AI Act.
We explain the role of harmonised standards under the AI Act and provide an overview of EN 18286.
The AI Act follows the EU New Legislative Framework (NLF) approach to product regulation. 1 Legislation establishes essential requirements for products, while harmonised European standards provide the technical details that support compliance with them. Some address the technical conformity of products, others organisational processes such as quality management.
Under the AI Act, essential requirements for high-risk AI systems are set out in Chapter III, Section 2 (Articles 8-15) of the Act. Providers must ensure that their high-risk AI systems comply with these requirements before their systems are placed on the market in the EU.
EN 18286 was jointly prepared by the European Committee for Standardisation (CEN), and the European Committee for Electrotechnical Standardisation (CENELEC), in response to a formal request from the European Commission to prepare standards covering 10 strategic areas: risk management, governance and quality of datasets, recordkeeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment.
Once a standard’s reference is published in the Official Journal of the European Union (OJ), Article 40 of the AI Act provides a presumption of conformity with the requirements covered by that standard. Applying harmonised standards, in whole or in part, is voluntary and providers are free to demonstrate compliance with essential requirements in other ways.
Importantly, as pointed out in the 2022 Blue Guide on the implementation of the product rules, harmonised standards do not replace the binding essential requirements set out in the law. A technical specification in a standard presents an option for complying with the legal obligation. In risk-related harmonisation legislation, such as the AI Act, this means providers remain responsible for assessing all the risks of their AI system in order to determine which essential (or other) requirements are relevant.
A provider that relies on harmonised standards to demonstrate compliance with its obligations under the AI Act benefits from a presumption of conformity, but only in relation to the legal requirements covered by those standards
EN 18286 requires providers to identify the requirements under the AI Act that apply to them, define the scope of their quality management system and adopt a documented strategy for regulatory compliance. That strategy covers the essential requirements of Articles 9 to 15 of the AI Act, conformity assessment, modifications, post-market monitoring and serious-incident reporting.
The standard then builds these into management-system processes covering leadership, roles and accountability, competence and resources, throughout the AI system lifecycle (including design and development, verification and validation, data management, continuous learning systems and retirement), supply chain controls, handling of non-compliance and management review.
The standard is designed to sit within an organisation's wider AI governance framework: it follows the same high-level management-system structure as ISO/IEC 42001 (AI management systems) and ISO 9001, so its regulatory-compliance processes can be integrated into an existing AI management system, or into a sector-specific quality management system.
According to the European Commission, EN 18286 is “designed to be layered on top of the existing international standards – such as ISO/IEC 42001, ISO 9001 or a sectoral QMS (e.g. ISO 13485) – rather than replace them.”
Adherence to these other standards on their own, however, will not allow a provider to benefit from the presumption of conformity.
For most high-risk AI systems, applying harmonised standards such as EN 18286 does not change the conformity assessment route. Harmonised standards affect the route only for biometric systems under Annex III, point 1, where providers may opt for self-assessment if harmonised standards or common specifications have been applied to all the essential requirements.
Otherwise, assessment by a notified body is mandatory. AI systems covered by points 2 to 8 of Annex III must be self-assessed by providers, whether or not they rely on harmonised standards.
The Official Journal publishes the reference, not the full standard. The standard is generally distributed for purchase by national standardisation bodies, including AFNOR (France), DIN (Germany), UNI (Italy) and BSI (UK). Buying it provides access to technical specifications, not certification or proof of compliance. Prices vary from one organisation to the next.
The paid-access model for harmonised standards is controversial and legally contested, given the importance of standards to legal compliance and their status as part of EU law.
EN 18286 is the first OJ-cited standard in a wider European AI standardisation programme. Commission standardisation request C(2025) 3871 final identifies 10 standardisation areas: risk management, data governance and quality, recordkeeping and logging, transparency and information to users, human oversight, accuracy, robustness, cybersecurity, quality management (including post-market monitoring), and conformity assessment.
These areas relate principally to Articles 9–15, 17 and 43 of the AI Act. Ten areas do not necessarily mean 10 individual standards: several deliverables may address a single area. The remaining standards are at different stages of development and adoption.
Providers of high-risk AI systems should assess their compliance arrangements against EN 18286 to benefit from the presumption of conformity under Article 40. Existing ISO/IEC 42001 or ISO 9001 processes may be relevant but should not be assumed to satisfy Article 17. Providers should monitor the remaining harmonised standards as they are published.
1 The central instruments relating to harmonised standards are Regulation (EC) No 765/2008 (accreditation and market surveillance), Decision No 768/2008/EC (common framework for marketing products and conformity assessment) and Regulation (EU) No 1025/2012 (European standardisation).