EU AI Act Gets Its First Harmonised Standard

The EU AI Act now has its first harmonised standard. It covers the quality management systems that providers of high-risk AI systems must have in place. The standard is called “EN 18286:2026 – Artificial intelligence – Quality management system for EU AI Act regulatory purposes”. It was “developed by CEN and CENELEC”, Europe’s standards bodies, the European Commission said in a notice dated 19 October.

The legal step that gives the standard its force came a few days earlier. The Commission’s Implementing Decision (EU) 2026/2274 is dated 12 October 2026. It was published in the Official Journal of the European Union on 14 October, and it says it “shall enter into force on the day of its publication”. The Commission’s announcement followed on 19 October.

What the standard does

Under the AI Act, a product that follows a harmonised standard listed in the Official Journal is presumed to meet the parts of the law that the standard covers. The Commission says that publication “through Commission Implementing Decision (EU) 2026/2274” means “providers implementing this standard will benefit from a presumption of conformity with the Article 17 requirements covered by the standard.”

The Decision says the presumption applies “from the date of publication of the reference of such standard in the Official Journal”. That date is 14 October.

Article 17 of the AI Act requires providers of high-risk AI systems to “put a quality management system in place that ensures compliance with this Regulation”. It must be written down as policies, procedures and instructions. The article lists 13 things the system must cover at a minimum. They include:

a strategy for complying with the rules
design, development, testing and validation procedures
data management
the risk management system
post-market monitoring
reporting serious incidents
record-keeping
a framework setting out who in management and staff is accountable for what

The Commission calls EN 18286 “the only AI QMS standard with a presumption of conformity”. It says the standard is “built around the AI system lifecycle, rather than the organisation”. It is also “designed to be layered on top of the existing international standards such as ISO/IEC 42001, ISO 9001 or a sectoral QMS (e.g. ISO 13485), rather than replace them.”

ISO/IEC 42001 is the international management-system standard for AI. ISO 9001 is the general quality management standard, and ISO 13485 covers medical devices. The Commission says providers in regulated sectors can fold the new requirements into their existing systems “rather than run a separate parallel management system”. Organisations without ISO/IEC 42001 can use EN 18286 “to extend an existing QMS or build their first one”, it adds.

What it does not do

Using the standard is optional. “The application of standards remains voluntary,” the Commission says on its AI Act standardisation page. “Providers can choose any other framework to demonstrate their compliance with the AI Act.” Following a harmonised standard is one way to show compliance, and it gives legal certainty. It is not a legal requirement in itself.

The presumption is also limited. It applies only to the Article 17 quality management requirements the standard covers. It does not cover the AI Act’s other obligations for high-risk systems.

How the dates fit together

The Commission says the standard arrives “ahead of the application of requirements for high-risk AI systems (December 2027 / August 2028), with further harmonised standards expected to follow.”

Those two dates come from the AI Omnibus, the package of changes to the AI Act that entered into force on 27 July 2026. It moved the start of the high-risk rules:

High-risk systems listed in Annex III of the Act, such as AI used in critical infrastructure or law enforcement: rules apply from 2 December 2027.
High-risk AI built into products covered by EU product-safety law in Annex I, such as machinery, toys and lifts: rules apply from 2 August 2028.

Under the AI Act as first adopted, these obligations were due to apply from 2 August 2026. The amending regulation, Regulation (EU) 2026/1744, lists “the delayed availability of standards” among its reasons for the delay.

How it got here

The Commission asked CEN and CENELEC to draft the AI Act standards in a standardisation request dated 23 June 2025, according to the Decision. The quality management standard answers one item on that list, covering “quality management systems for providers of AI systems, including post-market monitoring processes”. The Commission’s standardisation page says the draft, prEN 18286, entered public enquiry on 30 October 2025. It was the first harmonised AI standard to reach that stage.

The Commission has asked for standards in ten areas, and the drafting is done by a joint CEN and CENELEC committee called JTC 21. The Commission has not said which standard will be referenced next, or when.