EN 18286: What the First AI Act Harmonised Standard Means

EN 18286 is the first harmonised standard supporting the EU AI Act, and its reference was published in the Official Journal of the EU in October 2026. Titled Artificial intelligence – Quality management system for EU AI Act regulatory purposes, it turns the quality management requirements of Article 17 into practical, auditable requirements for providers of high-risk AI systems (European Commission).

For a law that has often been criticised for being hard to apply, this is an important step: companies now have a recognised method, not just a legal text, for one of the central provider obligations.

What a harmonised standard does

A harmonised standard is a European standard developed by the European standardisation organisations at the Commission’s request. Once its reference is published in the Official Journal, applying it gives a presumption of conformity with the legal requirements it covers. In plain terms: if you implement the standard correctly, regulators start from the assumption that you meet the matching part of the law.

EN 18286 was developed by CEN and CENELEC and cited through Commission Implementing Decision (EU) 2026/2274 (CEN-CENELEC). The presumption it gives is limited to the Article 17 requirements it covers. It does not cover data governance, technical documentation, transparency or human oversight; those will depend on further standards that the Commission expects to follow.

What EN 18286 covers

Article 17 of the AI Act requires providers of high-risk AI systems to run a documented quality management system. EN 18286 structures that system around the AI system lifecycle: design, development, testing, release, monitoring and changes, with the policies, responsibilities and records each stage needs.

Two design choices matter for companies:

• It builds on what you have. The Commission notes that EN 18286 can be layered on existing management systems such as ISO/IEC 42001, ISO 9001 or sector systems like ISO 13485 for medical devices, rather than run as a parallel system.
• It is written for regulators as well as auditors. The requirements are meant to be checked, which makes gaps visible early.

How it relates to ISO/IEC 42001

Many companies ask whether ISO/IEC 42001 certification is enough for the AI Act. The short answer is no, and EN 18286 shows why. ISO/IEC 42001 is a voluntary, certifiable AI management system standard with a broad scope. It is a strong foundation, but it was not written against the AI Act and does not, on its own, give a presumption of conformity with any AI Act article.

EN 18286 is narrower and legal in purpose: it targets Article 17 specifically. Companies that already run ISO/IEC 42001 are well placed, because much of the management system, from roles to document control and internal audit, can be reused. The work is then to close the gap between the two, not to start again. We explain the wider choice in whether you need ISO 42001 certification.

When it matters

The high-risk requirements, including Article 17, apply from 2 December 2027 for Annex III systems, such as AI used in recruitment or credit decisions, and from 2 August 2028 for AI in products covered by Annex I Section A, following the Digital Omnibus on AI (Regulation (EU) 2026/1744). The full timeline is in what the EU AI Act requires.

That may sound distant, but a quality management system is not something a provider can build in a quarter. It needs agreed processes, trained people and a track record of records. For SMEs there is some relief: the system must be proportionate to the provider’s size, and eligible SMEs may simplify certain elements under Article 63. Simplification does not remove the obligation.

What to do now

For providers of AI systems that are, or may become, high-risk:

1. Confirm your role and classification. EN 18286 matters only if you are the provider of a high-risk system. Start with whether you are a provider or a deployer.
2. Get the standard and run a gap analysis against your current processes, or against ISO/IEC 42001 if you already use it.
3. Assign ownership. A quality management system needs a named owner with authority, not a folder of policies.
4. Plan for the next standards. Further harmonised standards will cover other AI Act requirements. Track them so you do not build the same evidence twice.

Deployers, meaning companies that use AI systems built by others, are not directly bound by Article 17. They can still use EN 18286 as a question list for vendors: a provider that cannot describe its quality management system for a high-risk product is a risk worth knowing about early.

The AIEI view

Standards are where principles become checkable practice. EN 18286 does not make a company ethical, and conformity is not the same as trustworthiness. But it gives organisations a shared language for responsibility in AI development, and it rewards those that have already invested in governance. AIEI will follow the next harmonised standards closely and share practical guidance with our members and the wider community.

Sources

• European Commission – First harmonised standard supporting the AI Act published in the Official Journal
• CEN-CENELEC – First ever European standard on AI published in the OJEU
• Regulation (EU) 2024/1689 (AI Act) – Articles 17 and 63
• Regulation (EU) 2026/1744 (Digital Omnibus on AI)