The European Commission has published the first harmonised technical standard under the EU AI Act, giving providers of high-risk AI systems a recognised way to demonstrate compliance with specific documentation and quality-management obligations. The reference to EN 18286:2026, covering artificial intelligence quality management systems, was published on 14 October through Commission Implementing Decision (EU) 2026/2274.

The standard supports compliance with Article 11(1), on technical documentation, and Article 17(1), on quality management systems. Its publication does not establish a blanket finding that an AI system complies with the Act. The legal benefit is limited to the requirements covered by the standard and depends on the provider applying the relevant specifications.

Harmonised standards connect the AI Act’s legal requirements with practical technical and organisational measures. Under Article 40, publication of a standard’s reference in the Official Journal of the European Union creates a presumption of conformity for the requirements it covers. Using such standards remains voluntary: providers can demonstrate compliance through other means.

That distinction leaves responsibility with providers to identify the obligations and risks relevant to their systems. A harmonised standard offers a recognised compliance method, but it does not replace the legislation or remove the need to assess risks beyond its scope.

EN 18286 was developed jointly by the European Committee for Standardisation, CEN, and the European Committee for Electrotechnical Standardisation, CENELEC. It requires providers to establish which AI Act requirements apply, set the boundaries of their quality management system and document a regulatory-compliance strategy. That strategy addresses the requirements in Articles 9–15, alongside conformity assessment, system modifications, post-market monitoring and serious-incident reporting.

The standard brings those responsibilities into management processes spanning the AI system’s lifecycle. Its scope includes leadership and accountability, staff competence and resources, design and development, verification and validation, data management, continuously learning systems and retirement. It also addresses supply-chain controls, responses to non-compliance and management review.

Organisations with existing management systems can integrate the new requirements into those arrangements. EN 18286 uses the same high-level management-system structure as ISO/IEC 42001, which concerns AI management systems, and ISO 9001. It is intended to complement existing international or sector-specific quality systems rather than displace them. Compliance with those other standards alone, however, does not provide the AI Act presumption of conformity associated with EN 18286.

For most high-risk AI systems, using the standard does not alter the applicable conformity-assessment procedure. Systems in Annex III, points 2–8, remain subject to provider self-assessment regardless of whether harmonised standards are used. For biometric systems covered by Annex III, point 1, providers may choose self-assessment where harmonised standards or common specifications cover all essential requirements; otherwise, assessment by a notified body is required.

The Official Journal contains the standard’s reference rather than its full technical text. National standardisation bodies generally sell access to the document, with prices varying between distributors. Purchasing it is not certification and does not itself establish compliance.

Further standards remain in development across a wider European programme covering 10 areas, including risk management, data quality, logging, transparency, human oversight, accuracy, robustness and cybersecurity. Those areas do not necessarily correspond to 10 separate standards: more than one deliverable may address a single subject.

Sources: Orrick