EU publishes first harmonised AI Act standard

The standard is EN 18286:2026, titled “Artificial intelligence – Quality management system for EU AI Act regulatory purposes.”[1] The Commission’s decision directs publication in the Official Journal of the reference to the standard listed in its annex.[1] The Official Journal citation is dated 14 October 2026, while the quoted date in the decision is 12 October 2026.[1] CEN and CENELEC completed work on the requested harmonised standard, and their organisation describes it as the first harmonised standard supporting the AI Act.[1][2]

The Commission says the standard provides providers of high-risk AI systems with a pathway to meet the AI Act’s Article 17 quality management system requirements.[3] Providers implementing it will benefit from a presumption of conformity with the Article 17 requirements the standard covers.[3] Orrick says providers can rely on compliance with the standard to demonstrate compliance with Articles 11(1) and 17(1).[4] The Commission says the standard satisfies the requirements it aims to cover under the Act, while the Act limits the presumption to requirements covered by the published harmonised standard.[1]

EN 18286 is built around the AI system lifecycle rather than the organisation.[3] The Commission says it is designed to layer on top of existing standards such as ISO/IEC 42001, ISO 9001 or a sectoral quality management system.[3] Providers in regulated sectors can integrate management systems instead of running separate ones, according to the Commission.[3] Organisations without ISO/IEC 42001 that plan to place or put into service high-risk AI systems in the EU can use the standard to expand an existing quality management system or build one.[3] CEN and CENELEC say it translates Article 17 requirements into practical, auditable requirements.[2]

The Commission’s standardisation request covered quality management systems for AI providers, including post-market monitoring processes.[1] Its broader request to CEN and CENELEC covered 10 strategic areas, including risk management, transparency, cybersecurity and conformity assessment.[4] The Commission says the presumption of conformity takes effect from the date the standard’s reference is published in the Official Journal.[1] AI Act requirements for high-risk systems are scheduled to apply from December 2027 and August 2028, according to AI Affairs; the Commission calls the standard a milestone ahead of those requirements and says further harmonised standards are expected.[5][3]