The European Commission has published the first harmonised standard supporting the EU AI Act in the Official Journal of the European Union. Called EN 18286:2026, it sets out a quality management system for providers of high-risk AI systems and addresses requirements in Article 17 of the Act.
Providers that implement the standard will receive a presumption of conformity for the Article 17 requirements it covers. That gives them a legal route to show they meet those requirements, but it does not mean the standard covers every obligation in the AI Act or makes a system compliant with the entire law.
How the standard fits existing systems
CEN and CENELEC developed EN 18286 around the lifecycle of an AI system, rather than the provider’s organisation as a whole. The Commission says it is designed to sit alongside existing systems such as ISO/IEC 42001, ISO 9001 and sector-specific ISO 13485, not replace them.
Providers in regulated industries can integrate its requirements into an existing management system instead of running a separate one. An organisation without ISO/IEC 42001 can also use EN 18286 to extend an existing quality system or build one to address Article 17. The Commission describes it as the only AI quality-management standard with a presumption of conformity; further harmonised standards are expected.
What comes next
The Commission says the standard arrives ahead of the application of high-risk AI requirements, which it lists as December 2027 and August 2028. The source does not explain which providers or systems fall under each date, so organisations will need to check the applicable requirements for their specific systems.
The standard was published through Commission Implementing Decision (EU) 2026/2274. The announcement does not give details on the standard’s price or access conditions.
Why it matters
For providers of high-risk AI systems intended for the EU market, EN 18286 offers a recognised way to address the Act’s quality-management requirements and can be integrated with an existing system. The presumption applies only to the requirements the standard covers; the announcement does not spell out which deadline applies to each provider or provide access and pricing details for the standard.
