EN 18286, the first AI Act harmonised standard: what it covers and who needs it

The EU AI Act says what providers of high-risk AI systems must do. Harmonised standards say how, in enough detail to build a process around. The first one is now official: EN 18286:2026, a quality management system standard for AI Act purposes, was referenced in the Official Journal on 14 October 2026. For the providers it applies to, following it now carries legal weight. For most engineering teams that use AI tools, it is a useful map of what regulators will consider good practice, not an obligation. This article explains what was published, what it covers and who should act.

What was published

The Commission's announcement of 19 October describes EN 18286:2026, which it titles "Artificial intelligence - Quality management system for EU AI Act regulatory purposes", developed by the European standardisation bodies CEN and CENELEC. Its reference was published through Commission Implementing Decision (EU) 2026/2274, adopted on 12 October and published in the Official Journal on 14 October 2026. The decision entered into force on the day of publication.

Note the dates. The Commission's page is dated 19 October, but the legal effect follows the Official Journal. The decision itself explains that following a harmonised standard confers a presumption of conformity from the date the standard's reference is published in the Official Journal, not from the date of any later announcement. That date is 14 October.

What a presumption of conformity means

Under Article 40 of the AI Act, a high-risk AI system that conforms with a harmonised standard whose reference is in the Official Journal is presumed to meet the requirements the standard covers. The decision restates this in its recitals.

The Commission's standardisation page is clear that standards stay voluntary: "Providers can choose any other framework to demonstrate their compliance with the AI Act." What the harmonised standard adds is legal certainty. A provider that follows it does not have to argue from first principles that its quality system meets Article 17. A provider that uses something else can still comply, but carries the burden of showing how.

The Commission says EN 18286 is "the only AI QMS standard with a presumption of conformity", and that it is built around the AI system's lifecycle rather than the organisation. It is designed to sit on top of existing management system standards such as ISO/IEC 42001, ISO 9001 or a sectoral one like ISO 13485, not to replace them. Organisations without ISO/IEC 42001 can use it to extend an existing quality system or build one.

What Article 17 asks for

EN 18286 maps to Article 17 of the AI Act, which requires providers of high-risk AI systems to run a documented quality management system. The article lists thirteen aspects it must cover at least. Several read like an engineering team's own process documents:

• a strategy for regulatory compliance, including how changes to the system are managed;
• techniques and procedures for design, design control and design verification;
• development, quality control and quality assurance procedures;
• examination, test and validation before, during and after development, and how often;
• data management, from collection and labelling to storage and retention;
• the risk management system, post-market monitoring and serious incident reporting;
• record-keeping of all relevant documentation, resource management, and an accountability framework naming who is responsible for what.

Since the AI Omnibus, the text on the AI Act Service Desk says implementation must be proportionate to the provider's size, naming SMEs, start-ups and small mid-caps, while still providing the rigour needed for compliance. Providers already under a sectoral quality system can include these aspects in it, and financial institutions can largely meet the obligation through their existing internal governance rules.

Who needs to act, and when

The standard is for providers of high-risk AI systems, as the Act defines providers in Article 3. A company that builds a system and puts it on the EU market or into service is the typical case. After the AI Omnibus, the Commission's timetable has high-risk rules for Annex III systems applying from 2 December 2027, and for high-risk AI in products covered by Annex I from 2 August 2028. We covered those changes in the AI Act after the AI Omnibus.

Most uses of AI coding assistants, code review bots and internal chat tools are not high-risk systems under Annex III. A company that only uses such tools is not a provider of a high-risk system because of them. The teams that should look at EN 18286 now are:

• companies building AI systems in the areas Annex III lists, such as critical infrastructure, education, employment or access to essential services;
• manufacturers whose regulated products include AI;
• suppliers to either, who will be asked for evidence that fits a customer's quality system.

There is a boundary close to engineering worth repeating. Annex III includes AI intended to make decisions on promotion or termination, or to monitor and evaluate the performance and behaviour of people at work. Productivity analytics built on AI tool data should be designed with that in mind.

What is still missing

EN 18286 covers one of the ten areas the Commission has asked CEN and CENELEC to standardise. The others, including risk management, data governance, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment, are still to come. The Commission says further harmonised standards are "expected to follow", without dates. The draft, prEN 18286, entered public enquiry on 30 October 2025, so the path from public enquiry to the Official Journal took close to a year.

Until the other standards arrive, a quality system built on EN 18286 will have to refer to other frameworks for the technical requirements. Article 17 expects exactly this: where harmonised standards are not applied in full, the quality system must say what is used instead.

What it means for engineering and security leaders

• If you are a provider, this is now the reference process. Following EN 18286 is the most direct route to showing that your quality system meets Article 17. Plan the gap analysis against your current process.
• If you already run ISO/IEC 42001 or ISO 9001, you are not starting from zero. The standard is designed to layer on top of them. The work is mapping, not rebuilding.
• If you only use AI tools, the list is still useful. Change management, test and validation records, data handling and named accountability are good practice for any team running AI in production, and they make later customer or audit questions easier to answer.
• Watch the next standards. Record-keeping, human oversight and cybersecurity are likely to matter most to the teams that build and operate AI systems day to day.

Practical takeaways

• Decide, in writing, whether anything you build or sell could be a high-risk AI system under Annex III or Annex I. Involve legal and compliance in that decision.
• If it could, obtain EN 18286 and compare it with your existing quality management system.
• Record the dates that matter: 14 October 2026 for the presumption of conformity, 2 December 2027 for Annex III and 2 August 2028 for Annex I.
• Map your current engineering documentation to the thirteen aspects in Article 17(1) and note the gaps.
• Track the Commission's standardisation page for the remaining harmonised standards.

This article is a summary for engineering readers, not legal advice. Read the primary texts and take advice that fits your organisation.