AI Act: EN 18286 is the first harmonised standard, for quality management
Since 14 October 2026, providers of high-risk AI that follow EN 18286:2026 are presumed to meet the AI Act's quality management rules (Article 17).
The AI Act has its first harmonised standard. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 published the reference of EN 18286:2026, Artificial intelligence: Quality management system for EU AI Act regulatory purposes in the Official Journal on 14 October 2026. The decision entered into force that day.
What changed
Under Article 40 of the AI Act, a high-risk AI system that follows a harmonised standard published in the Official Journal is presumed to meet the requirements that standard covers. EN 18286, drafted by CEN and Cenelec at the Commission's request, covers the quality management system that providers of high-risk AI must have under Article 17.
According to the Commission, the standard:
- is built around the life cycle of the AI system rather than the organisation;
- is designed to sit on top of existing management systems, such as ISO/IEC 42001, ISO 9001 or a sector system like ISO 13485, rather than replace them;
- lets organisations without ISO/IEC 42001 extend an existing quality management system or build a new one that meets Article 17.
The Commission calls it the only AI quality management standard with a presumption of conformity and expects further harmonised standards to follow.
Who it matters for, and when
The standard concerns providers of high-risk AI systems: those who build or place them on the market. Organisations that only use AI tools have deployer duties instead. After the Digital Omnibus, the high-risk rules apply from 2 December 2027 for Annex III uses, such as recruitment, education and credit scoring, and from 2 August 2028 for AI in products under Annex I.
The Commission's guidelines on which systems count as high-risk are still a draft, published for feedback on 19 May 2026. All dates: AI Act after the Digital Omnibus.
What to do now
First settle your role and whether any system is high-risk; only then is EN 18286 relevant. If you are a provider, compare your current quality management system with the standard and plan the gaps before December 2027. Dazr Compliance starts with an AI inventory and a guided classification check on every plan, and its Enterprise plan carries the full provider set, from the quality management system to conformity assessment, as tasks with owners and evidence.
Sources
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026
- European Commission: First harmonised standard supporting the AI Act published in the Official Journal
- European Commission: AI Act, regulatory framework and timeline
- European Commission: Draft guidelines on the classification of high-risk AI systems
- Regulation (EU) 2024/1689 (AI Act), Articles 17 and 40
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål