The EU AI Act now has its first harmonized standard. The European Commission announced on October 19 that it has published the reference to EN 18286:2026, a quality management standard for providers of high-risk AI systems, in the Official Journal of the European Union. Providers that follow it get a legal presumption that they meet the quality management rules in Article 17 of the Act that the standard covers.
That sounds procedural. It is also the first concrete answer to a question that companies have asked since the Act passed: what does "compliant" look like in practice?
What was published
- The standard: EN 18286:2026, "Artificial intelligence: Quality management system for EU AI Act regulatory purposes." The European standards bodies CEN and CENELEC wrote it, through their joint AI committee, JTC 21.
- The legal act: Commission Implementing Decision (EU) 2026/2274, dated October 12, 2026. Its annex lists one standard: EN 18286:2026.
- The date: CEN-CENELEC says the decision appeared in the Official Journal on World Standards Day. AI governance platform Modulos, which publishes a clause-by-clause guide to the standard, gives that date as October 14, 2026. The Commission's own announcement followed on October 19.
The draft, prEN 18286, was the first AI Act standard to enter public enquiry, on October 30, 2025, according to the Commission's standardisation page. Modulos says CEN approved the final text on July 12, 2026.
What "presumption of conformity" means
Under Article 40 of the AI Act, a high-risk AI system that conforms to a harmonized standard whose reference is in the Official Journal is presumed to meet the requirements that standard covers. Recital 6 of the decision, as quoted by Modulos, says the presumption runs from the date the reference is published.
In plain terms: if a regulator asks how your quality management system meets Article 17, "we implemented EN 18286" becomes a strong answer. You do not have to argue from first principles that your own process satisfies the law.
Two limits apply.
- It is voluntary. The Commission says providers "can choose any other framework to demonstrate their compliance." The standard is one route, not the only one.
- It covers only what it covers. The presumption reaches only the provisions mapped in the standard's Annex ZA, and Modulos notes that it lasts only while the Official Journal keeps the reference.
What EN 18286 covers, and what it leaves out
According to Modulos, Annex ZA has a table with 19 rows that map clauses of the standard to provisions of the Act.
- Covered: the duty in Article 17(1) to have a quality management system, its written documentation, and all 13 required elements, points (a) to (m). Those include a compliance strategy, design and testing procedures, data management, the risk management system, post-market monitoring, serious incident reporting, record keeping, resources, and an accountability framework.
- Also covered: the first sentence of Article 11(1), on technical documentation, on the condition that the documentation contains every item in Annex IV of the Act.
- Conditions: four rows carry conditions. For example, the risk management row is covered only if the risk management system used complies with Article 9.
- Not covered: Article 17(2) (the rule that the system be proportionate to the size of the provider), Article 17(3) (providers already under sectoral EU quality rules), and Article 17(4) (financial institutions).
The standard is written for providers of high-risk AI systems. Modulos notes that it does not treat providers of general-purpose AI models as its audience. A deployer, importer or distributor can still need it if Article 25 of the Act makes them a provider, for example by putting their own name on a high-risk system or making a substantial modification to one.
How it fits with ISO 42001 and ISO 9001
Many companies already hold ISO/IEC 42001 (AI management) or ISO 9001 (general quality management) certificates. The Commission says EN 18286 is "designed to be layered on top" of those standards, or a sectoral one such as ISO 13485 for medical devices, rather than replace them. It also says EN 18286 is built around the AI system lifecycle, not the organization, and is "the only AI QMS standard with a presumption of conformity."
That last point matters for buyers of compliance services. Since EN 18286 is the only one with that presumption, an ISO/IEC 42001 certificate does not by itself give a presumption of conformity under the AI Act. Per Modulos, the standard includes informative annexes that map its clauses to ISO 9001:2015 and ISO/IEC 42001, but the mapping is clause to clause and does not make the standards equivalent.
The Commission says companies without ISO/IEC 42001 can use EN 18286 to expand an existing quality system or to build one.
The timeline
The high-risk rules themselves are not in force yet. After the Digital Omnibus, they apply from December 2, 2027 for stand-alone uses listed in Annex III (such as biometrics, critical infrastructure, education and employment) and from August 2, 2028 for AI built into products covered by EU product law in Annex I. Our EU AI Act deadline explainer has the full schedule.
That leaves providers a little over a year to build a quality system against a fixed text, which is the point of publishing it now.
Why it matters
- One of ten. The Commission asked CEN and CENELEC for standards in ten areas: risk management, data governance, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. Only the quality management standard is cited so far. The Commission says the publication comes "with further harmonised standards expected to follow."
- The rest still needs another route. Until more standards are cited, providers must show they meet the other high-risk requirements, such as data governance and human oversight, by their own means. Article 15, for example, asks for measures against attacks such as data poisoning; our guide to AI agent red-teaming covers how teams test for them.
- It sets the template. EN 18286 shows how the remaining standards are likely to work: a voluntary text, a mapping annex to specific articles, and a presumption limited to what is mapped.
For a company that sells a high-risk AI system in the EU, the practical step is simple. Get the standard, compare it with the quality processes you already run, and close the gaps before December 2027.
Sources
- European Commission: First harmonised standard supporting the AI Act published in the Official Journal
- EUR-Lex: Commission Implementing Decision (EU) 2026/2274
- CEN-CENELEC: First ever European standard on AI published in the OJEU
- European Commission: Standardisation of the AI Act
- Modulos: EN 18286 Quality Management System for EU AI Act
- Modulos: EN 18286 Annex ZA and presumption of conformity
