EN 18286, the EU AI Act's first harmonised standard, is in the Official Journal: what it covers and what's still missing

The EU AI Act has its first harmonised standard. On October 14, 2026, the European Commission published a reference to EN 18286, a European standard for quality management systems at companies that provide high-risk AI, in the Official Journal of the EU. From that day, a provider that follows EN 18286 is presumed to meet the Act's quality management requirements in Article 17. The Commission announced the step on October 19. It is one of ten areas the Commission asked standards bodies to cover, and the other nine are still in draft.

This story is based on Commission Implementing Decision (EU) 2026/2274 in the Official Journal, the Commission's announcement and standardisation pages, the AI Act text on the Commission's AI Act Service Desk, CEN-CENELEC's announcements, the site of its AI committee JTC 21, and Georg Philip Krog's AI Standardisation Watch newsletter, checked October 20, 2026. For the full timeline of what already applies, see our explainer on the EU AI Act in October 2026.

The short version

• What: EN 18286:2026, "Artificial intelligence – Quality management system for EU AI Act regulatory purposes," developed by the European standards bodies CEN and CENELEC.
• Made official by: Commission Implementing Decision (EU) 2026/2274, adopted October 12, published in the Official Journal and in force October 14, 2026.
• Who it's for: providers of high-risk AI systems, meaning the companies that develop them and put them on the EU market.
• What it gives them: a presumption of conformity with the Article 17 quality management requirements it covers.
• What it doesn't cover: the rest of the high-risk requirements, such as risk management, data, logging, human oversight and cybersecurity. Those standards aren't finished.

What does EN 18286 cover?

It covers the management system that wraps around a high-risk AI system. CEN-CENELEC says the standard "specifies the requirements and provides guidance for the definition, implementation, and maintenance" of a quality management system for organizations that provide AI systems, and that it isn't specific to any sector. The implementing decision says it covers quality management systems for AI providers, "including post-market monitoring processes."

Article 17 of the AI Act lists what such a system must document. That includes a regulatory compliance strategy, design and development controls, testing and validation, data management, the risk management system, post-market monitoring, serious incident reporting, record-keeping, resource management and an accountability framework.

The Commission says EN 18286 is mapped to Article 17 and built around the AI system's lifecycle, not the organization as a whole. It is meant to sit on top of systems companies may already run, such as ISO/IEC 42001, ISO 9001 or the medical-device standard ISO 13485, not replace them. The Commission's standardisation FAQ explains why a new standard was needed: ISO/IEC 42001's goals and definitions don't line up with the Act's quality management requirements. The Commission calls EN 18286 "the only AI QMS standard with a presumption of conformity."

What does "presumption of conformity" mean?

It means regulators start from the assumption that you comply. Under Article 40(1) of the AI Act, high-risk systems that conform to harmonised standards whose references are published in the Official Journal "shall be presumed to be in conformity" with the Act's requirements, "to the extent that those standards cover those requirements." The Commission's FAQ says this shifts the burden of proof to public authorities, which would have to show that a system doesn't conform.

Three limits matter:

• It's voluntary. Providers can meet Article 17 another way, but then they have to show their approach works.
• It's partial. EN 18286 covers quality management only. It gives no presumption for the separate requirements on risk management, data governance, logging, transparency, human oversight, accuracy, robustness or cybersecurity.
• It's for providers. If you only call model APIs and don't build a high-risk system, this standard isn't aimed at you. See what the AI Act means if you only use model APIs.

How did it get here?

Last verified: October 20, 2026

Which standards are still pending?

Most of them. The Commission asked CEN and CENELEC for standards in ten areas: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. The Commission's page says "further harmonised standards" are expected but gives no dates.

The most detailed public status found for this story is in AI Standardisation Watch, a newsletter by Georg Philip Krog that tracks the work of CEN-CENELEC's AI committee, JTC 21. It isn't an official status register. Its September 2026 edition reported:

Last verified: October 20, 2026

CEN-CENELEC hasn't published an official status for these drafts: its October 15 announcement of EN 18286 doesn't mention them, and JTC 21's own site said on October 14 only that "several of the core drafts are being revised after their public enquiries." The same newsletter says CEN-CENELEC is aiming to make its priority deliverables available in the fourth quarter of 2026; that target doesn't appear on a Commission or CEN-CENELEC page. The deadline is firmer: JTC 21's site says the amended standardisation request runs until February 28, 2027. If standards don't arrive or don't satisfy the request, Article 41 lets the Commission adopt "common specifications" by implementing act instead. Those would carry the same kind of presumption.

How does this fit the AI Act timeline?

The standard has arrived well ahead of the deadlines it serves. The AI Omnibus, Regulation (EU) 2026/1744, in force since July 27, 2026, moved the high-risk obligations back. According to the Commission's AI Act Service Desk:

• December 2, 2027: rules for high-risk systems in Annex III, such as AI used in hiring, education, credit and migration.
• August 2, 2028: rules for high-risk AI built into products under Annex I, such as machinery, toys and medical devices.

Other parts of the Act already apply, including the general-purpose AI model rules and the transparency duties covered in our story on AI content marking. The December 2, 2026 deadline for new bans and for marking AI content from older generative systems is unaffected by the standard.

EN 18286 and the AI Act's next dates

1. July 27, 2026AI Omnibus in force; high-risk obligations moved backRegulation (EU) 2026/1744Confirmed
2. October 14, 2026EN 18286 reference published in the Official Journal; presumption of conformity appliesOfficial JournalConfirmed
3. Fourth quarter of 2026CEN-CENELEC aims to make its priority deliverables availableAI Standardisation Watch newsletter, not an official dateReported
4. December 2, 2026New bans and marking of AI content from older generative systems; unaffected by the standardAI ActConfirmed
5. February 28, 2027The Commission's amended standardisation request runs outJTC 21, the CEN-CENELEC AI committee (October 14, 2026)Confirmed
6. December 2, 2027High-risk rules apply to Annex III systems, such as AI used in hiring, education, credit and migrationAI Act Service DeskConfirmed
7. August 2, 2028High-risk rules apply to AI built into Annex I products, such as machinery, toys and medical devicesAI Act Service DeskConfirmed

• Confirmed
• Reported

What's confirmed, reported and uncertain

• Confirmed (Official Journal and Commission): the decision number, its adoption on October 12 and publication on October 14, EN 18286's title and scope, the presumption under Article 40, and the high-risk dates. JTC 21 confirms the standardisation request runs until February 28, 2027.
• Reported (CEN-CENELEC and the AI Standardisation Watch newsletter): EN 18286's approval in June 2026 and publication in July 2026, and the status of the other drafts, which CEN-CENELEC hasn't published.
• Uncertain: when the remaining standards will reach the Official Journal, whether any will be published with restrictions, and whether the Commission will need common specifications for any area.

Nothing here is legal advice.