EU publishes first AI Act harmonized standard, EN 18286:2026

The European Commission has published the first harmonized technical standard under the EU AI Act, a quality management system for makers of high-risk AI. The Commission said Monday that it published the reference to EN 18286:2026 in the Official Journal of the European Union.

Providers that follow the standard will benefit from a “presumption of conformity” with the AI Act’s Article 17 quality management requirements covered by it, the Commission said. That gives companies a defined way to show they meet that part of the law.

The standard: EN 18286:2026 is titled “Artificial intelligence – Quality management system for EU AI Act regulatory purposes.” European standards bodies CEN and CENELEC developed it. The Commission gave it legal effect through Implementing Decision (EU) 2026/2274.

The Commission says it is the only AI quality management standard with a presumption of conformity. It is mapped to Article 17 and built around the life cycle of an AI system rather than the organization.

It is meant to sit on top of existing standards, such as ISO/IEC 42001, ISO 9001 or sector systems like ISO 13485 for medical devices, rather than replace them. Companies in regulated sectors can merge management systems instead of running separate ones, the Commission said.

Organizations without ISO/IEC 42001 that plan to sell or deploy high-risk AI systems in the EU can use the standard to expand an existing system or build one, according to the Commission.

The rule behind it: Article 17 of the AI Act requires providers of high-risk AI systems to run a documented quality management system. Under the law’s text, that system covers a compliance strategy, design and testing procedures, data management, risk management, post-market monitoring, incident reporting and record keeping. High-risk systems include AI used in areas such as hiring, credit and critical infrastructure.

Until now, providers had no harmonized standard to point to for those duties. EN 18286 translates those requirements into an operational quality management system, the Commission said.

What it means: Harmonized standards are voluntary. Companies may meet the law another way, but then must show compliance without the presumption. This standard covers only quality management. It does not address other high-risk duties, such as data governance, accuracy or human oversight.

The Commission called the publication “an important milestone in implementing the AI Act,” coming ahead of the application of requirements for high-risk AI systems.

What’s next: More harmonized standards are “expected to follow,” the Commission said. It did not give a timeline.

Sources: European Commission, Shaping Europe’s digital future