The European Commission has published the first harmonised standard under the Artificial Intelligence Act (AI Act). It is EN 18286:2026, drawn up by the European standardisation organisations CEN and CENELEC, and it covers the quality management system that Article 17 requires from providers of high-risk AI systems. Its reference appeared in the Official Journal of the EU on 14 October 2026, through Commission Implementing Decision (EU) 2026/2274. From that day, a provider that applies it benefits from a presumption of conformity with the Article 17 requirements the standard covers. High-risk obligations do not apply until 2 December 2027, but the quality management system organises the compliance strategy, design, testing, data and monitoring of the system, and it is worth starting to build it now.
If you need an AI Act lawyer to bring your AI system into line with the Regulation, ask for a free initial assessment.
Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 publishes in the Official Journal of the EU the reference of a harmonised standard for high-risk AI systems. It appeared in the L series on 14 October 2026 and entered into force the same day, as its Article 2 provides.
Its annex lists a single standard, EN 18286:2026, «Artificial intelligence – Quality management system for EU AI Act regulatory purposes». It answers the standardisation request the Commission addressed to CEN and CENELEC on 23 June 2025, Implementing Decision C(2025) 3871. One item of that request asked for standards on the quality management systems of providers of AI systems, including post-market control processes.
The Commission announced it on 19 October 2026 in a note on the first harmonised standard supporting the AI Act. According to the note, the standard gives providers of high-risk AI systems a clear legal pathway to meet the quality management system requirements of Article 17, and further harmonised standards are expected to follow.
A harmonised standard is a European technical standard drawn up at the Commission’s request to support a regulation, whose reference is published in the Official Journal. Its effect is set by Article 40(1) of the AI Act. High-risk AI systems that conform to published harmonised standards are presumed to comply with the requirements of the Regulation to the extent that those standards cover them.
That presumption has two practical consequences. The first concerns proof. A provider applying the standard does not have to show from scratch that its quality management system meets Article 17, because compliance is presumed for what the standard covers. The second is that the standard is voluntary. A provider can meet Article 17 by other means, but will have to demonstrate it without the support of that presumption. Article 17(1)(e) itself provides for this, by requiring the system to set out the standards applied and, where harmonised standards are not applied in full, the means used to comply.
The presumption applies from the date the reference is published, 14 October 2026, as recital 6 of the Decision recalls. And it only reaches what the standard covers. The Commission speaks of a presumption of conformity with the Article 17 requirements covered by the standard, not with the rest of the provider’s obligations.
Article 17 requires providers of high-risk AI systems to put in place a quality management system documented in a systematic and orderly manner, with written policies, procedures and instructions. At a minimum, it must include the following aspects.
| Point | What the system must cover |
|---|---|
| (a) | The strategy for regulatory compliance, including conformity assessment and the management of modifications to the system |
| (b) and (c) | The techniques and procedures for design, design control and verification, development, and quality control and assurance |
| (d) | The examination, test and validation procedures before, during and after development, and how often they are carried out |
| (e) | The technical specifications and standards applied, and how compliance is ensured where harmonised standards do not cover everything |
| (f) | Data management, from acquisition and labelling to storage and retention |
| (g) | The risk management system referred to in Article 9 |
| (h) and (i) | Post-market monitoring under Article 72 and the reporting of serious incidents under Article 73 |
| (j) | Communication with authorities, notified bodies, customers and other interested parties |
| (k) | Record-keeping of all relevant documentation and information |
| (l) | Resource management, including security-of-supply measures |
| (m) | An accountability framework setting out the responsibilities of management and other staff |
Paragraph 2 introduces proportionality. Since the Digital Omnibus on AI, Regulation (EU) 2026/1744, it states that those aspects are to be implemented in proportion to the size of the provider’s organisation, in particular where the provider is an SME, including a start-up, or a small mid-cap enterprise (SMC). Proportionality does not lower the outcome. The provider must still respect the degree of rigour and the level of protection needed for the system to comply.
There are also two integration rules. A provider that already has a quality management system under sectoral EU law may include the Article 17 aspects in it, under paragraph 3. And financial institutions subject to internal governance rules are deemed to comply if they follow those rules, except for risk management, post-market monitoring and incident reporting, points (g), (h) and (i), under paragraph 4.
Many technology companies already work with ISO 9001 on quality management or ISO/IEC 42001 on AI management systems. The Commission’s note explains the relationship. EN 18286 is mapped to Article 17, built around the AI system lifecycle rather than the organisation, and designed to be layered on top of those international standards or a sectoral system, such as ISO 13485 for medical devices, rather than replace them.
Three useful points follow. ISO/IEC 42001 does not appear in Decision 2026/2274, so on its own it does not give the presumption of conformity under Article 40. Companies that already hold it can build on their system and complete it with EN 18286. Companies with neither can use EN 18286 to build a system that meets Article 17 or to extend the one they have, as the Commission envisages. And in regulated sectors the standard allows management systems to be integrated instead of running two in parallel.
Article 17 is addressed to providers, that is, whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. To know whether a system is high-risk, you need to look at the two routes in Article 6, which we explain in our guide to high-risk AI systems.
High-risk obligations do not apply yet. Following the Digital Omnibus on AI, they apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, those that are part of regulated products. There is time, but a documented quality management system, with its procedures for testing, data, risks and monitoring, is not built in a few weeks. The standard already makes it possible to design it against a benchmark that carries a presumption of conformity.
The deployer, the company using the system under its authority, does not have to set up this quality management system, but it has every reason to ask for it. A provider applying EN 18286 is an objective factor when choosing one, and the contract should state how the provider evidences it, what documentation it hands over and what happens if it stops complying. We cover this in our SaaS contract lawyer service. Watch out for Article 25: a deployer becomes a provider if, for example, it puts its name or trademark on a high-risk system or substantially modifies it.
The Commission presents EN 18286 as the Article 17 standard. The technical requirements for the system itself, in Section 2 of Chapter III, are left to further harmonised standards that the Commission expects to publish, without a timetable. They are risk management (Article 9), data and data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency towards deployers (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15).
The Digital Omnibus on AI also added a request to Article 40(2). The Commission will ask for standardisation deliverables that make it easier to comply at the same time with Sections 2 and 3 of Chapter III of the AI Act and with the product legislation in Annex I, such as the rules on machinery or medical devices. This matters for manufacturers of regulated products with embedded AI.
A fictitious company based in Valencia, Criba Analytics, sells human resources departments an AI-based tool that ranks job applications. It is a high-risk system under Annex III, in the employment area, as we explain in our AI Act compliance guide, and Criba is its provider. It has held ISO 9001 certification for years and was planning to obtain ISO/IEC 42001 to comply with the Regulation.
When it learns of Decision 2026/2274, it changes the order. It keeps ISO 9001 as the foundation and builds the EN 18286 system on top, since that is the one with a presumption of conformity with Article 17. It documents how training data is managed, the test plan for each release, post-market monitoring and the channel for reporting serious incidents, and it sets out who is responsible for each. Its customers start asking for this in their contracts, and Criba prepares an annex describing its quality management system and the documentation it will deliver before 2 December 2027.
None of this is mandatory today, but the work pays off with or without the standard.
The fines the Regulation sets for breaches of the high-risk obligations are explained in our article on AI Act penalties.
No. Harmonised standards are voluntary. What is mandatory is Article 17, for providers of high-risk AI systems, once their obligations apply. Applying EN 18286 gives a presumption of conformity with the Article 17 requirements it covers. A provider that does not apply it can comply by other means, but will have to demonstrate it without that presumption.
From 14 October 2026, the day its reference was published in the Official Journal of the EU through Implementing Decision (EU) 2026/2274, which entered into force on that date. The obligation to have a quality management system arrives with the other high-risk obligations, on 2 December 2027 for Annex III and on 2 August 2028 for Annex I.
On its own it does not give the presumption of conformity, because it is not a harmonised standard published in the Official Journal. According to the Commission, EN 18286 is designed to be layered on top of ISO/IEC 42001, ISO 9001 or a sectoral system, not to replace them. An ISO/IEC 42001 system is a good basis, but it needs to be completed with what EN 18286 requires.
No. Article 17 applies to providers. The deployer has its own obligations and becomes a provider in the cases set out in Article 25, for example if it puts its name or trademark on the system or substantially modifies it. Even so, it is advisable to ask the provider to evidence its quality management system and to put this in writing in the contract.
Yes, according to the Commission, which expects more standards without giving a timetable. Standardisation request C(2025) 3871 asked CEN and CENELEC for several standards for high-risk systems, and EN 18286 answers the item on quality management systems. The Digital Omnibus on AI also provides for standardisation deliverables to comply at the same time with the AI Act and the product legislation in Annex I.
EN 18286 is the first official technical benchmark for meeting an AI Act obligation, and it arrives more than a year ahead of the high-risk deadlines. The sensible move is to use that time to organise the quality management system on what already exists, rather than wait for the standards still to come. At Innovatech we advise companies that develop and companies that buy AI systems on bringing them into line with the Regulation, as part of our AI Act lawyer service. Tell us about your case and we will give you a free initial assessment.
Marta Suárez-Mansilla is Managing Partner of Innovatech Legal and a Spanish lawyer (abogada), Madrid Bar (ICAM), working in technology law. She completed Harvard Law School's Copyright course and BerkeleyX's Blockchain programme, and has advised technology companies for more than eight years.