On 14 October 2026, the European Commission cited EN 18286:2026, developed by CEN and CENELEC, in the Official Journal. It is the first harmonised standard cited under Regulation (EU) 2024/1689, the AI Act. It addresses the quality management system (QMS) that Article 17 requires from providers of high-risk AI systems. This article sets out its content, the timeline, the other standards under preparation and the practical implications for providers.
1. A harmonised standard cited in the Official Journal
A harmonised standard is a European standard drawn up at the Commission’s request. Under Article 40 of the AI Act, a high-risk AI system that complies with such a standard, once its reference is published in the Official Journal, is presumed to comply with the requirements the standard covers. EN 18286:2026, prepared by the committee CEN/CLC/JTC 21 and published in July 2026, was cited by Commission Implementing Decision (EU) 2026/2274 on 14 October 2026.
Its use remains voluntary, as a provider may demonstrate compliance by other means.
Compliance impact. The presumption applies to Article 17 only, and within the limits of the standard. It does not extend to the classification of AI systems or to the other requirements for high-risk systems, for which no harmonised standard has been cited yet.
2. What the standard covers
Article 17 requires a QMS documented as written policies, procedures and instructions. It covers at least thirteen aspects, which can be grouped into four blocks.
- Compliance and the system lifecycle: compliance strategy, standards applied, design, development, testing and validation.
- Data and risks: data management and the risk management system.
- The system on the market: post-market monitoring, serious incident reporting and communication with authorities.
- The organisation: record-keeping, resource management and management accountability.
The standard turns these aspects into auditable requirements, built on a management-system structure.
- Clause 4: context, scope and regulatory compliance strategy.
- Clauses 5 to 7: leadership, planning and support (resources, competence, communication).
- Clause 8: AI system realisation, from design to documentation.
- Clause 9: operations and control, including supply chain and post-market monitoring.
- Clause 10: performance evaluation.
Informative annexes map the text to EN ISO 9001:2015 and EN ISO/IEC 42001:2026. The standard defines quality as compliance with all AI Act requirements and can be built into an existing sectoral QMS, such as the one for medical devices. It is intended for providers irrespective of their size or location, including those outside the Union that are active on the EU market.
3. Timeline
Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI) postponed the application of the high-risk obligations. Article 17 therefore applies to providers from the dates below.
| Date | Milestone |
| 12 October 2026 | Implementing Decision (EU) 2026/2274 adopted |
| 14 October 2026 | Decision published in the Official Journal and presumption of conformity starts |
| 2 December 2027 | Application to Annex III high-risk AI systems |
| 2 August 2028 | Application to Annex I high-risk AI systems |
4. What it means in practice
Providers of high-risk AI systems get a clear route to meet Article 17, as a QMS built on EN 18286 benefits from a presumption of conformity for the requirements covered. Organisations already applying ISO 9001 or ISO/IEC 42001 can extend their system using the mappings in Annexes B and C. The approach follows six operational steps.
- Qualify the AI systems and confirm the role of provider of high-risk AI systems.
- Define the QMS scope, identify the applicable regulatory requirements and formalise the compliance strategy (clause 4).
- Compare existing management systems with clauses 4 to 10 and address the gaps.
- Assign roles and responsibilities, adopt a quality policy and plan resources and competence (clauses 5 to 7).
- Document lifecycle processes: design, verification and validation, data, modifications, supply chain (clauses 8 and 9).
- Set up post-market monitoring, serious incident reporting, the handling of non-compliance and management review (clauses 9 and 10).
5. More harmonised standards are on the way
EN 18286:2026 is the first deliverable under standardisation request M/613. Work continues on the other standards the AI Act needs, and the request, as amended, runs until 28 February 2027.
| AI Act articles concerned | Corresponding standard |
| Article 17(1); Article 11(1); Article 72 | EN 18286:2026, Quality management system for EU AI Act regulatory purposes |
| Article 9 | prEN 18228, AI risk management |
| Article 10 | prEN 18284, Quality and governance of datasets in AI |
| Article 10(2)(f)-(g) | prEN 18283, Concepts, measures and requirements for managing bias in AI systems |
| Articles 12 to 14 | prEN 18229-1, AI trustworthiness framework, Part 1: logging, transparency and human oversight |
| Article 15 | prEN 18229-2, AI trustworthiness framework, Part 2: accuracy and robustness |
| Article 15 | prEN 18282, Cybersecurity specifications for AI systems |
| Article 43 | prEN 18285, Conformity assessment framework for AI |
Conclusion
EN 18286:2026 gives providers of high-risk AI systems a recognised reference for building their QMS ahead of the December 2027 and August 2028 deadlines. Its legal effect remains limited as the presumption concerns Article 17 alone. The governance task is to connect that QMS to the Regulation’s other requirements, which must still be demonstrated by other means until the corresponding standards are cited.
From mapping to steering with Naaia
Setting up a compliant QMS starts with knowing which AI systems are in scope and which evidence must be documented. The Naaia AI management platform lets organisations map their AI systems, qualify applicable obligations, follow action plans and keep traceability of decisions and evidence.
