On 14 October 2026, the Official Journal of the European Union published Commission Implementing Decision (EU) 2026/2274 of 12 October 2026. Behind the administrative title lies an event awaited since the AI Act was adopted: it lists the reference of the first harmonised standard drafted in support of the Regulation. The standard is EN 18286:2026, “Artificial intelligence — Quality management system for EU AI Act regulatory purposes”, developed by CEN and CENELEC. The Commission announced it on 19 October.
For a provider of a high-risk AI system, this is not standardisation news. It is a legal tool.
Also available in Français and Nederlands.
What a harmonised standard changes
The AI Act works like most texts of the EU “new legislative framework”: the Regulation sets the requirements, harmonised standards say how to meet them. Article 40 draws the consequence: a high-risk AI system that conforms to a harmonised standard whose reference has been published in the Official Journal is presumed to comply with the requirements that standard covers.
Three points that matter in practice.
- The presumption only applies to the extent that the standard covers the requirement. EN 18286 addresses the quality management system under Article 17. Applying it does not, by itself, establish a presumption of compliance with all requirements applicable to the AI system, including those concerning data, risk management or cybersecurity. The quality management system must nevertheless organise how these matters are addressed.
- Applying the standard remains voluntary. A provider may demonstrate compliance with Article 17 by other means; it must then document how its chosen approach meets the applicable requirements, without benefiting from the presumption attached to the standard.
- The presumption can be challenged. It makes it easier to demonstrate compliance with the requirements covered, provided the provider can show that the standard has been effectively and correctly applied.
EN 18286 in a few lines
The standard translates the requirements of Article 17 into an operational quality management system. As the Commission presents it, it is built around the lifecycle of the AI system rather than the organisation, and designed to be layered on existing systems — ISO/IEC 42001 (AI management), ISO 9001 (quality) or a sectoral system such as ISO 13485 for medical devices — rather than to replace them. A company in a regulated sector can therefore integrate its management systems instead of running several in parallel.
As at 22 October 2026, it is the only AI quality management system standard carrying a presumption of conformity. The draft (prEN 18286) entered public enquiry on 30 October 2025. Further harmonised standards are expected on the other topics covered by the standardisation request addressed to CEN-CENELEC: the request covers ten topics, from risk management to conformity assessment.
Article 17, briefly
Article 17 requires every provider of a high-risk AI system to have a documented quality management system — written policies, procedures and instructions — covering, among other things: the regulatory compliance strategy (conformity assessment, change management), design and design control, development and quality assurance, examination, testing and validation, the technical specifications and standards applied, data management, the risk management system, post-market monitoring, serious incident reporting, communication with authorities and third parties, record-keeping, resource management and an internal accountability framework.
Three nuances worth knowing. Paragraph 2, as amended by the digital omnibus (see below), requires measures proportionate to the size of the organisation — including SMEs, start-ups and small mid-caps — without lowering the expected level of rigour. Paragraph 3 allows providers already subject to quality management obligations under sectoral Union law to integrate the AI Act requirements into those systems; voluntary ISO certification does not, on its own, bring a provider within that provision. Paragraph 4 concerns financial institutions subject to internal governance requirements under Union financial services law: complying with those rules fulfils the quality management system obligation, except for risk management, post-market monitoring and serious incident reporting. Harmonised standards referred to in Article 40 must be taken into account for this purpose.
The timeline, after the digital omnibus
The applicable text is no longer the 2024 version. Regulation (EU) 2026/1744 of 8 July 2026 (the “digital omnibus on AI”) amended the AI Act, including Article 113. In the version consolidated as at 27 July 2026, Chapter III, Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to those falling under Article 6(1) and Annex I. The quality management system obligation in Article 17 follows this timetable, subject to the transitional provisions in Article 111, notably for systems already placed on the market or put into service.
Publishing a harmonised standard more than a year before the first deadline is exactly what the postponement was meant to achieve: giving providers time to build compliance on stable references rather than on interpretations.
In practice
- Qualify first. Article 17 concerns providers of high-risk AI systems. An operator acting solely as a deployer is not subject to this obligation, unless it becomes a provider under Article 25, notably following a substantial modification or certain changes to the intended purpose. It is well advised to ask its providers what they rely on, and to record this in the contract.
- Already certified to ISO 9001, ISO/IEC 42001 or ISO 13485? Start with a gap analysis against EN 18286 and determine how to extend the existing system. This integration follows the approach presented by the Commission. The option in Article 17(3) specifically concerns systems required under sectoral Union law.
- Starting from scratch? EN 18286 provides a framework specifically designed to structure compliance with Article 17 and benefit from a presumption for the requirements covered, provided the relevant clauses are effectively complied with.
- Document your choices. The presumption only extends to the requirements covered by the standard. Keep evidence of its effective application and also document compliance with the other applicable requirements: risks, data, transparency, human oversight and robustness.
- To obtain the standard: consult national standardisation bodies, including NBN in Belgium, and check the availability of the EN 18286:2026 edition.
Sources
- European Commission, “First harmonised standard supporting the AI Act published in the Official Journal”, 19 October 2026.
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689, OJ L, 2026/2274, 14.10.2026.
- Regulation (EU) 2024/1689 (AI Act), Articles 17, 25, 40, 111 and 113, consolidated version as at 27 July 2026 (AI Act Service Desk).
- Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, 2018/1139 and 2023/1230 (digital omnibus on AI).
- European Commission, “Standardisation of the AI Act”, updated 19 October 2026.
This article presents a topic in general terms and does not constitute legal advice. Every situation calls for its own analysis.
Jeoffrey Vigneron
Attorney at the Brussels Bar — Lawgitech