First EU AI Act standard is official: One of ten promised is out

The European Commission has published the reference to the first harmonised standard for the AI Act in the Official Journal. EN 18286:2026 covers quality management systems and gives high-risk AI providers a presumption of conformity with Article 17.

A quality system designed to sit on top of ISO standards

The standard is titled Artificial intelligence – Quality management system for EU AI Act regulatory purposes. CEN and CENELEC, the European standardisation bodies, developed it. It becomes usable as a legal route through Commission Implementing Decision (EU) 2026/2274. Providers who implement it benefit from a presumption of conformity with the parts of Article 17 that the standard covers. Article 17 is the AI Act provision on quality management systems for high-risk AI.

The Commission describes EN 18286 as an operational version of those requirements, organized around the lifecycle of the AI system rather than around the organization. It is not meant to replace existing frameworks. The Commission says it is designed to sit on top of international standards such as ISO/IEC 42001 and ISO 9001, or a sectoral system such as ISO 13485 for medical devices. Providers in regulated sectors can fold it into the system they already run instead of maintaining a second, parallel one.

Companies without ISO/IEC 42001 are also covered. According to the Commission, they can use EN 18286 either to extend a quality system they already have or to build their first one, as long as they plan to market high-risk AI in the EU or deploy it there. The Commission’s own wording on its exclusivity is blunt:

It is the only AI QMS standard with a presumption of conformity.

Use of the standard remains voluntary. The Commission’s standardisation page says companies that apply harmonised standards are presumed to comply with the matching legal requirements, but they are not obliged to use them. A provider can still show compliance by other means, though it then carries the burden of demonstrating it.

One of ten requested areas, after a delayed start

The standard is a single piece of a larger puzzle. The Commission’s standardisation request to CEN and CENELEC, referenced as C(2025)3871, covers ten areas: risk management, data governance and dataset quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. Quality management is therefore the first of those ten areas to reach the Official Journal. The Commission says further harmonised standards are expected, but it gives no schedule in the announcement.

The path to this point was slower than planned. The draft, then called prEN 18286, entered public enquiry on 30 October 2025, the first harmonised AI standard to do so, according to the Commission’s standardisation page. The compliance consultancy DQS reported that the joint technical committee, JTC 21, missed its autumn 2025 deadline and that delivery of the full set was expected by the end of 2026 at the earliest. That is a secondary source and the Commission does not confirm the figure.

What changes for providers before the deadlines

For providers of high-risk systems, the practical effect is that one compliance question now has a recognized answer. Teams that already run ISO/IEC 42001 or ISO 9001 do not have to start over, since the standard is built to be layered on top. Medical device makers working to ISO 13485 get the same integration option. Organizations with no management system at all can treat EN 18286 as a blueprint instead of designing their own reading of Article 17.

The timing matters because of the dates in the announcement. The Commission places the application of high-risk requirements at December 2027 and August 2028, depending on the type of system. Those dates are later than the original date of 2 August 2026 in the AI Act. DQS, summarizing the Digital Omnibus on AI, links the postponement to the lack of finished standards and guidance, saying providers would otherwise have faced the deadline without a clear benchmark. The Commission’s announcement does not itself explain the delay, so that link rests on the secondary source.

Several things remain open. The announcement does not say how much of Article 17 the standard covers, so the phrase “requirements covered by the standard” leaves room for gaps that providers must fill themselves. The standard also addresses only quality management. A provider still needs technical standards or other evidence for risk management, data quality, human oversight, accuracy and cybersecurity, and none of those has a published reference yet. Nor does the announcement say how national authorities or notified bodies will treat the presumption in practice.

The Commission’s work is also not the only EU activity on the subject. Earlier coverage on aiholics looked at how the Commission uses AI internally, and at the EU’s investigation of Google’s AI summaries, which shows the same institution acting under other rules.

For now, the signal is narrow but concrete: the first piece of the AI Act’s technical rulebook is legally in force as a compliance route, and nine requested areas still wait for theirs.