EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, is the first harmonised European standard developed in support of the EU AI Act to reach publication and citation.
It was approved by CEN and CENELEC on 12 July 2026, published as EN 18286:2026, and cited in the Official Journal of the European Union on 14 October 2026. That citation is the step that matters legally. From it, a provider of a high-risk AI system that conforms to the standard benefits from a presumption of conformity with the requirements it covers, under Article 40 of the AI Act.
The standard operationalises Article 17, the quality management system obligation on providers of high-risk AI systems. It also covers the first sentence of Article 11(1) on technical documentation.
It does not cover everything. Articles 17(2), 17(3) and 17(4) are expressly outside its scope, and it carries no mapping to Article 72 on post-market monitoring. A provider conforming to EN 18286 has not thereby discharged every Article 17 obligation, and the gaps have to be closed separately.
For providers with Annex III high-risk systems facing the 2 December 2027 deadline, this is the first piece of usable runway the standardisation process has produced.
Official standard: EN 18286:2026, CEN
EN 18286: Key Definitions
| Term | Definition |
|---|---|
| Harmonised standard | A European standard developed by a recognised European standardisation organisation following a request from the European Commission, and cited in the Official Journal in support of a specific piece of Union legislation |
| Presumption of conformity | The legal effect under Article 40 of the AI Act whereby a high-risk AI system conforming to a harmonised standard, or part of it, is presumed to comply with the requirements that standard covers |
| Official Journal citation | Publication of the standard’s reference in the Official Journal of the European Union, which is the step that activates presumption of conformity. Publication of the standard itself does not |
| CEN | European Committee for Standardization |
| CENELEC | European Committee for Electrotechnical Standardization |
| CEN/CLC/JTC 21 | The joint technical committee of CEN and CENELEC responsible for artificial intelligence standardisation |
| M/613 | The European Commission’s standardisation request to CEN and CENELEC in support of the AI Act |
| Quality management system (QMS) | Under Article 17 of the AI Act, the documented system of policies, procedures and instructions that a provider of a high-risk AI system must operate to ensure compliance with the Regulation |
| New Legislative Framework | The EU’s framework for product legislation, built on conformity assessment, CE marking, market surveillance and the use of harmonised standards |
| AIMS | AI management system, the subject of ISO/IEC 42001. An organisation-level governance system, distinct from a product-level QMS |
Why the 14 October 2026 EN 18286 Citation Matters
A standard being published and a standard being harmonised are different events with different legal consequences, and the distinction has been the source of considerable confusion about EN 18286 since July.
| Event | Date | Legal effect |
|---|---|---|
| Public enquiry | 30 October 2025 to 22 January 2026 | None. Consultation stage |
| Approval by CEN and CENELEC | 12 July 2026 | Standard becomes available for purchase and use |
| Publication as EN 18286:2026 | July 2026 | Standard exists as a European Standard. No presumption of conformity |
| Citation in the Official Journal | 14 October 2026 | Presumption of conformity attaches under Article 40 |
Between July and October, EN 18286 was a European Standard that organisations could implement, with no legal benefit beyond the quality of the framework itself. The Commission still had to assess formally whether the standard met the AI Act’s objectives and legal requirements. That assessment is now complete.
Article 40(1) of the AI Act sets out the effect:
“High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter or, as applicable, with the obligations set out in Chapter V, Sections 2 and 3, of this Regulation, to the extent that those standards cover those requirements or obligations.”
Two qualifications in that text carry weight. The presumption attaches to the extent that the standard covers the requirements, which is why the coverage gaps discussed below matter. And it attaches to conformity with the standard, which means the provider has to actually conform, not merely reference it.
What EN 18286 Is
EN 18286:2026 was prepared by CEN/CLC/JTC 21 under standardisation request M/613, the Commission’s request to CEN and CENELEC for standards supporting the AI Act. Its ICS classification is 35.240.01.
The scope statement:
“This document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems.”
The standard is written to the logic of the New Legislative Framework, which is the structural point most commentary misses. It is a product compliance standard rather than a general governance standard, and it redefines quality to mean one specific thing: fulfilment of the applicable regulatory requirements, including the protection of health, safety and fundamental rights.
That definition is deliberate and consequential. A system can be excellent by any ordinary engineering measure and non-conforming under EN 18286, because the standard’s benchmark is the AI Act rather than fitness for purpose.
EN 18286 Structure
The standard follows the harmonised management system structure used across ISO and CEN management standards, which makes it recognisable to anyone who has implemented ISO 9001 or ISO/IEC 27001.
| Clause | Subject |
|---|---|
| 1 to 3 | Scope, normative references, terms and definitions |
| 4 | Context. Establishing the QMS, identifying applicable regulatory requirements, defining scope, setting the compliance strategy, controlling documented information |
| 5 | Leadership. Management commitment, policy, roles and responsibilities |
| 6 | Planning. Actions to address risks and opportunities, objectives |
| 7 | Support. Resources, competence, awareness, communication, documented information |
| 8 | Operation. Design, development, verification, validation, data management, change control |
| 9 | Performance evaluation. Monitoring, measurement, internal audit, management review |
| 10 | Improvement. Nonconformity, corrective action, continual improvement |
| Annex A | Mapping to AI Act requirements |
| Annex B | Mapping to EN ISO 9001:2015 |
| Annex C | Mapping to EN ISO/IEC 42001:2026 |
Clause 4 is where the standard departs most clearly from a conventional QMS. It requires the organisation to identify which regulatory requirements apply to its AI systems and to define a compliance strategy against them. That is a legal determination placed at the front of a management system standard, and getting it wrong invalidates everything downstream.
The annexes are the practically useful part for most organisations. Annex B gives the mapping to ISO 9001, which lets a manufacturer with an existing certified QMS identify what it needs to add rather than rebuild. Annex C gives the mapping to ISO/IEC 42001.
What Article 17 Requires
EN 18286 exists to operationalise Article 17 of the AI Act. Article 17(1) provides:
“Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects:”
The aspects listed run from (a) to (m).
| Aspect | Subject |
|---|---|
| (a) | A strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for managing modifications to the system |
| (b) | Techniques, procedures and systematic actions for design, design control and design verification |
| (c) | Techniques, procedures and systematic actions for development, quality control and quality assurance |
| (d) | Examination, test and validation procedures before, during and after development, and their frequency |
| (e) | Technical specifications, including standards to be applied, and where harmonised standards are not applied in full, the means used to ensure compliance |
| (f) | Systems and procedures for data management, covering acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation and retention |
| (g) | The risk management system referred to in Article 9 |
| (h) | Setting up, implementing and maintaining a post-market monitoring system in accordance with Article 72 |
| (i) | Procedures for reporting serious incidents in accordance with Article 73 |
| (j) | Handling communication with national competent authorities, notified bodies, other operators, customers and interested parties |
| (k) | Systems and procedures for record-keeping of all relevant documentation and information |
| (l) | Resource management, including security-of-supply measures |
| (m) | An accountability framework setting out the responsibilities of management and other staff |
A provider that can evidence each of these in a documented, systematic and orderly form has an Article 17 QMS. EN 18286 provides the structure for doing so in a way a notified body or market surveillance authority will recognise.
What EN 18286 Does Not Cover
This is the section most summaries of the standard leave out, and it is the one that determines whether a compliance programme built on EN 18286 actually works.
| Provision | Covered by EN 18286 |
|---|---|
| Article 17(1), aspects (a) to (m) | Yes |
| Article 11(1), first sentence, technical documentation drawn up before placing on the market and kept up to date | Yes |
| Article 17(2), proportionality to the size of the provider’s organisation | No, expressly outside scope |
| Article 17(3), integration with QMS obligations under sectoral Union law | No, expressly outside scope |
| Article 17(4), financial institutions subject to internal governance requirements | No, expressly outside scope |
| Article 72, post-market monitoring, as a standalone requirement | No mapping row |
| Article 9, risk management system | Only as referenced through Article 17(1)(g) |
| Article 10, data and data governance | Only as referenced through Article 17(1)(f) |
| Article 12, record-keeping and logging | Not directly |
| Article 13, transparency and instructions for use | Not directly |
| Article 14, human oversight | Not directly |
| Article 15, accuracy, robustness and cybersecurity | Not directly |
| Article 43, conformity assessment | Not directly |
Three consequences follow.
The presumption is partial. Conformity with EN 18286 produces a presumption of conformity with the requirements the standard covers, which is Article 17(1) and part of Article 11(1). Everything else in Chapter III, Section 2 requires separate demonstration.
Article 72 is a live gap. Article 17(1)(h) requires the QMS to include the setting up, implementation and maintenance of a post-market monitoring system in accordance with Article 72. EN 18286 addresses the QMS element but carries no Article 72 mapping. A provider needs to build post-market monitoring to the Article 72 requirement directly, and the forthcoming standards in the M/613 portfolio are expected to address it.
Proportionality is not standardised. Article 17(2) permits implementation of the QMS to be proportionate to the size of the provider’s organisation. EN 18286 does not cover that provision, which means an SME wanting to rely on proportionality cannot point to the standard for how to do so. The judgment remains the provider’s to make and document.
EN 18286 Compared to ISO/IEC 42001
The two are frequently presented as alternatives. They are not. They operate at different levels and answer different questions.
| Dimension | EN 18286:2026 | ISO/IEC 42001 |
|---|---|---|
| Developed by | CEN/CLC/JTC 21 | ISO/IEC JTC 1/SC 42 |
| Scope | Quality management system for regulatory purposes | AI management system for organisational governance |
| Level | Product and system | Organisation |
| Definition of quality | Fulfilment of applicable regulatory requirements | Fitness for purpose within a governance framework |
| Target | Providers of high-risk AI systems under the EU AI Act | Any organisation developing, providing or using AI |
| Legal effect in the EU | Presumption of conformity with Article 17, from 14 October 2026 | None under the AI Act |
| Certifiable | Expected, through accredited bodies | Yes, through accredited bodies |
| Geographic reach | European | International |
| Relationship | Annex C maps EN 18286 clauses to EN ISO/IEC 42001:2026 | Provides the broader governance context |
The practical position for a provider with ISO/IEC 42001 certification is that the certification remains valuable and does not produce a presumption of conformity with Article 17. Annex C exists precisely to let such a provider identify the delta rather than start again.
For a provider with no management system at all and a high-risk AI system heading for the EU market, EN 18286 is the more direct route, because it was written for exactly that purpose and now carries legal weight.
For an organisation whose AI estate spans jurisdictions, both have a role. ISO/IEC 42001 travels internationally and speaks to customers and investors. EN 18286 speaks to European market surveillance authorities and notified bodies.
How EN 18286 Fits the AI Act Timeline
| Date | Event |
|---|---|
| 1 August 2024 | AI Act enters into force |
| 2 February 2025 | Prohibited practices and AI literacy obligations apply |
| 2 August 2025 | GPAI model obligations apply |
| 30 October 2025 | prEN 18286 enters CEN-CENELEC public enquiry |
| 22 January 2026 | Public enquiry closes |
| 2 August 2026 | Article 50 transparency obligations apply |
| 12 July 2026 | EN 18286:2026 approved by CEN and CENELEC |
| July 2026 | Published as EN 18286:2026 |
| 14 October 2026 | Cited in the Official Journal. Presumption of conformity attaches |
| 2 December 2027 | Annex III high-risk AI obligations apply, including Article 17 |
| 2 August 2028 | Annex I product-embedded high-risk AI obligations apply |
The slow development of harmonised standards was one of the stated reasons behind the Digital Omnibus extension of the Annex III deadline from August 2026 to December 2027. EN 18286 arriving in October 2026 gives providers roughly fourteen months to implement before Article 17 becomes enforceable.
That is adequate but not generous. Implementing a quality management system from a standing start, running it long enough to produce audit evidence, and completing conformity assessment is not a six-month exercise.
Where the Rest of the Standards Stand
EN 18286 is the first standard under M/613 to reach citation. It is not intended to stand alone. The broader portfolio is designed to cover the remaining Chapter III, Section 2 requirements.
| Requirement | Article | Standard status |
|---|---|---|
| Quality management system | 17 | EN 18286:2026, cited 14 October 2026 |
| Risk management system | 9 | In development under M/613 |
| Data and data governance | 10 | In development under M/613 |
| Technical documentation | 11 | Partially covered by EN 18286. Further work in development |
| Record-keeping and logging | 12 | In development under M/613 |
| Transparency and instructions for use | 13 | In development under M/613 |
| Human oversight | 14 | In development under M/613 |
| Accuracy, robustness and cybersecurity | 15 | In development under M/613 |
| Conformity assessment | 43 | In development under M/613 |
| Post-market monitoring | 72 | In development under M/613 |
A provider cannot wait for the full portfolio. The December 2027 deadline applies whether or not every supporting standard has been cited, and Article 40 does not excuse non-compliance where no harmonised standard exists. Where a standard is unavailable, the provider demonstrates compliance by other adequate means and documents the reasoning.
Who Should Implement EN 18286
| Situation | Position |
|---|---|
| Provider of an Annex III high-risk AI system | Directly relevant. Article 17 applies from 2 December 2027 |
| Provider of an Annex I product-embedded high-risk AI system | Directly relevant. Article 17 applies from 2 August 2028 |
| Provider relying on the Article 6(3) exception | Article 17 does not apply, but the exception requires documented reasoning and EU database registration. Implementing the standard is disproportionate |
| Deployer of a high-risk AI system | Article 17 is a provider obligation. Deployer obligations sit in Article 26 |
| GPAI model provider | Chapter V applies. Article 17 does not, unless the provider is separately a high-risk system provider |
| Non-EU provider placing high-risk systems on the EU market | Directly relevant. Article 17 applies regardless of establishment |
| Provider with existing ISO/IEC 42001 certification | Relevant. Use Annex C to identify the delta rather than rebuilding |
| Provider with existing ISO 9001 certification | Relevant. Use Annex B to identify the delta |
Implementation Steps
| Step | Action |
|---|---|
| 1 | Confirm that each AI system is high-risk under Article 6, and that you are the provider rather than the deployer |
| 2 | Obtain EN 18286:2026 from your national standards body |
| 3 | Work Clause 4 first. Identify which regulatory requirements apply to each system and define the compliance strategy against them |
| 4 | Map existing management systems using Annex B for ISO 9001 and Annex C for ISO/IEC 42001 |
| 5 | Build the Article 17(1) aspects (a) to (m) against the standard’s clause structure |
| 6 | Address the coverage gaps separately: Article 72 post-market monitoring, and Articles 9, 10, 12, 13, 14 and 15 |
| 7 | Document the proportionality position under Article 17(2) if relying on it, since the standard does not cover it |
| 8 | Establish documented information control that survives an audit years after the fact, given the ten-year retention under Article 18 |
| 9 | Run the system long enough to generate internal audit and management review evidence before conformity assessment |
| 10 | Determine the conformity assessment route under Article 43 and engage a notified body early where third-party assessment is required |
| 11 | Track the remaining M/613 standards as they are cited, and update the compliance strategy accordingly |
Step 9 is the one that most affects timelines. A quality management system that has never completed an internal audit cycle or a management review produces no evidence of operation. Implementation in late 2027 does not satisfy a December 2027 deadline.
Where Grecta Fits
EN 18286 tells a provider what the quality management system must contain. It does not tell them which obligations reach a specific product, and that determination sits at the front of Clause 4 as the thing everything else depends on.
That is the gap between an organisational management system and product compliance. A certified QMS demonstrates that the organisation runs a system. It does not demonstrate that a particular AI system has been correctly classified, that the applicable obligations have been identified across every regime it touches, or that the evidence held against each obligation is current.
Grecta determines which obligations reach a product across the EU AI Act, GDPR, the Cyber Resilience Act, the GPSR, DORA, NIS2 and the other regimes in scope, then builds the infrastructure around each one: evidence bound to the obligation, recalculation when the law or the product changes, an audit trail of every evaluation, the reports each authority expects, and retention for as long as the obligation runs.
For EN 18286 specifically, that means Clause 4’s regulatory requirement identification is produced and maintained rather than compiled once, the Article 17(1) aspects are each backed by evidence tied to the obligation it satisfies, and the coverage gaps the standard leaves open are visible rather than assumed closed. When the remaining M/613 standards are cited, the obligations they cover map onto the same product record.
Book a Grecta demo to see how obligations are mapped to a specific product and what the evidence set looks like.
FAQ
What is EN 18286?
EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, is a European Standard prepared by CEN/CLC/JTC 21 under the European Commission’s standardisation request M/613. It specifies requirements and guidance for a quality management system for organisations that provide AI systems, and it operationalises Article 17 of the EU AI Act.
When was EN 18286 published?
It was approved by CEN and CENELEC on 12 July 2026 and published as EN 18286:2026 that month. It was cited in the Official Journal of the European Union on 14 October 2026.
Does EN 18286 give a presumption of conformity with the EU AI Act?
Yes, since 14 October 2026. Publication of a standard does not create presumption of conformity. Citation in the Official Journal does, under Article 40 of the AI Act, and only to the extent that the standard covers the relevant requirements.
Which parts of the AI Act does EN 18286 cover?
Article 17(1) and its aspects (a) to (m), and the first sentence of Article 11(1) on technical documentation being drawn up before market placement and kept up to date. Articles 17(2), 17(3) and 17(4) are expressly outside scope, and there is no mapping to Article 72.
Is EN 18286 mandatory?
No. Harmonised standards are voluntary. Article 17 is mandatory. A provider may demonstrate compliance with Article 17 by other adequate means, but conformity with EN 18286 is the route that carries presumption of conformity and is therefore the simplest to defend.
How is EN 18286 different from ISO/IEC 42001?
ISO/IEC 42001 is an international standard for an organisation-level AI management system covering AI governance generally. EN 18286 is a European standard for a product-level quality management system written specifically to implement Article 17 of the AI Act, and it carries presumption of conformity. Annex C of EN 18286 maps its clauses to EN ISO/IEC 42001:2026.
Does ISO/IEC 42001 certification satisfy Article 17?
No. ISO/IEC 42001 certification does not produce a presumption of conformity with the AI Act. It is useful evidence of governance maturity and covers substantial common ground, which Annex C makes visible, but Article 17 compliance has to be demonstrated against Article 17.
Can EN 18286 be certified?
The standard is written as an auditable management system and certification through accredited bodies is expected to develop. Certification is not required by the AI Act. What Article 17 requires is that the QMS exists, is documented in a systematic and orderly manner, and can be evidenced during conformity assessment and market surveillance.
Who does Article 17 apply to?
Providers of high-risk AI systems, meaning those who develop a high-risk AI system and place it on the market or put it into service under their own name or trade mark. It does not apply to deployers, whose obligations sit in Article 26, or to GPAI model providers, whose obligations sit in Chapter V.
When does Article 17 become enforceable?
From 2 December 2027 for stand-alone Annex III high-risk AI systems, and from 2 August 2028 for Annex I product-embedded systems, following the extensions introduced by the Digital Omnibus.
Does EN 18286 cover post-market monitoring?
Only as an element of the quality management system under Article 17(1)(h). It carries no mapping to Article 72 itself. Post-market monitoring has to be built to the Article 72 requirement separately, and a standard addressing it is in development under M/613.
Do non-EU providers need to implement EN 18286?
The AI Act applies to any provider placing a high-risk AI system on the EU market, regardless of establishment. Article 17 applies to them, and EN 18286 is as useful a route to demonstrating compliance for a US, UK or Swiss provider as for an EU one. Non-EU providers must also appoint an EU-established authorised representative under Article 22.
Where do I obtain the standard?
Through your national standards body. In the UK it is published as BS EN 18286:2026 by BSI. Other national bodies publish national adoptions under their own prefixes, for example DIN EN 18286 in Germany and SIST EN 18286 in Slovenia. The text is identical.
