Cited in the Official Journal of the EU on 15 October 2026, EN 18286:2026 is the first harmonized standard adopted under the EU AI Act. It sets out a quality management system for organizations that provide AI systems — and citing it gives providers a documented route to presumption of conformity with one specific AI Act obligation, not the whole regulation.
A CEN-CENELEC harmonized standard — “Artificial intelligence – Quality management system for EU AI Act regulatory purposes” — the first standard adopted under the Act.
Requirements and guidance for building and maintaining a quality management system for organizations that provide AI systems, with high-risk AI providers the primary audience.
Its citation in the Official Journal gives a presumption of conformity with Article 17 of the AI Act — the QMS obligation for high-risk AI system providers — nothing more, nothing less.
EN 18286:2026, “Artificial intelligence – Quality management system for EU AI Act regulatory purposes,” is a standard developed by CEN-CENELEC Joint Technical Committee 21 (JTC 21), the body responsible for AI standardization in support of EU regulation. On 15 October 2026, the European Commission cited it in the Official Journal of the EU via a Commission Implementing Decision — making it the first harmonized standard formally adopted under the EU AI Act. A feature article from CEN-CENELEC in July 2026 had already flagged it as the standard to watch; the October citation is what gives it legal weight.
“Harmonized standard” is a specific EU regulatory term, not just a description. Under the EU’s New Legislative Framework, a standard cited in the Official Journal gives organizations that follow it a presumption of conformity with the corresponding legal requirement — they don’t have to independently prove compliance from first principles if they can show they followed the cited standard. EN 18286:2026 is the first time that mechanism has been applied to the AI Act.
The standard specifies requirements and guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems. It is written sector-neutral — it does not target a specific industry — but its primary audience is providers of high-risk AI systems under the AI Act, since Article 17 of the Act specifically requires those providers to operate a quality management system. Like other management-system standards in the ISO/IEC 42001 and ISO 9001 family, it is structured around the discipline of defining the system, documenting it, running it, and keeping it current as the organization and its AI systems change.
EN 18286:2026 and ISO/IEC 42001 sit at different layers and serve different purposes, even though both are AI management-system standards. ISO/IEC 42001 is a global, voluntary, certifiable AI management system standard — organizations anywhere can pursue 42001 certification to demonstrate AI governance maturity to customers and partners, regardless of whether EU law applies to them. EN 18286:2026 is specific to the EU AI Act’s Article 17 obligation, and its value is legal rather than purely reputational: following it is how an AI Act-covered provider supports its conformity claim for that one article. An organization already certified to ISO/IEC 42001 has real groundwork to build on — much of the management-system discipline transfers — but 42001 certification does not automatically satisfy Article 17; the two are complementary, not interchangeable.
EN 18286:2026 is explicitly the first of several harmonized standards the AI Act anticipates. CEN-CENELEC JTC 21 has further standards in development covering other AI Act obligations — risk management and conformity assessment among them — through the same standardization request process. Organizations building their AI Act compliance roadmap now are better served treating EN 18286:2026 as the opening piece of that set, not the final word on what harmonized standards will require of them.
No. EN 18286:2026 supports a presumption of conformity with one specific obligation — Article 17 of the AI Act, the quality management system requirement for high-risk AI providers. The Act's other obligations, including risk management, technical documentation, human oversight and conformity assessment, each need their own evidence and are not covered by this standard.
No — the two are complementary rather than interchangeable. ISO/IEC 42001 is a global, voluntary, certifiable AI management system standard. EN 18286:2026 is specific to the EU AI Act's Article 17 obligation, and its value is legal: it is how an AI Act-covered provider documents conformity with that article. Groundwork from a 42001 certification helps, but does not automatically satisfy Article 17.
Primarily providers of high-risk AI systems under the EU AI Act, and any organization placing AI systems on the EU market that falls within the Act's scope. Organizations outside the EU market, or whose AI systems fall outside the Act's high-risk categories, may still find the quality-management discipline useful, but the presumption-of-conformity benefit is specific to AI Act-covered providers.