SignorCrypto note · AI
EN 18286: The First Harmonised Standard Under the EU AI Act
What the Official Journal citation gives high-risk AI providers, what it does not, and how ISO/IEC 42001 fits
EN 18286:2026 is the first harmonised standard referenced under the EU AI Act. Commission Implementing Decision (EU) 2026/2274, adopted on 12 October 2026 and published in the Official Journal on 14 October 2026, cites it for the quality management system (QMS) that Article 17 requires from providers of high-risk AI systems. A provider that builds its QMS on EN 18286 gets a presumption of conformity with those Article 17 requirements. The presumption is voluntary, and it does not replace the rest of the AI Act.
What the Official Journal citation changes
EN 18286 was published as a European standard in July 2026, but until the citation it was a voluntary document. Only the reference in the Official Journal gives a harmonised standard legal effect under Article 40 of the AI Act, according to the CEN-CENELEC JTC 21 announcement.
The Decision's annex lists one entry: "EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes". The Decision states that the standard satisfies the requirements of Regulation (EU) 2024/1689 that it aims to cover, and that it is appropriate to publish its reference in the Official Journal (EUR-Lex, Decision 2026/2274).
What EN 18286 covers
EN 18286 sets requirements and guidance for a QMS for organisations that place high-risk AI systems on the EU market. It is written for AI Act purposes rather than as a general management standard. Its scope is the QMS that Article 17 requires from providers.
Article 17 requires that the QMS be documented "in a systematic and orderly manner in the form of written policies, procedures and instructions", and that it include at least a set of listed aspects, starting with a strategy for regulatory compliance (AI Act Explorer, Article 17).
Two features matter for implementation:
- Annex ZA shows which AI Act requirements each clause supports.
- Informative annexes map the standard to EN ISO 9001 and EN ISO/IEC 42001, so organisations already certified to either can extend their existing system.
Where ISO/IEC 42001 fits
ISO/IEC 42001:2023, first published in December 2023, specifies requirements for establishing, implementing, maintaining and improving an artificial intelligence management system (AIMS) within an organisation (ISO).
The two standards overlap, but they are not interchangeable for AI Act purposes:
- ISO/IEC 42001 is a general, organisation-level AI management system standard.
- EN 18286 is written to the AI Act's quality management requirements and is the only standard cited in Decision 2026/2274.
SignorCrypto analysis: an ISO/IEC 42001 management system is a sound base for a QMS, and EN 18286's mappings are designed to make reuse practical. Under the Decision, however, only EN 18286 carries the presumption. A team should not assume that an ISO/IEC 42001 record alone demonstrates Article 17 conformity.
What the presumption does not do
The presumption has clear limits:
- It is voluntary. Providers can meet Article 17 in other ways, but then they must demonstrate compliance on their own.
- It covers the quality management requirements. It is not a conformity assessment of a specific AI system. Readers should check Annex ZA and the Decision for the exact scope.
- It does not decide classification. Whether a system is high-risk is a separate question under the AI Act. A QMS for a non-high-risk system is outside the presumption.
When the obligations apply
Article 17 applies from 2 December 2027 for high-risk systems under Annex III and from 2 August 2028 for systems under Annex I, according to Article 113(c) as summarised by the AI Act Explorer.
For providers, the practical window is therefore a planning period rather than an immediate deadline. The harmonised standard reduces uncertainty about how to demonstrate compliance, but the documentation work still takes time.
A practical starting checklist for providers
SignorCrypto analysis, based on the sources above:
- Confirm the high-risk scope. Identify which products or services fall under Annex III or Annex I before choosing a QMS approach.
- Map Article 17 to EN 18286. Use Annex ZA to check which clauses cover each requirement, and record gaps.
- Reuse existing management systems. If the organisation already runs ISO 9001 or ISO/IEC 42001, use the informative mappings as a starting point.
- Assign ownership. Name the people responsible for policies, post-market monitoring and change control.
- Track further standards. According to JTC 21, EN 18286 is the first deliverable under standardisation request M/613, not the last.
FAQ
Is EN 18286 mandatory?
No. The presumption of conformity is voluntary. Providers can use other means to show Article 17 compliance, but they must demonstrate them.
Does EN 18286 certify an AI product?
No. According to the JTC 21 announcement, EN 18286 is a standard for an organisation's quality management system. It does not replace the conformity assessment obligations of the AI Act.
Does ISO/IEC 42001 give the same presumption?
Not under Decision 2026/2274. The Decision's annex lists EN 18286:2026 only.
Sources
- CEN-CENELEC JTC 21, EN 18286 becomes the first harmonised standard under the EU AI Act
- EUR-Lex, Commission Implementing Decision (EU) 2026/2274
- AI Act Explorer, Article 17: Quality Management System
- ISO, ISO/IEC 42001:2023 AI management systems
- CEN-CENELEC JTC 21, European AI standardization
Next step
If your team needs to turn EN 18286 and Article 17 into a working QMS, including documentation architecture, tooling and integration with existing systems, contact SignorCrypto to scope a technical review.