EN 18286 gives high-risk AI providers a presumption of conformity on quality management

The European Commission said on 19 October 2026 that it has published the reference to EN 18286:2026 in the Official Journal of the European Union. EN 18286 is the first harmonised standard supporting the implementation of the AI Act. Developed by CEN and CENELEC, the standard covers "Quality management system for EU AI Act regulatory purposes". Its reference was published through Commission Implementing Decision (EU) 2026/2274, which appeared in the Official Journal L series on 14 October 2026, according to the EUR-Lex record.

For providers of high-risk AI systems, the effect is legal. The Commission says providers implementing the standard "will benefit from a presumption of conformity with the Article 17 requirements covered by the standard". Article 17 sets the AI Act's quality management system requirements for those providers. The presumption is therefore tied to Article 17 and, within it, to the requirements EN 18286 covers. The Commission describes the standard as "a clear legal pathway" to meeting those requirements and says EN 18286 "translates these requirements into an operational quality management system".

How it fits with ISO/IEC 42001

The Commission says EN 18286 "is the only AI QMS standard with a presumption of conformity." According to the Commission, the standard:

- is mapped to Article 17 of the AI Act;
- is built around the AI system lifecycle, "rather than the organisation";
- is designed to be layered on top of existing international standards such as ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485, "rather than replace them".

EN 18286 also "explicitly allows providers in regulated sectors to integrate management systems, rather than run separate ones". For firms that have not adopted ISO/IEC 42001, the Commission says EN 18286 can be used to expand an existing QMS, or to build one that meets Article 17, before they place a high-risk AI system on the EU market or put one into service.

Atlas reads the layering language as a signal that an ISO/IEC 42001 certificate does not carry the presumption by itself. The lifecycle structure is likely to be the main point of difference from an organisation-level management system.

More standards to follow

The Commission called the publication "an important milestone" in implementing the AI Act, ahead of the application of requirements for high-risk AI systems. It said further harmonised standards are expected to follow.