The first European standard for the AI Act is here
On 14 October the first harmonised standard under the EU AI Act appeared in the EU’s Official Journal. It sets out the quality management system for providers of high-risk AI.
What happened
On 14 October the reference to EN 18286:2026 appeared in the Official Journal of the EU. For the first time there is a European standard that sets out how to meet a requirement of the AI Act.
The standard covers the quality management system that providers of high-risk AI must have: the fixed procedures and ways of working that keep such a system within the law, from design and data to reporting incidents. The European standards bodies CEN and CENELEC drew it up in their joint committee on AI. The European Commission included the reference in a decision dated 12 October.
Providers that apply the standard are presumed to meet the Article 17 requirements it covers. This is called a presumption of conformity: a regulator may then assume that you meet those requirements. The standard is built around the lifecycle of an AI system and sits on top of existing standards such as ISO 9001, ISO/IEC 42001 and ISO 13485 for medical devices. According to the Commission, companies can extend their existing quality system this way rather than run a second one alongside it. More standards will follow, but the Commission gives no date.
Meanwhile the Dutch Data Protection Authority (AP) announced that it has set up a directorate for supervising AI and algorithms, which among other things prepares market supervision under the AI Act. Formally, the AP is not yet an AI regulator: the Dutch law that would make it one has not yet taken effect. The EU deadline for designating national regulators, 2 August 2025, passed more than a year ago.
Providers that apply EN 18286 are presumed to meet the Article 17 requirements it covers.
The European Commission on 19 October 2026, in short
The background
How European standards work
The AI Act says what has to happen; standards describe how to do it. Following a standard is voluntary. But once its reference is in the Official Journal, the presumption of conformity applies, for as long as that reference stays there.
The European Commission asked CEN and CENELEC for standards on risk management, data, record-keeping, human oversight, accuracy and cybersecurity, among other topics. That work fell behind schedule. According to the Future of Privacy Forum, the delay was a key reason for postponing the rules for high-risk AI. The standards for risk management, datasets, logging and accuracy are still being written.
What is in EN 18286
Article 17 lists what a quality management system has to cover: how you comply and manage changes, how you design, test and validate, how you handle data, your risk management, monitoring a system after release, reporting serious incidents and who is responsible for what. Small companies may scale this to their size, as long as the level of protection is the same.
The standard turns that into requirements an auditor can check, from leadership and planning to design, data, testing, retirement and incidents. Annexes map it to ISO 9001 and ISO/IEC 42001. The presumption of conformity only covers the first paragraph of Article 17 and the first sentence of Article 11, on technical documentation. The draft went out for public enquiry on 30 October 2025 and was approved in July 2026.
Who the standard applies to, and from when
Article 17 applies to providers: whoever builds a high-risk AI system or puts it on the market under their own name. High-risk covers AI for recruitment, credit scoring and border control, among other things, and AI in products such as toys, lifts and medical devices. If you only use such a system, Article 17 does not apply to you. But under Article 25 a user counts as a provider if they offer the system under their own name, modify it substantially or put an AI system that was not meant to be high-risk to a high-risk use.
Under the AI Omnibus, published in the Official Journal on 24 July 2026, the rules apply to uses such as recruitment and credit scoring from 2 December 2027, and to AI in products from 2 August 2028.
Our analysis
The standard is for providers, the trap is for users
The headlines speak of a first route to AI Act compliance. That is true, but the route is narrow. EN 18286 covers the quality management system and a little documentation. The standards for risk management, data, logging and accuracy do not exist yet, so following this one does not make you compliant with the whole law. Companies with ISO/IEC 42001 can build on what they have, but only EN 18286 gives the presumption of conformity.
What the coverage leaves out is that most companies do not build high-risk AI; they use AI. Article 17 is not meant for them. But the line is thinner than you might think. Use a general-purpose AI model to assess job applications and you give it a high-risk purpose, and under Article 25 you may count as the provider yourself, with this quality management system as your duty.
Our expectation: buyers will start asking suppliers of high-risk AI for EN 18286, just as they now ask for ISO 27001 for information security. December 2027 seems far off, but you don’t build a quality management system in a few months. So don’t wait for your national regulator.
What stands out
- The standard covers only one article The presumption of conformity covers only Article 17(1) and the first sentence of Article 11. Standards for risk management and data are still being written.
- A user can become a provider Offer AI under your own name, modify it substantially or use it for a high-risk purpose, and Article 25 gives you the provider’s duties.
- High-risk rules only apply from December 2027 The AI Omnibus pushed the rules back. Standards that were not ready in time were a key reason.
- The regulator has no powers yet The Dutch Data Protection Authority is building up AI supervision, but is not yet formally a regulator. The Dutch law for that has not taken effect.
What it means for you
Do you build or buy AI that counts as high-risk? Then there is now a first benchmark for what ‘in order’ means.
- A route, not an obligation Using the standard is voluntary, but following it makes it easier to show that your quality system holds up. That gives you something firm to point to with regulators and customers.
- Build on what you have Already working with ISO 9001 or ISO/IEC 42001? The new standard sits on top of them rather than replacing them.
- Don’t wait for the regulator The Netherlands has not formally arranged its AI supervision yet, but parts of the AI Act already apply. If you buy AI, ask your supplier now how they comply.
Where we come in · Advisory
We help you choose your AI, and what comes with it
In a Discovery or Roadmap we work out where AI can take work off your hands and choose the right tools with you; whether an application counts as high-risk is part of that choice. With Support, we continuously check what your colleagues build with AI against the GDPR and the AI Act, among other things.
Do you know whether your AI counts as high-risk?
Tell us what you use AI for, or want to. We’ll think it through with you and always reply within one working day.
