On 14 October 2026, Commission Implementing Decision (EU) 2026/2274 was published in the Official Journal of the European Union. For the first time, it recognises a harmonised standard supporting the AI Act: EN 18286:2026, on the quality management system for providers of high-risk AI systems. It is a technical step, but one with concrete legal effects.

‍
What the Decision provides
With Implementing Decision (EU) 2026/2274 of 12 October 2026, the European Commission published the reference of EN 18286:2026 “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”. The standard was drafted by the European standardisation organisations CEN and CENELEC at the Commission’s request.
It covers the quality management system that providers of high-risk AI systems must put in place, including post-market monitoring. The Decision entered into force on the day of its publication, 14 October 2026.

‍
Why it matters: the presumption of conformity
Under Article 40 of the AI Act, AI systems that comply with harmonised standards published in the Official Journal are presumed to conform to the requirements those standards cover.
In practice, a provider that applies EN 18286 to build its quality management system now has a recognised way to demonstrate compliance with Article 17 of the AI Act. The presumption applies only to the aspects the standard covers.
Using standards remains voluntary, and conformity can be demonstrated by other means. Following a harmonised standard, however, makes that demonstration simpler and more robust in case of an inspection.

‍
What EN 18286 covers
The standard turns the elements required by Article 17 into a management system, including:
• a regulatory compliance strategy, covering conformity assessment procedures and the management of modifications;
• the design, development and testing of the system;
• data management: acquisition, labelling and storage;
• the link to the risk management system (Art. 9) and to technical documentation (Art. 11);
• post-market monitoring (Art. 72) and serious incident reporting (Art. 73);
• record-keeping, supplier management and clear accountability.

‍
EN 18286 and ISO/IEC 42001: not the same thing
Many organisations have already adopted, or are adopting, ISO/IEC 42001, the international standard for AI management systems. The two standards are complementary but different:
• ISO/IEC 42001 addresses AI governance at the organisational level and can be certified, but it is not a harmonised standard and gives no presumption of conformity with the AI Act;
• EN 18286 is designed for the AI Act obligations relating to each high-risk system and, now that it is published in the Official Journal, confers a presumption of conformity.
Organisations already certified to ISO/IEC 42001 start with an advantage, but they need to close some gaps. These include a compliance strategy for each system, change management, serious incident reporting deadlines and supply-chain requirements specific to AI.

‍
Only the first building block
EN 18286 is so far the only harmonised standard published for the AI Act. The others, on risk management, data quality and governance, logging, cybersecurity and trustworthiness, are still being developed by the joint CEN-CENELEC technical committee JTC 21.
The timetable remains the one set by the Digital Omnibus on AI (Regulation (EU) 2026/1744): obligations for high-risk systems apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. There is time to prepare, but a quality management system takes months to build and put into operation.

‍
What to do now
For organisations that develop or place on the market AI systems that may be high-risk:
1. classify your systems and check whether they fall under Annex I or Annex III of the AI Act;
2. compare your existing management system (quality, ISO/IEC 42001, ISO 9001) with the requirements of EN 18286;
3. plan the adjustments ahead of 2027, starting with the elements that take longest: data management, technical documentation and post-market monitoring;
4. follow the publication of the next standards, which will complete the framework.

With its first harmonised standard, the AI Act now has a concrete tool for demonstrating conformity. Data Valley Consulting supports organisations in classifying their AI systems and building a compliance roadmap, combining legal and technical expertise.

‍