Blog · EU AI Act · Standards
EN 18286: the EU's first AI Act standard is now official, and what it means if you use ISO/IEC 42001
19 October 2026 · 5 min read · By LeadAI
For two years, one question has followed the EU AI Act around: what exactly do we have to do to comply? This month the EU gave a first concrete answer for one important part. On 14 October 2026, the first harmonised standard for the AI Act was cited in the Official Journal of the European Union. It is EN 18286:2026, "Artificial intelligence – Quality management system for EU AI Act regulatory purposes".
What happened
- End of July 2026. The European standards bodies CEN and CENELEC, through their joint AI committee (JTC 21), published EN 18286:2026. They presented it as the first standard supporting the implementation of the AI Act.
- 12 October 2026. The European Commission adopted Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems.
- 14 October 2026. The decision was published in the Official Journal. Its annex lists EN 18286:2026, which makes it the first AI Act standard to be cited there.
Why "cited in the Official Journal" matters
A harmonised standard is a European standard that the Commission has formally referenced in the Official Journal. If you follow it, you benefit from a presumption of conformity with the legal requirements the standard covers. In plain English: you have a recognised way to show you meet those requirements, instead of having to argue that your own approach is good enough.
Following a harmonised standard is voluntary. It is a route, not an obligation.
What EN 18286 covers
EN 18286 sets out requirements and guidance for defining, implementing, maintaining and improving a quality management system (QMS) for organisations that provide AI systems. It supports Article 17 of the AI Act, which requires providers of high-risk AI systems to have a QMS. It addresses processes across the AI system life cycle, including post-market monitoring. It is not specific to any sector. Article 17 also allows providers that already operate a QMS under other EU product rules to build the AI Act elements into the system they have, rather than starting again.
What it does not do
| It does | It does not |
|---|---|
| Give providers of high-risk AI a recognised route to show they meet the QMS requirements it covers | Cover every high-risk requirement. Risk management, data governance, human oversight and cybersecurity, among others, are separate. |
| Add structure to an area many providers found vague | Remove the need for the conformity assessment steps that apply to your system. Commentators note that using it does not by itself take a notified body out of the picture. |
| Signal what regulators are likely to expect | Make following it mandatory |
| Help buyers ask better questions of suppliers | Place duties directly on organisations that only use AI. These are deployers, not providers. |
Reports so far also indicate that EN 18286 is the only AI Act standard cited in this first decision. More harmonised standards are expected, so treat this as the first piece, not the whole picture.
Who should care
| Your role | Relevance |
|---|---|
| Provider of a high-risk AI system | High. This is your route to a presumption of conformity for the QMS requirement. Start planning now. |
| Provider of other AI systems | Useful as a benchmark for good practice, but not required. |
| Deployer (you use AI built by others) | Indirect. Expect suppliers to cite it and customers to ask about it. Use it when you assess vendors. |
| Organisation unsure of its role | Start by working out your position. See which role you are. |
EN 18286 and ISO/IEC 42001: how they relate
The two are close relatives with different jobs.
| EN 18286 | ISO/IEC 42001 | |
|---|---|---|
| Purpose | A regulatory QMS for meeting Article 17 of the AI Act | An AI management system for any organisation |
| Audience | Providers of AI systems, especially high-risk | Providers, deployers and others |
| Presumption of conformity | Yes, for the requirements it covers | No. It is not a harmonised standard. |
| Focus | Regulatory compliance | Governance, risk and continual improvement |
Published summaries indicate that EN 18286 includes an annex mapping its clauses to ISO/IEC 42001, so work done under 42001 can be reused. Treat that as a head start, not as proof of equivalence. A 42001 certificate does not prove AI Act compliance, and EN 18286 asks for things that are specific to the regulation. A gap analysis between the two will show what is missing. For more on certification, see what ISO/IEC 42001 certification really involves.
What to do now
- Confirm your role and your systems. Do you provide a high-risk AI system? If you are unsure, start with an inventory and a role check.
- Get the standard. It is available through national standards bodies. Read the scope and requirements before you plan any work.
- Run a gap analysis. Compare EN 18286 with the management system you have today, whether that is ISO/IEC 42001, ISO 9001 or a sector QMS.
- Build on what you have. Avoid running parallel systems. One integrated management system is easier to keep alive.
- Use the window. High-risk obligations now apply from 2 December 2027 and 2 August 2028. See what the delay really changed. That is time to prepare, not time to wait.
- Watch for further standards. Assign someone to follow new citations in the Official Journal.
If you want to see where you stand first, take the free AI Readiness Check, or follow the LeadAI Assure journey from inventory to evidence.
This article gives general information and is not legal advice or a substitute for the EU AI Act, EN 18286:2026, ISO/IEC 42001:2023 or professional advice. Check the Official Journal and the text of the standard for the exact scope.
Sources
- Nemko, EN 18286: EU AI Act cites new harmonised QMS standard: https://digital.nemko.com/news/en-18286-eu-ai-act-cites-new-harmonized-qms-standard
- LNE-GMED, a first harmonised standard published in the Official Journal: https://lne-gmed.com/news/ai-act-a-first-harmonized-standard-published-in-the-ojeu
- CEN-CENELEC, EN 18286 in the spotlight: https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/
- BSI, EN 18286 provides a framework for AI quality management: https://www.bsigroup.com/en-GB/insights-and-media/media-centre/press-releases/2026/july/en-18286-provides-a-framework-for-ai-quality-management-under-the-eu-ai-act/
- Reglog, EN 18286 is published: https://reglog.io/blog/en-18286-first-ai-act-harmonised-standard
- Harveys, EN 18286:2026 and AI Act compliance: https://harveys.hu/en/blog/en-18286-2026-ai-act-compliance/