EN 18286 Explained: The AI Act's First Harmonized Standard

On 14 October 2026, the Commission published the reference of EN 18286:2026 in the Official Journal through Implementing Decision (EU) 2026/2274, and CEN-CENELEC marked the day as the citation of "the first harmonized standard in support of the AI Act." Since then, a provider of a high-risk AI system whose quality management system conforms to EN 18286 is presumed to meet the quality management duty in Article 17(1) and the first sentence of the technical documentation duty in Article 11(1), within the limits that the standard's Annex ZA sets out.

Those limits matter more than much of the early coverage suggests. The presumption covers having the right procedures for risk management, data, monitoring and incidents, while the risk management system itself, the data, the logs and each incident report are still judged against the Act. An ISO/IEC 42001 certificate gives no presumption at all, and the standard's own correspondence tables show where a 42001 system falls short. With the Annex III high-risk obligations applying from 2 December 2027, providers have about thirteen months to close that gap.

Watch the five-minute explainer: What EN 18286 means for providers of high-risk AI

What is EN 18286?

EN 18286, Artificial intelligence: Quality management system for EU AI Act regulatory purposes, is a voluntary European Standard prepared by CEN and CENELEC and approved by CEN on 12 July 2026. It sets requirements for the quality management system (QMS) of providers of AI systems, and its primary audience is providers of high-risk AI systems placed on the EU market or put into service there (clause 1). One QMS can cover several AI systems.

Two definitions set it apart from the management system standards most compliance teams know. Quality, in EN 18286, means regulatory compliance: with the AI Act as a minimum, and with the law that protects health, safety and fundamental rights (3.1.23 and 3.1.26), and the standard itself notes that this differs from quality in ISO 9001. Risk means harm to people's health, safety or fundamental rights, and risks to the organization are handled separately. As we put it in our webinar with Schellman, "9001 tells you that the goal is to ensure quality. 18286 tells you the goal is to ensure regulatory compliance."

The requirements sit in clauses 4 to 10:

Clause	What it covers
4 Quality management system	Applicable regulatory requirements, the scope of the QMS, the strategy for regulatory compliance, documented information
5 Leadership	Top management, the quality policy, roles, responsibilities and authorities
6 Planning	Risks to the operation of the QMS, quality objectives
7 Support	Resources, competence, communication, awareness
8 AI system realization	Life cycle processes, risk management, design and development, verification and validation, data management, retirement, identification, continuous learning, product documentation
9 Operations and control	Placing on the market, support services, supply chain, modifications, post-market monitoring, serious incidents, non-compliance
10 Performance evaluation	Management review, planning of changes

Annex A covers consultation of interested parties about risks to fundamental rights, health and safety; Annexes B and C map the clauses to ISO 9001:2015 and ISO/IEC 42001; Annex ZA ties the standard to the AI Act.

Deployers are not the audience, with one important exception. Under Article 25(1), a distributor, importer or deployer becomes the provider of a high-risk system that is already on the market or in service when it puts its own name or trademark on it, makes a substantial modification that leaves it high-risk, or changes the intended purpose of a system that was not high-risk so that it becomes high-risk. An enterprise that fine-tunes and rebrands a vendor model for credit decisions can end up inside the scope of EN 18286 without having planned for it.

What does EN 18286's presumption of conformity cover?

Annex ZA's Table ZA.1 maps clauses of the standard to provisions of the Act, and the presumption reaches only the rows it lists, on the conditions each row carries.

AI Act provision	Status in Table ZA.1
Article 17(1), points (a) to (m)	Covered. Point (g), the risk management system, is covered only if that system complies with Article 9.
Article 17(1), first sentence: the duty to have a QMS	Covered, with the remark that applying the standard does not by itself ensure that every requirement of the Act is met
Article 17(1), second sentence, first part: documenting the QMS	Covered if, at a minimum, points (a) to (m) are documented
Article 11(1), first sentence: technical documentation	Covered if the documentation contains every item of Annex IV
Article 17(2) proportionality, 17(3) sectoral QMS, 17(4) financial institutions	Not covered
Articles 9, 72 and 73 as such	No row. The standard covers the procedures that points (g), (h) and (i) of Article 17(1) require.
Articles 10 and 12 to 15	Outside EN 18286; no harmonized standard is cited for them yet

The table rests on a distinction that providers need to plan around. EN 18286 covers having procedures for risk management, data management, post-market monitoring and serious incidents. The risk management system itself, the training data, the logs, the accuracy of the model, the monitoring plan and each incident report are judged on their own against the Act, and later against the other standards that are still being prepared. A conforming QMS shows that the provider has a disciplined way of producing that evidence, and each piece of evidence is still assessed on its merits.

Two further conditions apply. Annex ZA's WARNING 1 says the presumption lasts only while the Official Journal keeps the reference, so the citation needs monitoring like any other dependency. And banks and insurers should note Article 17(4), under which their financial-services governance rules count toward the QMS duty except for points (g), (h) and (i), which are risk management, post-market monitoring and incident reporting; Table ZA.1 marks that paragraph as not covered.

EN 18286 vs ISO/IEC 42001: is a 42001 certificate enough?

No. ISO/IEC 42001 is an AI management system standard for any organization that develops, provides or uses AI, and it is not a harmonized standard, so its certificate gives no presumption of conformity under Article 40(1). A 42001 system still covers much of the ground, and EN 18286's Annex C maps its clauses to 42001 to show where. The annexes compare clauses, though, and do not make the standards equivalent.

	ISO/IEC 42001	EN 18286
What it is	AI management system	Quality management system for EU AI Act purposes
Who it is for	Any organization that supplies or uses AI	Providers of AI systems, primarily high-risk
What the system aims at	Responsible AI against the organization's objectives	Regulatory compliance
When a requirement is missed	"Nonconformity" with any requirement	"Non-compliance" with an applicable regulatory requirement
Continual improvement	Clause 10.1	No such clause; management review and planning of changes
Market operations: withdrawal, recall, informing authorities	Not in its corrective-action clause	Clause 9.7
Regulatory compliance strategy	No counterpart	Clause 4.4
Presumption of conformity under the AI Act	None	Yes, within Annex ZA, since 14 October 2026
Certification	Accredited certification available	Offered by certification bodies such as BSI; accreditation still being settled

The correspondence tables find no 42001 counterpart for two parts of EN 18286, and that is where the new work for a 42001-certified provider lies. The first is the regulatory compliance strategy in clause 4.4. The second is clause 9, which covers running an AI system on the market: placing it there, the supply chain, modifications, post-market monitoring, serious incidents and non-compliance. ISO 9001 organizations face a similar exercise through Annex B, which maps to ISO 9001:2015, even though ISO published ISO 9001:2026 in September. For the full argument on certification, see our post on why an ISO 42001 certification won't make your AI system compliant, and our ISO/IEC 42001 guide.

EN 18286 requirements providers underestimate

The regulatory compliance strategy (clause 4.4). The strategy has at least six items: the essential requirements, post-market monitoring, serious incidents, data management, the choice of conformity assessment procedure, and modifications to the AI systems. For each essential requirement of Articles 9 to 15, the provider picks a method, whether a cited harmonized standard, common specifications, another standard or its own technical specification, and records it in the technical documentation. Where no cited standard covers a requirement fully, which today is most of them, the provider has to describe in detail how it complies.

Reproducible tests (clause 8.4.2). Test plans need acceptance criteria that can be verified, such as numeric limits or ranges, and the tests must be reproducible. The provider documents the hardware and compute environment, the software and library versions, random seeds and initialization, training parameters and hyperparameters, dataset versions and preprocessing, and how each stochastic element is handled. For stochastic systems, documented statistical limits on the variation between runs can stand in for identical results.

Modifications and continuous learning (clauses 3.2.7, 8.8 and 9.4). Every post-market modification gets a documented decision on whether it is substantial, including the rationale when it is not, and a substantial modification makes the system a new AI system that needs a new conformity assessment. For systems that keep learning after deployment, the changes have to be determined in advance, included in the risk management system, verified and validated, and logged. Article 43(4) treats such changes as not substantial when the provider pre-determined them at the initial conformity assessment and recorded them in the technical documentation under point 2(f) of Annex IV.

Incidents and non-compliance (clauses 9.6 and 9.7). Clause 9.6.1 sets reporting deadlines of 2 days for serious incidents related to critical infrastructure, 10 days for a death and 15 days for other serious incidents. Article 73 sets the legal limits, and they differ in detail: its 2-day limit also covers widespread infringements, for example. Clause 9.7 requires procedures that find non-compliance and drive corrective action up to withdrawal, disabling or recall, and that inform the market surveillance authorities when a system presents a risk. ISO/IEC 42001's corrective-action clause has no equivalent of these steps.

When should providers start preparing for EN 18286?

Providers should start now. Article 17 applies from 2 December 2027 for Annex III systems such as credit scoring and life and health insurance pricing, and from 2 August 2028 for AI classified as high-risk under Article 6(1) because it is, or is a safety component of, a product covered by Section A of Annex I. Danny Manimbo of Schellman made the practical point in our webinar on EN 18286: "this documentation takes a long time to put together." The other standards that CEN and CENELEC are writing for the Act, on risk management (EN 18228), datasets (EN 18284) and, in the EN 18229 series, logging, accuracy, robustness and related topics, were still in preparation when EN 18286 was published in July. Providers will therefore build against a moving set of standards, and Danny also pointed out that the accreditation mechanism for EN 18286 audits is still an open question.

Customers are moving faster than the deadline. Modulos customers that sell high-risk systems to other businesses already get asked by their own customers for evidence that they meet their AI Act obligations, and a cited standard gives them something specific to show.

Enforcement is the other reason. Under Article 43(2), most Annex III systems go through internal control, so the provider assesses its own conformity, and the external check comes from market surveillance. In the webinar, we argued that this makes the AI Act a product safety law in practice. When a system becomes the subject of a dispute, the authority can ask to see the conformity assessment, and a provider that cannot produce one faces corrective action up to withdrawal from the market, with a return that we estimate at 12 to 18 months in the best case. The GDPR's reactive enforcement is the wrong model to plan against.

How to implement EN 18286: a plan for providers

The order of the steps matters, because each depends on the one before.

1. Confirm your role, system by system. List the high-risk systems you provide, including the Article 25(1) cases where a deployer becomes the provider.
2. Get the standard. Buy EN 18286:2026 from your national standards body.
3. Write the clause 4.4 compliance strategy for each high-risk system: the applicable requirements, the method for each, and the gaps.
4. Map what you already run. Use Annex B for ISO 9001:2015 and Annex C for ISO/IEC 42001, map a sectoral QMS such as ISO 13485 against EN 18286 clause by clause yourself, and list the clauses with no counterpart.
5. Build the clause 9 procedures: modifications, post-market monitoring, serious incidents and non-compliance.
6. Draw up the technical documentation against every item of Annex IV, since the Article 11(1) presumption depends on it.
7. Hold the first management review and record its decisions.

The Modulos platform models EN 18286 as two Frameworks that follow the same split. OFF-19, at the organization level, holds clauses 4 to 7 and 9.6 to 10; MFF-19, at the AI system level, holds clause 8 and clauses 9.1 to 9.5, with one AI system record for each system in the QMS. Completing the Frameworks records the work and its evidence, but it does not by itself create a presumption of conformity, which comes only from conforming to the standard. Our EN 18286 guide walks through Annex ZA row by row and every clause, and the full webinar with Schellman covers what an EN 18286 audit will look like. To see the Frameworks in practice, request a demo.

Frequently asked questions about EN 18286

What is EN 18286? EN 18286:2026 is the voluntary European Standard for the quality management system of providers of AI systems under the EU AI Act, approved by CEN on 12 July 2026. Its primary audience is providers of high-risk AI systems.

Is EN 18286 mandatory? No. Applying the standard is voluntary, but Article 17(1) requires providers of high-risk AI systems to have a quality management system, from 2 December 2027 for Annex III systems and from 2 August 2028 for high-risk systems under Article 6(1) tied to products covered by Section A of Annex I. Systems already on the market before those dates are caught once their design changes significantly, and such legacy systems intended for public authorities must comply by 2 August 2030.

When was EN 18286 cited in the Official Journal? The Commission published its reference on 14 October 2026 through Implementing Decision (EU) 2026/2274. It was the first harmonized standard cited under the AI Act.

Does EN 18286 give presumption of conformity with the whole EU AI Act? No. The presumption covers Article 17(1) and the first sentence of Article 11(1), on the conditions in Annex ZA. Article 17(2) to (4) are not covered, and requirements such as Articles 9, 10 and 12 to 15 are judged on their own.

Is ISO/IEC 42001 certification enough for the EU AI Act? No. ISO/IEC 42001 is not a harmonized standard and gives no presumption of conformity. A 42001 system covers much of the ground, but it has no counterpart for EN 18286's regulatory compliance strategy (clause 4.4) or its market operations clause (clause 9).

Is there an EN 18286 certification? Certification bodies such as BSI offer EN 18286 certification, and Schellman's Danny Manimbo noted in our webinar that the accreditation mechanism is still an open question. The presumption of conformity comes from conforming to the cited standard itself, whether or not a certificate exists.

Does EN 18286 apply to deployers? Only when a deployer becomes a provider under Article 25(1), which concerns systems already on the market or in service: putting its name or trademark on a high-risk system, substantially modifying one so that it stays high-risk, or changing the intended purpose of a system that was not high-risk so that it becomes high-risk.

Which other harmonized standards for the AI Act are coming? CEN and CENELEC are preparing standards on risk management (EN 18228), datasets (EN 18284), logging, accuracy, robustness and related topics (the EN 18229 series), and conformity assessment. EN 18286 was the first to be cited, and the others were still in preparation when it was published.