The AI Act gets its first standard, covering quality control for high-risk AI

The decision's annex is a single line long. Implementing Decision (EU) 2026/2274, dated October 12 and published in the Official Journal of the European Union on October 14, cites only one standard. Still, it is a first: EN 18286 becomes the first harmonized standard supporting the European regulation on artificial intelligence, the AI Act. The European standardization body CEN-CENELEC welcomed it on October 15, and the European Commission announced it on October 19.

Its title, translated from English: “Artificial intelligence – Quality management system for EU AI Act regulatory purposes.” It is aimed at providers of high-risk AI systems, such as those used for hiring, credit or regulated products.

What does a company gain by applying it?

A harmonized standard published in the Official Journal provides a “presumption of conformity”: a company that complies with it is presumed to meet the corresponding requirements of the regulation. Here, that means Article 17, which requires providers of high-risk AI to have a written, documented quality management system covering, among other things, post-market monitoring and reporting of serious incidents.

The presumption stops there. It does not extend to the requirements on risk management, data quality, cybersecurity or human oversight, which are the subject of other standardization requests. Applying it also remains voluntary: a provider can demonstrate compliance by other means, at the cost of heavier justification work.

This is not just another ISO certification

EN 18286 is a European standard, not an ISO standard. According to the journal Management Qualité, it can be built on top of an existing system: ISO/IEC 42001 for AI management, ISO 9001 for quality, ISO 13485 for medical devices. A company already certified to ISO/IEC 42001 is not automatically presumed to comply with the AI Act: only EN 18286 provides that presumption for the quality system, according to the Commission as cited by the journal. Another particularity noted by the Commission: the standard is organized around the AI system's life cycle, not around the organization.

What should you do now?

The obligations for high-risk AI have been postponed by the digital “omnibus”: they will apply on December 2, 2027 for Annex III systems (hiring, credit, education…) and on August 2, 2028 for those embedded in regulated products (Annex I). For a provider of Annex III systems, a little over a year remains.

• Check whether your systems fall under high risk, and whether you are their provider or only the deployer. The standard targets providers.
• Compare your current quality system with the requirements of EN 18286, especially if you are already certified to ISO 9001 or ISO/IEC 42001.
• Follow the other expected standards: the Commission has requested standards in ten areas, including risk management, data, transparency, robustness and cybersecurity.

Brussels is also moving forward on other fronts of the AI Act, as shown by its request for explanations from OpenAI and Anthropic. For standards, the question is now one of pace: the other nine areas remain to be covered, while the first obligations will apply in December 2027.