EU AI Act harmonised standards: where prEN 18286 stands and what the sources show

This explainer answers a three-part question using two primary documents: the European Commission's standardisation page for the AI Act and Regulation (EU) 2026/1744 as published on EUR-Lex. Where the documents do not cover part of the question, the relevant section says so and does not fill the gap.

What standards do and who writes them

The Commission's standardisation page says the AI Act's requirements for high-risk systems must be fulfilled before placement on the market, ensuring high-risk AI systems are monitored throughout their lifecycle. The page says standards translate legal requirements into common technical language, which simplifies compliance for companies and other stakeholders.

The page says standards are voluntary, because providers can choose any other framework to demonstrate their compliance with the AI Act. According to the page, companies that apply harmonised standards are presumed to be compliant with the legal requirements.

On process, the page says that once CEN and CENELEC publish harmonised standards, the Commission assesses whether they meet the intended objectives and legal requirements of the AI Act. It says that after this final step the standards are referenced in the Official Journal of the EU.

The page says working groups in CEN and CENELEC, the two European Standardisation Organisations, are actively developing harmonised standards for high-risk AI systems. It says the Commission has requested standards in ten key areas, which are risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment.

Where prEN 18286 stands

The Commission page says that on 30 October 2025, prEN 18286: Artificial Intelligence - Quality Management System for EU AI Act Regulatory Purposes became the first harmonised standard for AI to enter public enquiry.

The page also says it was published in the EU Official Journal as Commission Implementing Decision (EU) 2026/2274.

According to the page, this harmonised standard is designed to help providers of high-risk AI systems comply with the AI Act, and it offers a product-focused framework for AI lifecycle governance.

The Commission page text supplied uses the label prEN 18286 throughout. It does not use the designation EN 18286:2026, and it does not state a date for the Official Journal publication. The page also does not say whether any further harmonised standard has been published beyond this one.

What Regulation 2026/1744 says about standards and timing

Regulation (EU) 2026/1744 is dated 8 July 2026 and amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as part of what its title calls the Digital Omnibus on AI.

Recital 1 says that Regulation (EU) 2024/1689 entered into force on 1 August 2024, and that the entry into application of its provisions is staggered, with all rules applying by 2 August 2027.

Recital 2 points to the delayed preparation of standards, which it describes as technical solutions for providers of high-risk AI systems. The recital says this delay, together with the delayed establishment of national governance and conformity assessment frameworks, has resulted in a compliance burden heavier than expected.

Security-relevant text in Regulation 2026/1744

Recital 10 says that, in light of technological and societal developments since the AI Act was adopted, it is necessary to amend Article 5 to address AI systems that generate non-consensual intimate material and child sexual abuse material.

Recital 12 says technical measures and other safeguards to prevent the generation of such material could include data cleaning, refusal training, safe prompt design and output controls, runtime prompt guardrails, content classification and filtering mechanisms, usage restrictions, abuse detection mechanisms, and notice and action mechanisms.

The recital says such measures are considered adequate if they align with state-of-the-art measures and demonstrably prevent or sufficiently reduce the likelihood of generating the material.

Recital 13 says the prohibition on child sexual abuse material should not prevent the legitimate use of an AI system in red-teaming and evaluation activities that assess compliance with the prohibition.

These passages come from recitals 10 to 13 of the excerpt supplied. The excerpt does not show the operative articles that apply them.

What the supplied documents leave open

The first open item is the proposed Standardisation Regulation. Neither document mentions a Commission proposal of that name. This explainer therefore gives no content, status or dates for it and draws no timeline from it.

The second is the high-risk delay. The copy of Regulation 2026/1744 supplied ends partway through the recitals, at recital 17, which concerns the designation of notified bodies. The operative articles are not visible, so the text provided gives no new application date for high-risk obligations. The only application date in the supplied text is the one in recital 1, quoted above.

The third is the label EN 18286:2026. The Commission page uses prEN 18286 and the Implementing Decision number. This explainer therefore does not describe a separate EN 18286:2026 text, its adoption date or its citation in the Official Journal beyond what the page states.

The fourth concerns the other requested areas. The Commission page lists ten areas and identifies one standard, prEN 18286. The supplied documents do not list standards for the other nine areas, their drafts or their expected dates. For the cybersecurity area in particular, the supplied documents give no standard reference.