CEN-CENELEC publishes EN 18286:2026, first harmonized EU AI Act standard

EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes, is the first harmonized European standard produced under the EU AI Act's standardisation programme.

CEN-CENELEC announced on 31 July 2026 that the standard had been finalized.

What it is

The standard specifies how organizations should define, implement and maintain a quality management system, and is aimed primarily at providers placing high-risk AI systems on the market.

CEN-CENELEC calls it the first harmonized European standard focused on the quality management system required for high-risk AI systems.

Applying harmonized standards under the AI Act remains voluntary, since providers can rely on any other framework to show compliance.

What it requires

The standard operationalizes Article 17 of the AI Act, requiring providers to document systems and procedures for data management, the risk management system, post-market monitoring, incident-reporting procedures, record-keeping, and an accountability framework that assigns responsibilities across all of the above.

Its ten normative clauses mirror a shared management-system structure, covering quality management, leadership, planning, support, system realization, operations and performance evaluation.

Under the AI Act's own calendar, these Article 17 duties apply from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems.

Before providers can claim a presumption of conformity, the European Commission still has to assess the published standard and reference it in the Official Journal of the EU.

What security leaders should do

Security and compliance leaders overseeing high-risk AI systems should begin mapping existing ISO/IEC 42001 or ISO 9001 programs against EN 18286:2026's clause structure now, ahead of the Commission's Official Journal review. Teams should use the Article 17 elements, especially post-market monitoring, incident reporting and the accountability framework, as a checklist for internal AI quality documentation rather than building one from scratch later. Because the Annex III and Annex I application dates fall in December 2027 and August 2028, leaders have time to pilot the standard on one high-risk AI system before broader enforcement begins.