Commission proposes new EU Standardisation Regulation to speed AI Act standards

On 6 October 2026 the European Commission published a proposal, COM(2026) 780 final, to repeal and replace Regulation (EU) No 1025/2012, the law that governs how harmonised standards are written across the Union, including the technical standards the AI Act relies on.

The Commission says the overhaul is needed because excessive delays in drafting harmonised standards are slowing implementation of EU laws, including rules on AI.

What it is

The proposal would repeal Regulation (EU) No 1025/2012 and replace it with a new regulation on European standardisation, using Article 114 of the Treaty on the Functioning of the European Union as its legal basis.

It follows the Commission's earlier commitment to revise the 2012 regulation after identifying standardisation delays as a barrier to the single market.

The proposal arrives while standard-setting bodies working on the AI Act are still behind their original timeline: the Commission requested AI Act high-risk standards from CEN and CENELEC as far back as 2021, and that drafting work remains incomplete.

Coverage of the AI Act timeline has separately noted that European standardisation bodies tasked with writing the technical standards needed to operationalise the AI Act have faced significant delays.

What it requires

The Commission frames the revision as addressing four problems: slow harmonised-standards development, uneven stakeholder participation, uncertain financing for standards bodies, and declining EU influence in global standard-setting.

The proposal builds on a 2022 amendment restricting standardisation requests to EU and EEA bodies and on a 2025 Omnibus IV proposal that proposed the introduction of common specifications as a fallback when harmonised standards are unavailable.

For the AI Act specifically, the Commission has already asked CEN and CENELEC to draft standards in ten areas covering risk management, data governance, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment.

One of those drafts, prEN 18286 on quality management for AI Act regulatory purposes, reached public enquiry in late October 2025 as the first harmonised AI standard to do so.

What security leaders should do

Security and compliance teams should keep tracking the CEN/CENELEC JTC21 work programme for the AI Act's ten requested standards areas, since any of them touching cybersecurity, robustness, or risk management will shape future audit expectations.

Because application of harmonised standards is voluntary and many AI Act standards are still being drafted, teams cannot yet rely solely on a published standard for a presumption of conformity and should document how they meet the AI Act's underlying legal requirements in the meantime.

Teams should also expect the standardisation process itself to change as this new regulation moves through the European Parliament and Council, given its stated aim of reducing the delays that have affected AI-related standards work.