On 14 October 2026 the Official Journal published the reference of EN 18286:2026, the first harmonised standard under the EU AI Act. It covers the quality management system of AI providers, and the Commission’s decision ties a presumption of conformity to it from that date. Eight days earlier, the European Commission proposed replacing the regulation that governs how such standards are requested, assessed and published. Unrestricted free online access to cited standards and fixed assessment deadlines are among the proposed changes.
The citation identifies the technical document the Commission has linked to a presumption of conformity today. The proposal would decide how quickly the remaining AI standards arrive, whether they can be read without a request, and where their status is tracked. Both matter mainly to providers of high-risk AI systems. Harmonised standards under the AI Act serve the rules for high-risk AI systems and general-purpose AI models, not the Article 50 transparency duties.
How a Standard Gets Legal Effect Under the AI Act
Article 40(1) links the AI Act to European standardisation. High-risk AI systems and general-purpose AI models that conform to harmonised standards are presumed to meet the requirements in Section 2 of Chapter III (Articles 8 to 15) and the obligations for general-purpose AI models in Chapter V, Sections 2 and 3, to the extent the standards cover them. The condition is that the standard’s reference has been published in the Official Journal in accordance with Regulation (EU) No 1025/2012. A standard that CEN and CENELEC have adopted but the Commission has not cited carries no presumption.
Applying a harmonised standard is voluntary. Article 17(1)(e) requires the provider’s quality management system to name the technical specifications, including standards, that it applies. Where harmonised standards are not applied in full or do not cover every relevant Section 2 requirement, the system must also state the other means used to meet those requirements.
When standards fail to arrive, Article 41 lets the Commission adopt common specifications by implementing act. It can do so where no European standardisation organisation accepted the request, or the standards missed their deadline, did not comply with the request, or insufficiently address fundamental rights concerns, and where no citation is expected within a reasonable period. Conformity with a common specification carries the same presumption.
The route from request to citation has been slow. The impact assessment accompanying the Commission’s proposal (SWD(2026) 786), prepared before EN 18286 was cited, reports that the harmonised standards requested for the AI Act were delayed by at least two years and not yet delivered. The original request had set an April 2025 deadline. Across all sectors, the Commission’s 2025 evaluation found that a harmonised standard takes six years on average.
EN 18286: The First Cited AI Act Standard
Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 publishes the reference of EN 18286:2026, Artificial intelligence: Quality management system for EU AI Act regulatory purposes. The decision entered into force on its publication on 14 October, and the presumption runs from that date. CEN and CENELEC drafted the standard under standardisation request C(2025) 3871 of 23 June 2025, which replaced the original 2023 request. The decision identifies it as the request’s item on quality management systems for providers of AI systems, including post-market monitoring processes. CEN and CENELEC approved it in June 2026 and describe it as the first European standard developed to support the AI Act.
Article 17 sets out what that quality management system has to contain. The list includes a strategy for regulatory compliance and for managing modifications to the system, examination, test and validation procedures, data management, the Article 9 risk management system, post-market monitoring under Article 72, serious incident reporting under Article 73, record-keeping for all relevant documentation, and an accountability framework for management and staff.
Article 17 sits in Section 3 of Chapter III, outside the Section 2 requirements that Article 40(1) names. The Commission’s decision states that EN 18286 satisfies the requirements it aims to cover and that compliance with a harmonised standard confers a presumption for the corresponding requirements. The AI Omnibus added to Article 40(2) a request for deliverables that facilitate joint compliance with, and presumption of conformity for, Sections 2 and 3 and the Annex I product legislation, but left paragraph 1 unchanged. How far the presumption reaches for the quality management system obligation is a question for counsel.
As amended by the AI Omnibus, Article 113 applies the high-risk requirements, including Article 17, from 2 December 2027 for systems classified under Annex III and from 2 August 2028 for systems covered by Annex I. That gives providers a cited reference for their quality management system more than a year before the obligation applies.
EN 18286 is the only standard listed in the decision. Other topics in the request were still moving through CEN-CENELEC Joint Technical Committee 21 in 2026. According to a CEN-CENELEC update from May 2026, the risk management draft prEN 18228, intended to support Article 9, was in public enquiry until the end of July, and a working draft of prEN 18283 on managing bias had circulated in March.
Bring an agent in a high-risk use case and we can walk through which Article 17 aspects its operation feeds, which records our platform holds, and which stay with your team.
Discuss AI Act readinessWhat COM(2026) 780 Would Change
On 6 October 2026 the Commission published COM(2026) 780, a proposed regulation on European standardisation that would repeal Regulation (EU) No 1025/2012. Its press release estimates that the measures would cut the average time to develop a standard from six years to four. The Commission’s questions and answers name AI among the strategic technologies where the EU is “increasingly unable to rely on standards providing presumption of conformity”.
Under Article 42 of the proposal, references to Regulation (EU) No 1025/2012 would be read as references to the new regulation. Article 40 of the AI Act would therefore run through the new procedure without being amended.
| Area | Regulation 1025/2012 today | Proposal COM(2026) 780 |
|---|---|---|
| Access to cited standards | No general free-access rule. Article 6 asks national bodies to ease SME access, for example through free drafts, free abstracts and reduced prices. Since the Court of Justice’s 2024 ruling in C-588/21 P, cited standards can be read free of charge, read-only, after an individual request. | Article 5: unrestricted free online access in every authentic language, in a readable, searchable and printable format, kept available after a reference is withdrawn. |
| Status tracking | References are published in the Official Journal. | Article 7: an EU Standards Platform listing cited standards and common specifications, explaining how to access them, and showing each request and its implementation status. Under Article 23(4), draft requests are published there for one month of comments. |
| Commission assessment | Article 10(5) provides for an assessment without a time limit. Article 10(6) requires publication “without delay” once a standard satisfies the requirements. | Article 25: assessment within six months of delivery, publication targeted within three months of a positive result, partial citation with restrictions possible, and notice of non-compliance within six months. |
| Missed deadlines | For the AI Act, Article 41 common specifications. | Article 25(8): the Commission can amend the request, redirect it to a designated standards development organisation, or adopt common specifications. |
| Interim presumption | None. | A harmonised standardisation deliverable can carry presumption as a step towards a harmonised standard and is withdrawn once the standard is cited. |
Free access would reach EN 18286
According to the impact assessment, cited standards can already be consulted free of charge, but only read-only and after an individual request through readability platforms. Article 5 would replace that with unrestricted online access, and Recital 12 of the proposal says the same access should extend to standards cited under the current regulation. That would cover EN 18286 once the new rules apply.
Access is to work without mandatory pre-identification or subscription. For standards requested under the new rules, it may be limited to self-standing parts that contain everything needed to comply. Economic operators in third countries with a legitimate interest would reach the texts through their authorised representative. The Commission’s questions and answers put the scope at around 3,650 of the 27,000 standards in the European catalogues.
The same recital limits what that access covers. It leaves the standardisation organisations’ copyright claims untouched and lets them apply digital rights management against mass extraction or re-use, citing developments in AI. Loading the full text of cited standards into a retrieval index would still depend on the terms the copyright holder sets.
Interim deliverables are an open question for the AI Act
The proposal creates the harmonised standardisation deliverable: a document that need not reach the same level of consensus as a full standard but can still provide a presumption of conformity while the standard is finished. Recital 30 gives digital products and services with short lifecycles as an example. Article 40 of the AI Act, however, grants presumption to harmonised standards. The proposal does not amend the AI Act, and its financial statement says targeted changes to sectoral legislation could follow. Whether an interim deliverable would carry presumption for AI Act requirements is therefore not settled by the text.
Common specifications under Article 41
Article 32 of the proposal sets a general framework for common specifications. Recital 8 states that the regulation is without prejudice to sectoral rules on common specifications, which indicates that the AI Act’s own Article 41 conditions would remain unless the AI Act itself is amended. Those conditions include a trigger for standards that insufficiently address fundamental rights concerns, which the general framework does not contain.
Who drafts the standards would become visible
Article 4 of the proposal would require the standardisation organisations to publish, for each requested standard, the organisations taking part in its technical bodies and the interests they represent. The impact assessment notes that the European Ombudsman opened an inquiry in 2025 into how the Commission ensures transparency, inclusiveness and accountability in the adoption of harmonised standards for the AI Act.
Status and Timeline
COM(2026) 780 is a proposal under the ordinary legislative procedure (2026/0307(COD)). The European Parliament and the Council both have to agree on a text. As proposed, Article 43 would apply the regulation six months after it enters into force, and the Commission’s financial statement plans for entry into force in 2028. The Commission says the final transition period will be set in the adopted act. Until then, Regulation (EU) No 1025/2012 governs every AI standard the Commission cites, as it did for EN 18286.
Mapping Operational Evidence to a Cited Standard
A standard describes what a quality management system has to contain. The evidence that the system works comes from operating the AI system: monitoring results, incident decisions, retained records. For an agent in a high-risk use case, several Article 17 aspects depend on what the runtime records. Connic AI Governance, an Enterprise entitlement, generates controls from an approved assessment, one for each applicable obligation and each tied to its AI Act article. For a provider of a high-risk system, the following controls correspond to Article 17 and the provisions it refers to:
What to Do Now
Confirm which agents fall under Annex III or Annex I and whether the organisation is their provider. Article 17, and with it EN 18286, matters only in that case.
Obtain EN 18286:2026 from a national standardisation body, or request free read-only access, and compare its structure with any quality management system already in place.
Record the standard and edition applied, the requirements it covers for the system, and the means used for anything it does not cover.
Check that post-market monitoring, incident handling and log retention produce the records the quality management system says they will.
Track further citations under the AI Act and the positions of Parliament and Council on COM(2026) 780, and update the record when either changes.
None of this is legal advice. Whether a system is high-risk, which role the organisation holds, and whether a standard has been applied correctly are decisions for the organisation and its counsel.
Further reading: EU AI Act enforcement and evidence, Article 50 disclosure rules, who owns AI Act readiness.