On 14 October 2026 the Official Journal published Commission Implementing Decision (EU) 2026/2274 of 12 October 2026. Its Annex lists one entry: EN 18286:2026, the first harmonised standard drafted in support of Regulation (EU) 2024/1689, the AI Act. The effect for providers of high-risk AI systems is practical. A provider that follows the standard is presumed to satisfy the quality management duty in Article 17 of the Act, and it gains a conformity assessment route that does not require a notified body.
What the decision does
The decision rests on Article 10(6) of Regulation (EU) No 1025/2012 on European standardisation. Article 1 publishes the reference set out in the Annex, and Article 2 brings the decision into force on the day of publication, 14 October 2026. Recital 6 explains that date: a presumption of conformity runs from the moment the reference appears in the Official Journal.
Recitals 2 and 3 record how the standard came about. By Commission Implementing Decision C(2025) 3871 of 23 June 2025 the Commission asked the European Committee for Standardisation (CEN) and the European Committee for Electrotechnical Standardisation (Cenelec) to draft standards supporting the AI Act. Point 9 of Annex I to that request covered quality management systems for providers of AI systems, including post-market monitoring processes. CEN and Cenelec completed that item and adopted EN 18286:2026, titled “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”. The Official Journal carries the reference and the title of the standard, not its text.
What the presumption of conformity is worth
A harmonised standard is a technical specification drafted by a European standardisation body at the Commission’s request, and using it remains voluntary. Under Article 40(1) of the AI Act, a high-risk AI system or a general-purpose AI model, meaning a model of significant generality capable of many distinct tasks, that conforms to such a standard is presumed to conform to the requirements the standard covers.
The duty covered here is Article 17. A provider of a high-risk AI system must operate a quality management system, that is a documented set of written policies, procedures and instructions. Article 17(1) lists thirteen aspects it must contain, among them a strategy for regulatory compliance, data management, the risk management system of Article 9, post-market monitoring under Article 72, serious incident reporting under Article 73, and an accountability framework for management and staff. Implementation must be proportionate to the size of the provider’s organisation, and a provider already bound by quality management duties under sectoral Union law may fold these aspects into that system.
Article 43(1) gives the published reference its commercial value. For high-risk systems listed in point 1 of Annex III, a provider that has applied harmonised standards may choose between internal control under Annex VI and assessment of its quality management system and technical documentation by a notified body under Annex VII. Where harmonised standards do not exist and common specifications are not available, the Annex VII route is compulsory.
What to watch next
One item of the 2025 standardisation request has now been answered. The requirements on risk management, data and data governance, technical documentation, transparency towards deployers, human oversight, and accuracy, robustness and cybersecurity still have no published harmonised standard, so conformity with them must be shown by other means. Each further reference that CEN and Cenelec deliver narrows the field in which a notified body has to be involved.
Sources: Commission Implementing Decision (EU) 2026/2274; Regulation (EU) 2024/1689 (Artificial Intelligence Act); The EU AI Act Newsletter, issue 113.