The European Commission announced on October 19 the publication of the standard EN 18286:2026, dedicated to the quality management system provided for by the European AI regulation. Its reference appears in an implementing decision published in the Official Journal of the European Union on October 14, the day this text entered into force.
The implementing decision (EU) 2026/2274, dated 12 October 2026, publishes the reference to only one standard, “Artificial Intelligence – Quality Management System for the European AI Regulation”, developed by CEN and Cenelec. According to the Commission, suppliers that implement it benefit from a presumption of conformity with the requirements of Article 17 covered by the standard. The decision itself refers to the corresponding essential requirements, without citing an article.
On 22 October, the AFNOR Editions shop released the French version, NF EN 18286. The document, dated July 2026, is 52 pages long and carries the status “in force”. Its second printing dates from September 2026.
Thirteen sections to document
Article 17 of Regulation (EU) 2024/1689 requires the provider to have a written quality management system, taking the form of policies, procedures and instructions. It lists thirteen minimum aspects, from regulatory compliance strategy to the management responsibility framework, including testing and validation procedures, data management, the risk management system of Article 9, post‑market surveillance and reporting of serious incidents.
The Commission describes the standard as an operational translation of these requirements, built around the AI system’s lifecycle rather than the organisation. It already presented the draft as a product‑focused framework for governing that lifecycle. Article 17 targets the provider. The company that deploys a high‑risk system falls under Article 26, and becomes a provider if it substantially modifies the system or markets it under its own name (Article 25).
A standard that overlaps with others
According to the Commission, EN 18286 overlaps with existing international standards, such as ISO/IEC 42001, ISO 9001 or a sector‑specific quality system like ISO 13485 for medical devices. It does not replace them, but allows providers in regulated sectors to integrate their management systems instead of running several in parallel. An organisation without ISO/IEC 42001 certification can use it to extend an existing quality system or to build one.
Applying the standard remains optional. A provider can demonstrate conformity using any other framework of its choice, but it must then prove itself that its quality system meets Article 17. The timetable also weighs on these efforts. Regulation (EU) 2026/1744, the digital omnibus on AI, entered into force on 27 July and postponed the application of Sections 1 to 3 of Chapter III, which cover high‑risk systems. They will apply on 2 December 2027 for systems listed in Annex III, and on 2 August 2028 for those integrated into products covered by Annex I, Section A.
Nine areas still without a harmonised standard
EN 18286 addresses point 9 of Annex I of the standardisation request C(2025) 3871, sent to CEN and Cenelec on 23 June 2025. The draft of this standard was the first to enter public consultation on 30 October 2025. The Commission had called for standards in ten areas: risk management, governance and quality of data sets, logging, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. As of 22 October, only quality management has a published harmonised standard.
In its 19 October announcement, the Commission indicated that further harmonised standards are to follow, without providing any dates.
