EN 18286: Is ISO/IEC 42001 enough for the EU AI Act?

As of 20 October 2026. This article is general information with sources, not legal advice on any individual case.

On 14 October 2026 the Official Journal of the EU published the reference of the first harmonised standard for the EU AI Act: EN 18286:2026, for the quality management system under Art. 17. If you already run a management system under ISO/IEC 42001, the obvious question is what it is worth under the AI Act. This article sets out what the standard does, with references to the legal text and the Commission's statements.

Key points

• The standard: According to the Commission, EN 18286:2026 translates the Art. 17 AI Act requirements into an operational quality management system (QMS) for providers of high-risk AI systems. CEN and CENELEC developed it.
• Since when: Its reference has been in the Official Journal since 14 October 2026 (Implementing Decision (EU) 2026/2274). From that day, the Commission says, a presumption of conformity applies to the Art. 17 requirements the standard covers.
• Voluntary: No one has to apply EN 18286. What providers of high-risk AI systems must have is the QMS itself.
• ISO/IEC 42001: A certificate under ISO/IEC 42001 gives no presumption of conformity under the AI Act (as of 20 October 2026). EN 18286 is designed to be layered on top of such a management system.
• What is missing: No harmonised standard for the requirements of Art. 8 to 15 has its reference in the Official Journal (as of 20 October 2026). That affects the technical documentation and the conformity assessment route for biometric systems.

What EN 18286 is

Its title is "Artificial intelligence - Quality management system for EU AI Act regulatory purposes". The European standardisation organisations CEN and CENELEC developed it in their Joint Technical Committee JTC 21. It answers the Commission's standardisation request of 23 June 2025 (Implementing Decision C(2025) 3871), Annex I point 9: quality management systems for providers of AI systems, including post-market monitoring processes.

The Commission's announcement of 19 October 2026 describes the standard this way: EN 18286 is mapped to Art. 17 and built around the AI system lifecycle rather than the organisation. It is designed to be layered on top of existing standards such as ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485, not to replace them. Providers in regulated sectors can integrate their management systems instead of running separate ones. The Commission calls EN 18286 the only AI QMS standard with a presumption of conformity (as of 20 October 2026).

The text of the standard is not freely available; it is sold through the national standardisation bodies. This article therefore relies on the legal text and the Commission's statements, not on the wording of the standard.

When the presumption of conformity applies

The Commission adopted Implementing Decision (EU) 2026/2274 on 12 October 2026. It was published in the Official Journal on 14 October 2026 and entered into force the same day. Its annex lists EN 18286:2026 without restriction. Under recital 6, compliance with a harmonised standard confers a presumption of conformity from the date its reference is published. The Commission announced the standard publicly on 19 October 2026.

According to the Commission, providers implementing EN 18286 benefit from a presumption of conformity with the Art. 17 requirements the standard covers. That is the Commission's position. The wording of Art. 40(1) expressly names the requirements of Chapter III, Section 2 and the obligations for general-purpose AI models; Art. 17 sits in Section 3. Recital 1 of the implementing decision restates Art. 40 more broadly, without limiting it to Section 2. And since the Digital Omnibus on AI (Regulation (EU) 2026/1744), Art. 40(2) requires the Commission to request standardisation deliverables that facilitate the presumption of conformity for Section 3 as well. If you rely on the presumption for Art. 17, cite it as the Commission's position, with the implementing decision and the announcement as sources.

The presumption reaches only as far as the standard covers a requirement. It does not replace the conformity assessment under Art. 43.

When Art. 17 applies

For high-risk AI systems under Annex III, the obligations in Chapter III, Sections 1 to 3, including Art. 17, apply from 2 December 2027. For high-risk AI systems under Art. 6(1) and Annex I, they apply from 2 August 2028 (Art. 113, point (c), as amended by the Digital Omnibus on AI). That leaves a little over 13 months between the publication of the standard and the Annex III date.

A voluntary standard, a mandatory QMS

Harmonised standards are voluntary. The Commission's standardisation page states that providers can choose any other framework to demonstrate their compliance with the AI Act. What is mandatory for providers of high-risk AI systems is the QMS itself: documented in written policies, procedures and instructions, and covering at least the aspects in Art. 17(1), points (a) to (m). The list runs from a strategy for regulatory compliance through data management, risk management and post-market monitoring to an accountability framework for management and staff.

Without a harmonised standard there is no presumption. The provider must then show by other means that its QMS meets Art. 17. Harmonised standards play a role at four points:

• In the QMS: Under Art. 17(1)(e), the QMS names the technical specifications, including standards, to be applied. Where the relevant harmonised standards are not applied in full or do not cover all Section 2 requirements, it names the means used to meet those requirements.
• In the technical documentation: Annex IV point 7 requires a list of the harmonised standards applied whose references have been published in the Official Journal.
• In the EU declaration of conformity: It refers to the harmonised standards used (Annex V point 6).
• In the conformity assessment: Under internal control, the provider itself verifies that its QMS complies with Art. 17 (Annex VI point 2). Under the Annex VII procedure, a notified body assesses the QMS.

ISO/IEC 42001, ISO 9001 and ISO 13485 under the AI Act

ISO/IEC 42001 is the international standard for AI management systems. Under Art. 40(1), however, a standard confers a presumption of conformity only if it is a harmonised standard whose reference has been published in the Official Journal under Regulation (EU) No 1025/2012. ISO/IEC 42001 is not one (as of 20 October 2026). A certificate under ISO/IEC 42001 therefore gives no presumption of conformity under the AI Act. The same holds for ISO 9001 (as of 20 October 2026).

That does not make such a system worthless. The Commission explicitly describes EN 18286 as a standard to be layered on top of ISO/IEC 42001, ISO 9001 or a sectoral QMS. If you run such a management system, you can extend it with EN 18286 instead of building a second one. Organisations without ISO/IEC 42001 can, according to the Commission, use EN 18286 to expand an existing QMS or to build a new one that meets Art. 17.

ISO 13485 and medical devices

Medical devices are a different case. EN ISO 13485:2016/A11:2021 is published in the Official Journal as a harmonised standard under the Medical Devices Regulation (EU) 2017/745 (Implementing Decision (EU) 2022/6). That presumption continues to apply under the MDR. Under the AI Act it gives none (as of 20 October 2026).

Art. 17(3) allows providers that must run a QMS under sectoral Union law to include the aspects of Art. 17(1) in that system. Where a high-risk AI system falls under the Union harmonisation legislation in Annex I, Section A, which includes the MDR, the Art. 17 QMS is assessed as part of the sectoral conformity assessment (Art. 43(3)). According to the Commission, EN 18286 is also meant to complement such a sectoral QMS.

What is still missing (as of 20 October 2026)

The Commission asked CEN and CENELEC for standards in ten areas: risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. As of 20 October 2026, only quality management has a published reference in the Official Journal; the requirements of Chapter III, Section 2 (Art. 8 to 15) have none. The Commission expects further standards to follow. Until then, the gap has two practical consequences.

Technical documentation: describe the solutions in detail

Annex IV point 7 requires a list of the harmonised standards applied. Where none have been applied, it requires a detailed description of the solutions adopted to meet the requirements of Chapter III, Section 2, including a list of other relevant standards and technical specifications applied. As long as no reference has been published for Section 2, this applies to risk management, data, record keeping, transparency, human oversight, accuracy, robustness and cybersecurity. EN 18286 does not change that, because it covers Art. 17. For individual requirements, Art. 42 provides separate presumptions, for example on cybersecurity.

Biometric systems: the notified body route

For high-risk AI systems under Annex III point 1 (biometrics), Art. 43(1) ties the choice of procedure to harmonised standards. Internal control under Annex VI is available only where the provider has applied harmonised standards or common specifications under Art. 41 for the Section 2 requirements. Where harmonised standards do not exist and no common specifications are available, the Annex VII procedure with a notified body applies. EN 18286 covers Art. 17, not Section 2, so it does not open the Annex VI route. As of 20 October 2026, providers of biometric systems that have not applied common specifications are left with Annex VII only.

SMEs, start-ups and small mid-caps

Two provisions, as amended by the Digital Omnibus on AI, concern smaller providers:

• Art. 17(2): The QMS aspects are implemented in proportion to the size of the provider's organisation, in particular for SMEs, including start-ups, and for small mid-cap enterprises (SMCs). Every provider must still respect the degree of rigour and the level of protection required for its high-risk AI systems to comply.
• Art. 63(1): SMEs, including start-ups, that have no partner or linked enterprises within the meaning of Recommendation 2003/361/EC may comply with certain elements of the QMS in a simplified manner. The Commission is to set out in guidelines which elements these are. This does not exempt them from their other obligations, for example under Art. 9 to 15, 72 and 73 (Art. 63(2)).

An SMC is a small mid-cap enterprise as defined in point 2 of the Annex to Recommendation (EU) 2025/1099. The simplification in Art. 63(1) covers SMEs, not SMCs. For both, EN 18286 remains an option, not an obligation.

Financial institutions

For providers that are financial institutions subject to internal-governance requirements under Union financial services law, the QMS obligation is deemed fulfilled by complying with those rules (Art. 17(4)). To that end, the harmonised standards referred to in Art. 40 must be taken into account. Since 14 October 2026, EN 18286 is one of them. Points (g), (h) and (i) of Art. 17(1) are excluded from this: the risk management system, post-market monitoring and serious incident reporting. Financial institutions need these in addition.

Checking the current status

The Commission expects further harmonised standards. You can check the current status free of charge with Lexbeam's EU AI Act MCP server at mcp.lexbeam.com. It makes the AI Act available to AI agents over the Model Context Protocol, with no key and no account. It lists the harmonised standards published in the Official Journal with their reference and the date of the last review. Like this article, it gives general guidance, not legal advice.

Frequently asked questions

Is ISO/IEC 42001 enough for the EU AI Act?

Not for a presumption of conformity. As of 20 October 2026, ISO/IEC 42001 is not a harmonised standard under the AI Act. EN 18286 is designed to be layered on top of an ISO/IEC 42001 management system.

Since when does EN 18286 give a presumption of conformity?

Since 14 October 2026, the day its reference was published in the Official Journal (Implementing Decision (EU) 2026/2274). According to the Commission, the presumption covers the Art. 17 requirements to the extent the standard addresses them.

Is EN 18286 mandatory?

No. Harmonised standards are voluntary. Providers of high-risk AI systems do need a QMS under Art. 17. Without a harmonised standard, they show by other means that it meets the requirements.

Which harmonised standards are still missing?

As of 20 October 2026, no harmonised standard for the requirements of Art. 8 to 15 has its reference in the Official Journal. The Commission expects further standards to follow.

Sources

• Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, OJ L of 14.10.2026
• Regulation (EU) 2024/1689 (AI Act), consolidated version of 27.07.2026. The consolidated text is a documentation tool. The acts published in the Official Journal are authentic.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI)
• European Commission: First harmonised standard supporting the AI Act published in the Official Journal (19 October 2026)
• European Commission: Standardisation of the AI Act
• Commission Implementing Decision (EU) 2022/6 on harmonised standards for medical devices, including EN ISO 13485:2016/A11:2021