EU publishes first AI Act quality management standard

The European Commission published EN 18286:2026 on 14 October 2026, making it the first harmonised standard under the EU AI Act. Providers of high-risk AI systems can use it to demonstrate compliance with Articles 11(1) (Technical Documentation) and 17(1) (Quality Management System). Applying harmonised standards is voluntary, and the resulting presumption of conformity extends only to the legal requirements they cover. Providers remain responsible for assessing their systems’ risks and meeting all applicable obligations.

The standard requires providers to identify applicable requirements, define their quality management system’s scope and document a regulatory compliance strategy. Its processes address leadership, accountability, resources, development, validation, data management, supply chains, post-market monitoring and incident reporting. It is designed to integrate with existing AI or sector-specific management systems rather than replace them. Compliance with other management standards alone does not provide the same presumption of conformity.

For most high-risk systems, using harmonised standards does not change the conformity assessment route. Certain biometric systems can qualify for self-assessment when standards or common specifications cover all essential requirements; otherwise, notified-body assessment is mandatory. The Official Journal publishes only the standard’s reference, with the full specifications generally sold by national standardisation bodies. Purchasing access does not establish compliance or certification. Further standards covering areas such as risk management, transparency and cybersecurity remain in development.