Wide exterior photograph of the Berlaymont building, headquarters of the European Commission in Brussels

The Berlaymont building in Brussels is the headquarters of the European Commission. Implementing Decision (EU) 2026/2274 was signed in Brussels and dated 12 October 2026. This image shows the building itself. It is not a photograph taken when the decision was adopted, and the date it was taken has not been verified. Photo: Nuno Nogueira; source: Wikimedia Commons; licence: CC BY-SA 2.5.

On 14 October 2026, European Commission Implementing Decision (EU) 2026/2274 was published in the Official Journal of the European Union and entered into force the same day. It cites EN 18286:2026, developed by CEN and CENELEC, as the first harmonised standard supporting the Artificial Intelligence Act. Providers of high-risk AI systems may apply the standard on a voluntary basis and obtain a presumption of conformity with the Article 17 quality management system requirements it covers. The remaining harmonised standards have yet to be published.

Publication and entry into force of the implementing decision

Commission Implementing Decision (EU) 2026/2274 was adopted in Brussels on 12 October 2026 (document number C/2026/7073) and published in the L series of the Official Journal on 14 October 2026. Article 2 of the decision provides that it enters into force on the day of its publication in the Official Journal. Recital 6 explains that the presumption of conformity arising from compliance with a harmonised standard applies from the date on which the reference to that standard is published in the Official Journal. The annex to the decision lists only one standard: EN 18286:2026 Artificial intelligence – Quality management system for EU AI Act regulatory purposes.

According to the recitals of the decision, the Commission had previously used Implementing Decision C(2025) 3871 to request that the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) draft harmonised standards in support of the AI Act. EN 18286:2026 corresponds to point 9 of Annex I of that request, namely the quality management system for providers of AI systems, including the post-market monitoring process. After an assessment carried out with the two bodies, the Commission concluded that the standard meets the requirements of the Act that it is intended to cover, and therefore cited it in the Official Journal. According to the Commission's standardisation page, the work was carried out by the two bodies' Joint Technical Committee JTC 21, and the draft standard prEN 18286 entered public enquiry on 30 October 2025. In its news release of 15 October, CEN-CENELEC noted that the day of publication in the Official Journal coincided with World Standards Day.

In-text figure: a code-drawn timeline, with the node 2025-10-30 prEN 18286 enters public enquiry.

Timeline of EN 18286:2026 from public enquiry to citation in the Official Journal. Sources for the nodes: the public enquiry on 2025-10-30 is documented on the European Commission's standardisation page. Adoption on 2026-10-12, publication and entry into force on 2026-10-14, and the start of the presumption of conformity are documented in Implementing Decision (EU) 2026/2274. 2026-10-15 and 2026-10-19 are the publication dates of the CEN-CENELEC page and the European Commission explanatory page, respectively. This is an AI-generated illustrative chart. Its dates and labels have been checked one by one, and the spacing between nodes does not represent the actual length of time between them.

The Article 17 requirements covered by the standard

Article 17 of the AI Act requires providers of high-risk AI systems to put a quality management system in place. The system must be documented in a systematic manner in the form of written policies, procedures and instructions, and must cover at least 13 aspects: a strategy for regulatory compliance and the management of modifications; procedures for design, development, quality control, and testing and validation; the technical specifications and standards to be applied; data management; the risk management system referred to in Article 9; post-market monitoring under Article 72; the reporting of serious incidents under Article 73; communication with competent authorities, notified bodies and other relevant parties; record-keeping; resource management; and an accountability framework for management and staff. Paragraph 2 requires the implementation to be proportionate to the size of the provider. Paragraph 3 allows providers that are already subject to quality management obligations under sectoral legislation to incorporate these aspects into their existing systems. Paragraph 4 sets out special arrangements for financial institutions subject to EU financial services law.

According to the Commission's explanation, EN 18286 turns these requirements into an operational quality management system. Its clauses correspond to Article 17, and it is structured around the lifecycle of the AI system rather than around the organisation itself. CEN-CENELEC, for its part, says the standard turns the Article 17 requirements into concrete, auditable requirements that providers can apply directly. The text of the standard was not consulted for this article (it must be purchased from the standardisation bodies). For the specific clause structure, the official text prevails.

Article 113 of the Act determines when the Article 17 obligations begin to apply. According to the amended text compiled by artificialintelligenceact.eu (an unofficial compilation), they apply from 2 December 2027 to the high-risk systems listed in Annex III and from 2 August 2028 to the high-risk systems listed in Annex I. The Commission's explanation of 19 October says only that the standard was published before the high-risk requirements begin to apply. The specific dates should be confirmed against the original text of the amending regulation published in the Official Journal.

Scope and limits of the presumption of conformity

Article 40(1) of the Act provides that high-risk AI systems that conform to harmonised standards, or parts of them, whose references have been published in the Official Journal are presumed to conform to the requirements of Section 2 of Chapter Three of the Act, to the extent that those standards cover those requirements. For general-purpose AI models, they are presumed to comply with the corresponding obligations in Chapter Five. For EN 18286:2026 specifically, the Commission states that providers that implement the standard benefit from a presumption of conformity with the Article 17 requirements covered by the standard. This presumption has the following limits:

  • Voluntary application: The Commission's standardisation page states that applying the standard remains voluntary and that providers may choose other frameworks to demonstrate compliance. The role of harmonised standards is to provide legal certainty.
  • Limited to the requirements the standard covers: The presumption applies to the Article 17 quality management system requirements covered by EN 18286. It does not extend to other requirements such as risk management, data governance, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity. Of the ten areas in which the Commission requested standards, this decision cites only one: quality management.
  • Partial application requires a separate explanation: Article 17(1), point (e), requires that, where the relevant harmonised standards are not applied in full or do not cover all the relevant requirements, providers set out in their quality management system the means they use to ensure compliance.
  • Starting date: Under recital 6 of the decision, the presumption applies from the date on which the reference was published, namely 14 October 2026. The decision itself does not address the dates of application of the obligations laid down in Article 113.

One distinction matters here: EN 18286:2026 is currently the only standard for which a presumption of conformity has been published. In its explanation of 19 October, the Commission said more harmonised standards will follow, but it gave no timetable. Until harmonised standards in other areas are cited in the Official Journal, providers cannot invoke the Article 40 presumption for the corresponding requirements. Instead, they must show by other means how they meet the provisions of the Act.

Relationship with ISO/IEC 42001 and other systems

The Commission says EN 18286 is designed to build on existing international standards rather than replace them. Examples include ISO/IEC 42001 (AI management systems), ISO 9001 (quality management systems), and sectoral quality management systems such as ISO 13485 for medical devices. The standard explicitly allows providers in regulated sectors to integrate their management systems rather than run a separate one. Organisations that have not adopted ISO/IEC 42001 but plan to place high-risk AI systems on the EU market or put them into service can also use EN 18286 either to extend an existing quality management system or to build a new one that meets Article 17.

The two types of standard have different legal effects. The Commission describes EN 18286 as the only AI quality management system standard that confers a presumption of conformity. International standards such as ISO/IEC 42001 are not listed in the annex to this decision, and relying on them alone does not provide the presumption referred to in Article 40. However, existing systems can serve as a basis for implementing EN 18286. Based on the original texts cited above, the following checkpoints can be drawn up (they are not compliance advice and have not been verified through an actual audit):

  • Applicable version: The version cited in the Official Journal is EN 18286:2026. The number and title listed in the annex to the decision prevail.
  • Precondition: The presumption is relevant only to the Article 17 obligations of providers of high-risk AI systems. Whether a system is high-risk must first be determined under Article 6 of the Act and Annexes I and III.
  • Record the scope of application: State in the quality management system documentation whether the standard is applied in full. Where it is applied only in part, explain how the remaining requirements are met, as required by Article 17(1), point (e).
  • Track subsequent citations: Whether harmonised standards in other areas have taken effect should be determined from implementing decisions published later in the Official Journal.

References

  1. European Commission. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689. OJ L, 2026/2274, 14.10.2026. ELI: http://data.europa.eu/eli/dec_impl/2026/2274/oj

  2. European Commission. First harmonised standard supporting the AI Act published in the Official Journal. 2026-10-19.

  3. CEN-CENELEC. First ever European standard on AI published in the OJEU. 2026-10-15.

  4. European Commission. Standardisation of the AI Act. The page is undated.

  5. Regulation (EU) 2024/1689: Article 17: Quality Management System; Article 40: Harmonised Standards and Standardisation Deliverables. Unofficial compiled text from artificialintelligenceact.eu.

  6. Xishu Zhifa · Law is the art of the rules of the game

  7. This information was compiled and published by the Scholay One-Stop Academic Platform. If it infringes your rights, please let us know and it will be taken down.

  8. This information is also published on Ente Academic, a community for scholars in the age of intelligence.