The European Commission has published in the Official Journal of the EU the reference to the first harmonised standard supporting the AI Act. EN 18286:2026, developed by the European standards bodies CEN and CENELEC, sets out a quality management system for providers of high-risk AI systems. Under Commission Implementing Decision (EU) 2026/2274, providers that apply it are presumed to meet the quality management requirements of Article 17 of the Act.
What the standard does
EN 18286 turns Article 17 into a working quality management system. It is built around the life of an AI system rather than around the organisation, and it is designed to sit on top of standards many companies already use, such as ISO/IEC 42001, ISO 9001 or a sector system like ISO 13485, rather than replace them. According to the Commission it is the only AI quality management standard that gives a presumption of conformity. Applying standards remains voluntary: a provider can show compliance another way, but a harmonised standard gives legal certainty.
The draft entered public enquiry on 30 October 2025. It is the first of a set: the Commission has asked CEN and CENELEC for standards in ten areas, from risk management and data quality to transparency, human oversight, accuracy, robustness and cybersecurity, and expects more to follow.
Why it matters for public services
The standard applies to providers of high-risk AI, and several high-risk categories cover services that city administrations run or buy:
- safety components in critical infrastructure such as transport;
- education, for example scoring exams;
- recruitment and management of workers, for example CV-sorting software;
- access to essential public and private services.
The Commission gives an application for a public benefit scheme as an example of a decision where it can be hard to tell whether someone was treated unfairly by an AI system. Before high-risk systems can be put on the market, they will need risk assessment and mitigation, high-quality data sets and other safeguards. For a public body buying such a system, the new standard is one concrete thing to ask a supplier about.
The AI Act timeline
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | Banned practices and AI literacy obligations |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models |
| 2 August 2026 | The Act applies in general; the AI Office and national authorities enforce it |
| December 2026 | Ban on AI apps that generate non-consensual intimate images |
| 2 December 2027 | Rules for high-risk uses such as biometrics, critical infrastructure, education and employment |
| 2 August 2028 | Rules for AI built into regulated products such as lifts or toys |
The two high-risk dates were pushed back by the AI Omnibus, a simplification package agreed on 7 May 2026 that entered into force on 27 July 2026. The Commission’s stated aim is that the rules apply once support tools such as standards are ready, which is why this first standard matters.