First Harmonised Standard Under the EU AI Act

The Decision lists the reference EN 18286:2026, titled “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”. It is the first harmonised standard to be cited in support of the EU Artificial Intelligence Act.

The citation is significant because the AI Act sets its requirements in general terms, and harmonised standards are meant to translate them into auditable practice. Until 14 October 2026, no standard had been cited that gave providers of high-risk AI systems a route to a legal presumption of conformity. With this Decision, one now exists, which could give providers, auditors and regulators a common reference point for what a compliant quality management system looks like.

What changes

The practical effect is set out in Article 40 of the AI Act, as quoted in the Decision. High-risk AI systems that conform to a harmonised standard, or parts of one, whose reference has been published in the Official Journal are presumed to conform with the requirements that standard covers. The Decision enters into force on the day of its publication, so the presumption applies from 14 October 2026.

The Decision describes the standard’s subject as quality management systems for providers of AI systems, including post-market monitoring processes. That corresponds to Article 17 of the AI Act, which requires providers of high-risk AI systems to put a documented quality management system in place. Practitioners in the standardisation community indicate that the presumption relates to these Article 17 requirements. The Decision does not say how much of Article 17 the standard covers, and the presumption applies only to the requirements the standard actually covers.

What Article 17 asks for

Article 17(1) of the EU AI Act lists at least thirteen aspects that the system must address, as written policies, procedures and instructions. These include the following:

• Testing and validation. Point (d) requires “examination, test and validation procedures to be carried out before, during and after the development” of the system, “and the frequency with which they have to be carried out”.
• Post-market monitoring. Point (h) requires a post-market monitoring system in accordance with Article 72, and point (i) procedures for reporting serious incidents under Article 73.
• Risk management and data management. Points (g) and (f) cover the Article 9 risk management system and procedures for data handling, from acquisition to retention.
• Standards and gaps. Point (e) requires providers to specify the standards they apply and, where harmonised standards are “not applied in full or do not cover all of the relevant requirements”, the means used to ensure compliance. A provider using EN 18286 alone could therefore still need to document how it meets requirements the standard does not cover.
• Proportionality. Article 17(2) states that implementation should be proportionate to the size of the provider’s organisation, while respecting the rigour needed for compliance.

Points (d) and (h) set a recurring, not one-off, expectation: procedures with defined frequencies, and monitoring after deployment.

A special rule for financial institutions

The quality management duty falls on providers, meaning organisations that develop a high-risk AI system, or have one developed, and place it on the market or put it into service under their own name. Under Article 17(4), a provider that is an EU-regulated financial institution, for example a bank with its own credit-scoring model, is deemed to meet the duty by complying with its internal governance rules under EU financial services law. Three aspects are excluded from this: the risk management system, post-market monitoring and the reporting of serious incidents. The article adds that harmonised standards “shall be taken into account”. How EN 18286 fits into this arrangement is not clear from the Decision and may only become apparent from the text of the standard.

Whether this applies to Swiss institutions is less clear. Switzerland is not subject to EU financial services law, so the shortcut may not be available to a Swiss bank, and its position would depend first on whether the AI Act applies to it at all.

What harmonisation is, and what it is not

Standards are, in the EU’s own description, voluntary guidelines on how products, services and business processes should work. They are developed by private European standardisation organisations: CEN, Cenelec and, for telecommunications, ETSI. National standardisation bodies then adopt them as identical national standards. A harmonised standard is a specific category, developed following a request from the European Commission.

The route to that status follows the EU’s standardisation framework, Regulation (EU) No 1025/2012, which the Decision cites. The Commission first issues a standardisation request, here Decision C(2025) 3871 of 23 June 2025. CEN and Cenelec then draft the standard, and the Commission assesses whether it satisfies the requirements it is meant to cover. Only when the Commission publishes the standard’s reference in the Official Journal does it become a harmonised standard.

The legal effect of that step is narrow. The standard does not become law, and its text is not published in the Official Journal. What the citation adds is the presumption of conformity in Article 40 of the AI Act: a provider that applies the standard is presumed to meet the requirements the standard covers. According to the EU’s guidance, the use of harmonised standards is usually voluntary, while the technical requirements in EU legislation are always mandatory. Providers can meet those requirements through a harmonised standard or through other technical solutions that reach the same level of compliance.

In practice, this means the following:

• It is voluntary. The AI Act sets the legal obligations. A harmonised standard is one way to demonstrate compliance, not the only way. Providers may choose other means, but then carry the burden of showing that those means meet the requirements.
• A presumption is not a certificate. Applying the standard could ease the demonstration of conformity. It does not replace the conformity assessment procedures that apply to a given system.
• It covers one area. The Decision cites only the quality management standard. Standards on risk management, data governance, logging, accuracy, robustness and cybersecurity are not part of it. CEN-CENELEC representatives have said that work on these continues.

Timing

The citation arrives ahead of the application of the high-risk rules. Under the AI Omnibus, as reported in our August 2026 insight, those rules are postponed to 2 December 2027, and rules for high-risk systems integrated into regulated products to 2 August 2028. Providers could therefore have more than a year to align their management systems with the standard before the obligations apply.

Relevance for Swiss organisations

Switzerland is not bound by the Decision. Swiss providers that place high-risk AI systems on the EU market, and Swiss subsidiaries of EU groups, will nonetheless find the standard relevant, as the AI Act can apply to them regardless of domestic law (see AI Regulation in Switzerland).

The standard may also interest organisations that already work with ISO/IEC 42001, the international management system standard for AI. How the two relate in detail is subject to study and worth closer analysis.

A quality management system with post-market monitoring assumes organisations can measure how its AI systems perform in operation. That connects the standard to the evidence theme running through Swiss and EU expectations: quantified, repeatable and auditable claims about system behaviour rather than one-off assertions.

Sources

• The ruling: Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689, Official Journal of the European Union, L series, 14 October 2026. Free to read on EUR-Lex. It contains the reference and title of EN 18286:2026 but not the text of the standard.
• The AI Act: Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence. Article 17 (quality management system) and Article 40 (harmonised standards) are cited above. Available on EUR-Lex.
• The standardisation request: Commission Implementing Decision C(2025) 3871 of 23 June 2025 on a standardisation request to CEN and Cenelec, cited in recital 2 of the Decision.
• Standards in Europe: the European Union’s guidance for businesses on standards and harmonised standards, Your Europe.
• The standard itself: EN 18286:2026, available through the national standards bodies of CEN and Cenelec members, usually for a fee.