The AI Act: dates, tool and articles
EN 18286: set up your AI Act quality management system
Decision (EU) 2026/2274, read in the Official Journal on 17 October 2026
EN 18286:2026 is the European standard for the quality management systems of AI providers, including post-market monitoring. On 14 October 2026 the Commission published its reference in the Official Journal, which made it the first harmonised standard under the AI Act. It is still the only one, and ISO 42001 is not among them.
- Who it applies to
- Providers of high-risk AI systems, who must run the quality management system of Article 17, and anyone asked whether ISO 42001 is enough.
- The dates
- The quality management system is owed from 2 December 2027 for an Annex III system and from 2 August 2028 for an Annex I product.
- The one thing to do
- Tick the 13 points below that you already run, see what is left, and read the table before you rely on the standard.
The 13 aspects of Article 17(1)
Article 17(1) asks for a documented quality management system with at least these aspects, quoted from the Official Journal. Tick what your system already does. Nothing you tick leaves this page.
Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions, and shall include at least the following aspects:
Our reading of ISO/IEC 42001:2023: the clauses and Annex A controls whose records are the process behind each point, checkable against both texts. In our reading an ISO 42001 system runs 7 of the 13 in full and 6 in part.
ISO 42001 runs part of it, and the Act asks for more4.2A.2.2A.2.3A.6.2.5
ISO 42001 runs thisA.6.1.3A.6.2.2A.6.2.3A.6.2.4
ISO 42001 runs thisA.6.1.3A.6.2.3A.6.2.4
ISO 42001 runs part of it, and the Act asks for moreA.6.2.4A.6.2.6
ISO 42001 runs part of it, and the Act asks for moreA.6.2.2
ISO 42001 runs thisA.7.2A.7.3A.7.4A.7.5A.7.6
ISO 42001 runs part of it, and the Act asks for more6.1.26.1.3A.5.2A.5.3A.5.4A.5.5
ISO 42001 runs part of it, and the Act asks for moreA.6.2.6A.8.3
ISO 42001 runs part of it, and the Act asks for moreA.8.4A.3.3
ISO 42001 runs thisA.8.2A.8.5A.10.4
ISO 42001 runs this7.5A.6.2.7A.6.2.8
ISO 42001 runs thisA.4.2A.4.3A.4.4A.4.5A.4.6A.10.3
ISO 42001 runs this5.3A.3.2A.10.2
of 13aspects in place
Still open
- (a) Regulatory compliance strategy
- (b) Design, design control and verification
- (c) Development, quality control and assurance
- (d) Examination, test and validation
- (e) Technical specifications and standards
- (f) Data management
- (g) Risk management system
- (h) Post-market monitoring
- (i) Serious incident reporting
- (j) Communication with authorities and others
- (k) Record-keeping
- (l) Resource management and security of supply
- (m) Accountability framework
All 13 are in place. What is left is keeping the evidence current.
Start the AI Act systemNo card to start · cancel in-app anytime
The AI Act's obligations as a catalogue and the ISO 42001 records that evidence them, in one workspace.
Regulation (EU) 2024/1689, Article 17(1), read on 17 October 2026.
What the citation gives you, and what it does not
| Question | Answer | Source |
|---|---|---|
| Is it cited? | Yes. EN 18286:2026 is the only harmonised standard cited under the AI Act. | Decision (EU) 2026/2274, Annex |
| Since when? | 14 October 2026, the day of publication. | Article 2 of the Decision |
| Written for | “quality management systems for providers of AI systems, including post-market monitoring processes” | Recital 3; standardisation request C(2025) 3871 |
| What the presumption of conformity reaches | Articles 8 to 15, and 53 to 55 for general-purpose AI models, as far as a standard covers them. | AI Act, Article 40(1) |
| How far EN 18286 reaches into Articles 8 to 15 | The Decision does not say, and we have not read the paid standard, so we do not say either. | Decision, Articles 1 and 2 |
| Your quality management system | Checked against Article 17 itself: by you under internal control, or by a notified body. | AI Act, Annex VI point 2 and Annex VII point 3.2 |
| ISO/IEC 42001 | Not cited, so a certificate carries no presumption of conformity under the AI Act. | Decision (EU) 2026/2274, Annex |
StandardOS has not read EN 18286 and does not certify. National standards bodies sell the standard, and conformity is assessed by you or a notified body.
Questions about EN 18286
Is EN 18286 a harmonised standard under the AI Act?
Yes. Commission Implementing Decision (EU) 2026/2274 published its reference in the Official Journal on 14 October 2026, in force that day. It is the first harmonised standard cited under the AI Act and, read on 17 October 2026, the only one.
What does applying EN 18286 give you under Article 40?
Article 40(1) presumes conformity with Articles 8 to 15, and 53 to 55 for general-purpose AI models, as far as a cited standard covers them. A quality management system holds part of that ground, such as the Article 9 risk management system and data management. The Decision does not say how far EN 18286 covers it.
Is ISO 42001 a harmonised standard under the AI Act?
No. EN ISO/IEC 42001 is not in the Decision's Annex, so a certificate carries no presumption of conformity under the AI Act. It is evidence of a managed system. In our reading that system runs much of what Article 17(1) lists, and the tool above shows where.
What must an AI Act quality management system contain?
At least the aspects of Article 17(1), points (a) to (m), written down as policies, procedures and instructions. Article 17(2) scales the work to the size of the provider and names SMEs, start-ups and SMCs.
What is the difference between prEN 18286 and EN 18286:2026?
prEN is how CEN and Cenelec number a draft. EN 18286:2026 is the adopted European standard, and it is the edition the Decision cites. Anything written about the draft predates the citation.
Where can I get EN 18286?
From a national standards body, which sells it under its own prefix, such as BS EN or DIN EN. We do not host it and have not read it. The Decision and the AI Act are free to read on EUR-Lex.
Is EN 18286 mandatory?
No. A harmonised standard is voluntary. The obligation is Article 17, and a provider may meet it another way, stating the specifications it applied, as Article 17(1)(e) asks.
All 13 points of Article 17, in one system
The AI Act's obligations as a catalogue and the ISO 42001 records that evidence them, in one workspace.
Start the AI Act systemWhere to start
If you run ISO 42001, switch on the reading above and look at the points it runs in part. Those are written for the Regulation, and Annex A does not hold them. If you run nothing yet, the 13 points are the plan, and EN 18286 is one way to build them.
Whether your system is high-risk at all decides whether Article 17 applies. The determination is free and ends in writing. Is your system high-risk?
The Article 16 provider checklistThe prohibited practices, and the two new bansISO 42001, the AI management system standardThe AI Act: dates, tool and articles
Sources, read on 17 October 2026: Decision (EU) 2026/2274 on EUR-Lex, Regulation (EU) 2024/1689 on EUR-Lex. This page reads the Decision and the Regulation. It is not legal advice.