Harmonised Standard for the AI Act: What Counts as Evidence Now

On 14 October 2026, the reference to EN 18286:2026 was published in the Official Journal of the European Union, as CEN-CENELEC announced on 15 October 2026. This marks the first time a harmonised standard exists on which the presumption of conformity under Article 40 of Regulation (EU) 2024/1689 can be based. The regulation itself was published in the Official Journal on 12 July 2024, entered into force on 1 August 2024, and, according to IHK Lippe zu Detmold, applies from 2 August 2026. For governance functions, the question now is what evidence this new benchmark actually requires.

What exactly did the Commission decide on 12 October 2026?

Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 refers for the first time to a harmonised standard for the AI Act: EN 18286:2026 on the quality management system.

The standard was developed by CEN and CENELEC and gives providers of high-risk AI systems a clear path to meeting the quality management system requirements under Article 17 of the regulation. The decision, as Nemko Digital reported on 16 October 2026, entered into force on the day of its publication. The European Commission, in a communication dated 19 October 2026, calls EN 18286 the first harmonised standard for the AI Act.

For governance functions that have spent years preparing for a moving target, this is a tangible fixed point. For the first time, it is possible to name concretely what a part of the evidence base is measured against.

How far does the presumption of conformity under Article 40 reach?

It applies exclusively to the quality management requirements under Article 17(1) and the first sentence of Article 11(1), not to the other obligations of the regulation.

Annex ZA of the standard links EN 18286 exclusively to these two provisions. Risk management, data governance, transparency and human oversight are not covered and await their own standards, for which no timeline currently exists. The presumption also applies only to the extent the standard actually covers the relevant requirement, it does not replace a conformity assessment under Article 43 and is not a certification.

One exception concerns financial institutions: providers subject to the Union’s governance requirements for the financial services sector are already deemed to comply with the quality management system obligation, with the exception of points g, h and i of Article 17(1). For all other providers, applying EN 18286 remains voluntary.

Does an existing ISO 9001 or ISO/IEC 42001 certification count as evidence?

Not on its own, because these standards are not harmonised standards within the meaning of the AI Act and are not cited in the Official Journal.

EN 18286 is deliberately designed to build on existing systems such as ISO/IEC 42001, ISO 9001 or the sector-specific quality management standard ISO 13485, rather than replacing them. An organisation already certified under one of these standards therefore holds essential building blocks, but must additionally show that the specific requirements of Article 17(1) are covered.

Applying EN 18286 remains voluntary and does not result in automatic certification. What counts as evidence is therefore not the certificate alone, but the documented mapping of an organisation’s own processes to the requirements of the standard. This mapping can be transferred into a library for standards and frameworks and kept continuously up to date.

What deadlines now apply to the high-risk obligations?

The Digital Omnibus Regulation (EU) 2026/1744 has postponed the application deadlines to 2 December 2027 for Annex III systems and to 2 August 2028 for AI systems in regulated products under Annex I.

At the same time, the earlier clause was deleted under which the high-risk rules would take effect as soon as harmonised standards became available. The availability of EN 18286 therefore does not trigger an automatic start of any deadline. Organisations gain time to prepare the evidence for the quality management system before the remaining high-risk obligations become binding.

For projects already under way, this is not an all-clear, but a shift in time pressure. Organisations that start documenting now can use the additional time to close gaps beyond the quality management system, for instance in risk management or human oversight. This shifts the work from evidence to a steering instrument.

What documentation should be in place now?

Documentation should cover the structure of the quality management system under EN 18286, the mapping to Article 17(1), and a clear delineation of the obligations that remain open.

For those responsible for governance, risk and compliance, this means the evidence for EN 18286 can already be prepared now, even though the full evidence chain will only emerge with further harmonised standards. This work can be embedded into an existing AI governance setup rather than built as a standalone solution. A sensible first step is for the compliance or risk function to carry out a gap analysis between the existing quality management system and the requirements of Article 17(1), and to document it by a self-set internal deadline.

• A current version of the quality management system, structured along the requirements of Article 17(1).
• A comparison of existing certifications such as ISO 9001 or ISO/IEC 42001 against the points in Annex ZA.
• A written justification of which AI Act requirements outside Article 17(1) and Article 11(1) are still covered by other measures.
• An overview of which high-risk systems are subject to the deadlines of 2 December 2027 and 2 August 2028 respectively.

FAQ

Frequently asked questions

What is EN 18286:2026?

EN 18286:2026 is the first harmonised standard for the AI Act. It was published in the Official Journal of the EU on 14 October 2026 and covers the quality management system requirements under Article 17(1) as well as the first sentence of Article 11(1). Since then, a presumption of conformity under Article 40 applies to this part.

For which AI Act requirements does the presumption of conformity under EN 18286 apply?

The presumption of conformity under Article 40 applies exclusively to the quality management system under Article 17(1) and the first sentence of Article 11(1). Other obligations such as risk management, data governance, transparency or human oversight are not covered and await their own harmonised standards, for which no timeline currently exists.

Is an existing ISO 9001 or ISO/IEC 42001 certification sufficient to meet the AI Act?

A certification under ISO 9001 or ISO/IEC 42001 alone is not sufficient, since these standards are not cited in the Official Journal as harmonised standards. EN 18286 does, however, build on such systems. Organisations must additionally document that the specific requirements of Article 17(1) are covered.

What deadlines apply to high-risk AI systems under the Digital Omnibus?

The Digital Omnibus Regulation (EU) 2026/1744 postpones the application deadlines for high-risk AI systems under Annex III to 2 December 2027 and for systems in regulated products under Annex I to 2 August 2028. The availability of EN 18286 does not trigger an automatic start of either deadline.

What should organisations do now to prepare for the AI Act?

A sensible approach is a gap analysis between the existing quality management system and the requirements of Article 17(1), a comparison of existing certifications against Annex ZA, and documentation of which remaining AI Act requirements are still open. This work can be embedded into an existing AI governance structure.

Sources

1. First ever European standard on AI published in the OJEUCEN-CENELEC
2. First harmonised standard supporting the AI Act published in the Official JournalEuropean Commission, Digital Strategy