On 19 October 2026 the European Commission announced that it has published the reference to the first AI Act harmonised standard, EN 18286:2026, in the Official Journal of the European Union [1]. Providers of high-risk AI systems that implement it are now presumed to meet the quality management requirements in Article 17 of the AI Act that the standard covers [1].
The standard was developed by CEN and CENELEC and published through Commission Implementing Decision (EU) 2026/2274 [1]. The Commission said it "provides a clear legal pathway for providers of high-risk AI systems" [1]. For schools, universities and teams that buy or build AI tools, it gives a clearer picture of what a recognised quality management system for AI looks like. Read the Commission announcement.
What does the AI Act harmonised standard cover?
EN 18286:2026 carries the title "Artificial intelligence - Quality management system for EU AI Act regulatory purposes" [1]. It turns the Article 17 requirements into an operational quality management system [1]. The Commission describes it as the only AI quality management standard with a presumption of conformity [1].
The standard is mapped to Article 17 [1]. It is built around the life cycle of an AI system rather than around the organisation [1]. The Commission calls it a product-focused framework for governing AI across its lifecycle [2].
The draft, prEN 18286, entered public enquiry on 30 October 2025 [2]. That let national standardisation bodies comment before final publication [2]. CEN and CENELEC develop AI Act standards together in a joint technical committee called JTC 21 [2].
What does a presumption of conformity mean?
The Commission is clear that "The application of standards remains voluntary." [2] Providers can use any other framework to show they comply with the AI Act [2]. But harmonised standards referenced in the Official Journal give legal certainty, and companies that apply them are presumed to comply [2].
The route to that status has set steps. CEN and CENELEC publish a standard, the Commission checks it against the aims and legal requirements of the AI Act, and only then is it referenced in the Official Journal [2]. For EN 18286, the presumption covers the Article 17 requirements that the standard addresses [1].
How does it fit with existing quality standards?
EN 18286 is designed to be layered on top of existing standards such as ISO/IEC 42001, ISO 9001 or a sectoral system like ISO 13485, not to replace them [1]. Providers in regulated sectors can integrate it instead of running a separate, parallel management system [1].
Organisations without ISO/IEC 42001 can also use it [1]. If they intend to place high-risk AI systems on the EU market or put them into service in the EU, they can extend an existing quality system or build their first one with it [1].
When do the high-risk rules apply?
The Commission says rules for systems used in certain high-risk areas, including education, apply from 2 December 2027. Rules for AI systems integrated into products such as robotics and industrial machinery apply from 2 August 2028 [3]. It expects further harmonised standards to follow [1].
The Commission has asked CEN and CENELEC for standards in ten key areas [2]. They are risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment [2]. Quality management is the first to reach the Official Journal [1].
The AI Act treats as high-risk those systems that affect safety, health and fundamental rights, for example in critical infrastructure and law enforcement [2]. The Commission points to Article 6 and Annex III for the full scope [2]. The requirements must be met before a system is placed on the market, and high-risk systems are monitored throughout their lifecycle [2]. More detail is on the Commission's standardisation page.
Who is affected?
- Providers of high-risk AI systems (High). Implementing the standard gives a presumption of conformity with the Article 17 requirements it covers [1].
- Organisations that already hold ISO quality or AI management certifications (Medium). The standard sits on top of these rather than replacing them [1].
- Schools and universities that buy AI tools (Medium). The high-risk scope is set in Article 6 and Annex III [2], and whether an education tool falls within it may need checking, so procurement questions may need updating.
- Remote teams and facilitators using general AI tools (Low). Teams should ask suppliers whether a tool falls within the high-risk category before treating the standard as applicable.
What can schools and teams ask suppliers now?
The high-risk rules do not apply yet, but buyers can start asking clearer questions. Useful ones include:
- Does the supplier consider its AI system high-risk under Article 6 and Annex III of the AI Act [2]?
- Does it run a quality management system for that system, and does it follow EN 18286:2026 or another framework [1]?
- If it uses another framework, how does it show that it meets Article 17 [1]?
- Does it already hold ISO/IEC 42001 or ISO 9001, and does it plan to extend that system [1]?
- How does it monitor the system after release, given that high-risk systems are monitored throughout their lifecycle [2]?
Keep the answers with your procurement records. Suppliers that cannot answer yet may still be planning their approach, so ask for a timeline. Follow-up questions are likely to change as further standards are published.
What is not yet clear?
The Commission describes which high-risk areas fall under the December 2027 and August 2028 dates [3]. It expects further harmonised standards, but the announcement gives no timetable for the remaining areas [1]. The sources do not explain how buyers can obtain or read the standard text, or what it costs. They also do not say how suppliers that choose another framework will be assessed in practice. Whether a given school tool counts as high-risk depends on Article 6 and Annex III, which the sources reference but do not apply to education [2].