EN 18286:2026 Is the Only AI Act Standard the Commission Has Cited

What the Commission has actually cited

Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 was published in the Official Journal on 14 October 2026 and entered into force that day (Article 2). Article 1 publishes the reference of the harmonised standard set out in its Annex. The Annex has a single entry: EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes¹².

The Decision imposes no duty on anyone; it makes one standard available. Every other standard in the CEN-CENELEC JTC 21 programme remains uncited.

Under Article 40 of the AI Act, high-risk AI systems that conform to harmonised standards whose references are published in the Official Journal are presumed to comply with the requirements those standards cover (Recital 1). The Decision ties the presumption to the date of publication of the reference (Recital 6). For EN 18286, that date is 14 October 2026¹.

Who may rely on it, and for what

The standard is attached to Article 17, the quality management system of providers of high-risk AI systems. JTC 21 states that providers who build their quality management system on EN 18286 now benefit from a presumption of conformity with Article 17, and that the presumption is voluntary: providers can meet Article 17 in other ways, but must then show on their own how they comply³.

The exact reach of the presumption depends on Annex ZA of the standard, which maps clauses to AI Act requirements. JTC 21 itself tells readers to check that annex and the Decision for the exact scope³. This brief has not read the standard and does not state what Annex ZA covers.

What is not covered

JTC 21 confirmed on 14 October that EN 18286 is the first deliverable under the standardisation request, not the last, and that the other drafts must still pass adoption by CEN and CENELEC, Commission assessment and citation³. The most recent stage-by-stage account found is the KROG Rules newsletter, a commentary by a participant in the JTC 21 work, with information as at 8 to 15 September 2026⁴:

These statuses are six weeks old and move quickly. Nothing later was verified. They show where the drafts stood, not where they stand.

What is contested or untested

Three points remain open, and none should be read as settled.

1. Article 17 and the scope of Article 40(1). An independent commentator, AI Act Insight, notes that Article 40(1) grants the presumption for the requirements in Section 2 of Chapter III, while Article 17 sits in Section 3, and calls the effect of a standard attached to Article 17 "not settled"⁵. That is an interpretation. JTC 21 and the Decision's recitals proceed on the basis that the presumption exists¹³. No court or regulator has resolved the point in anything found.
2. The deadline. The standardisation request expires on 28 February 2027³⁴. A draft amendment notified on 30 July 2026 would move expiry to 31 August 2028, but as at 4 September it was a draft, not an adopted act⁵. Its later status was not checked.
3. Certification. EN 18286 carries informative mappings to EN ISO 9001 and EN ISO/IEC 42001³, but AI Act Insight records no presumption attached to EN ISO/IEC 42001⁵. A management-system certificate is not, on that account, the same as conformity with the cited standard.

Publication dates for EN 18286 also differ across sources: July 2026 generally, 22 July in KROG³⁴. The date of the standard does not affect the date of the presumption, which runs from 14 October 2026.

No enforcement or regulatory guidance on use of the presumption was found. It is untested.

What to do with it

Treat EN 18286 as an available route to demonstrating Article 17, not as a requirement. Before building a quality management system on it, read Annex ZA and decide whether the presumption it supports is worth the commitment compared with showing compliance another way.

For the requirements the other drafts address, stop assuming a standard gives you a shortcut. None is cited. A supplier that claims conformity with a "harmonised AI Act standard" for risk management, logging or cybersecurity is describing a draft. The test is simple: ask for the reference published in the Official Journal and the Annex ZA clause relied on. If neither exists, the claim is not a presumption.

This brief is not legal advice.