EU AI Act harmonised standards: EN 18286 is the first reference in the Official Journal

On 14 October 2026 the Official Journal of the European Union published Commission Implementing Decision (EU) 2026/2274, dated 12 October 2026, on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689. Its Annex lists one standard: EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes. CEN-CENELEC calls it the first harmonized standard in support of the AI Act.

What the Decision says

Article 1 of the Decision says the reference of the harmonised standard listed in the Annex is hereby published in the Official Journal of the European Union. Article 2 says the Decision shall enter into force on the day of its publication in the Official Journal of the European Union. The OJ header on EUR-Lex dates that publication 14.10.2026, L series.

The recitals explain where the standard came from:

• The Commission asked CEN and Cenelec for AI Act standards by Commission Implementing Decision C(2025) 3871.
• EN 18286 answers the request corresponding to point 9 of Annex I to that Decision regarding harmonised standard(s) and if necessary European standardisation deliverable(s) on quality management systems for providers of AI systems, including post-market monitoring processes.
• The Commission concluded that Standard EN 18286:2026 satisfies the requirements which it aims to cover.
• Compliance with a harmonised standard confers a presumption of conformity with the corresponding essential requirements set out in Union harmonisation legislation from the date of publication of the reference of such standard in the Official Journal of the European Union.

What it covers: quality management, not the whole Act

CEN-CENELEC says the standard translates the quality management system requirements of Article 17 into practical, auditable requirements that providers of high-risk AI systems can readily apply.

Article 17 requires providers of high-risk AI systems to put a quality management system in place that ensures compliance with this Regulation. The listed aspects run from a strategy for regulatory compliance through the risk management system referred to in Article 9, a post-market monitoring system, in accordance with Article 72 and procedures related to the reporting of a serious incident in accordance with Article 73, to an accountability framework.

The Decision’s Annex has one entry. We queried the EU Publications Office catalogue on 24 October 2026 and found no other implementing decision on harmonised standards under Regulation (EU) 2024/1689. So, as of that date, we found no OJ reference for a standard dedicated to risk management (Article 9), data governance (Article 10), human oversight (Article 14) or accuracy, robustness and cybersecurity (Article 15). See Articles 9 and 15 for what those articles require.

How the presumption works

Article 40(1) says high-risk AI systems that conform to harmonised standards whose references are published in the OJ shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter, or with the GPAI obligations in Chapter V, to the extent that those standards cover those requirements or obligations. CEN-CENELEC says EN 18286 offers a clear route to demonstrating compliance and benefiting from presumption of conformity with the corresponding provisions of the AI Act.

Editorial note, not legal advice: the AI Act Service Desk places Article 17 in Chapter III, Section 3 (obligations of providers), while Article 40(1) refers to Section 2 (requirements). The Decision’s recital (1) restates Article 40 as presumption of conformity with the requirements covered by those standards or parts thereof set out in that Regulation. Ask counsel or your notified body how they read the scope of the presumption for your system before relying on it.

Dates that still apply

Regulation (EU) 2026/1744 moved the high-risk dates: Chapter III, Sections 1, 2 and 3 apply from 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and from 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I. Its recitals cite the delayed availability of standards, common specifications, and alternative guidance among the reasons.

What this means for aerospace, defense and manufacturing suppliers

Editorial judgment: if you are a provider of a high-risk AI system under the EU AI Act, EN 18286 is now the cited route for the quality management system. It does not replace product-level evidence for Articles 9 to 15, and it is not ISO/IEC 42001. We have not found an official source stating that ISO/IEC 42001 certification confers a presumption of conformity under the Act. EN 18286 is a paid standard; we do not reproduce its text.

Questions

Was EN 18286 cited in the Official Journal in October 2026?

Yes. Implementing Decision (EU) 2026/2274 was published in the OJ L series on 14 October 2026 and entered into force that day.

Does EN 18286 give a presumption of conformity for Article 15 cybersecurity?

No source we cite says so. The Decision describes EN 18286 as the deliverable on quality management systems for providers of AI systems, including post-market monitoring processes.

Is using EN 18286 mandatory?

The Act ties a presumption of conformity to harmonised standards in Article 40. Article 17(1)(e) anticipates providers that do not apply harmonised standards in full, requiring them to set out the means to be used to ensure that the high-risk AI system complies with those requirements.