The European Commission has published Implementing Decision (EU) 2026/2274 in the Official Journal, citing EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes. Developed by CEN-CENELEC, it is reported to be the first harmonised standard cited under the AI Act (Regulation (EU) 2024/1689). The decision was adopted on 12 October and took effect on publication on 14 October 2026.
What changes
- Providers of high-risk AI systems that apply EN 18286 get a presumption of conformity with the AI Act requirements it covers, mainly the Article 17 quality management system duty.
- Using it is voluntary, and it does not certify an AI system or remove any other AI Act obligation.
- Existing quality management systems, and ISO/IEC 42001 AI management systems, do not automatically meet EN 18286, so a gap analysis is needed.
- Separately, on 12 October the Commission opened feedback on a draft implementing regulation setting procedural rules for AI Office enforcement under Articles 75c and 75d, which were added by the AI omnibus (Regulation (EU) 2026/1744). Feedback is reported to close on 9 November 2026.
Providers of high-risk AI systems, and manufacturers that build AI into regulated products, should obtain EN 18286 and assess their quality management system against it. Organisations already using ISO/IEC 42001 should map the differences. Providers of general-purpose AI models and very large online platforms should review the draft procedural rules.
Source: EUR-Lex: Commission Implementing Decision (EU) 2026/2274
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
