Complying with the European AI Act just got a little easier, on one specific point. Since October 14, 2026, the European Commission has published in the EU Official Journal the very first harmonised standard under the AI Act: EN 18286:2026. For an SME that develops or markets a high-risk AI system, this technical text now offers a clear path to prove compliance, where the AI Act had so far only given general obligations to interpret alone.
In brief
- Standard EN 18286:2026 was cited in the EU Official Journal on October 14, 2026, through Commission Implementing Decision (EU) 2026/2274 of October 12, 2026.
- It is the first harmonised standard published for the AI Act, out of the ten areas covered by the Commission's standardisation request.
- It covers only the quality management system required by Article 17 of the AI Act for providers of high-risk AI systems.
- Applying it remains voluntary, but it grants a presumption of conformity: no need to prove compliance with Article 17 point by point yourself.
- The nine other areas (risk management, data quality, cybersecurity, human oversight...) still have no harmonised standard.
EN 18286, in one sentence
EN 18286:2026 is a European technical standard, developed by the CEN-CENELEC JTC 21 committee, that translates the obligation under Article 17 of the AI Act into concrete, auditable requirements: having a documented quality management system for any high-risk AI system. A provider that builds its quality system on this basis benefits from a presumption of regulatory conformity, without having to demonstrate itself, point by point, that it meets each of the thirteen minimum requirements listed in Article 17.
June 23, 2025
Standardisation mandate
July 27, 2026
Digital omnibus
October 12, 2026
Implementing decision
October 14, 2026
Publication in the Official Journal
December 2, 2027
Annex III deadline
August 2, 2028
Annex I deadline
What the standard covers, and what it doesn't
This is the most important point for an SME leader to remember: EN 18286 only covers part of the AI Act. It addresses the internal organisation (the quality management system), not the technical characteristics of the AI system itself.
Covered by EN 18286
Documented quality management system. Design, control and verification procedures. Post-market monitoring. Serious incident reporting. Thirteen minimum aspects required by Article 17.
Not covered by EN 18286
AI system risk management (Article 9). Data quality and governance. Technical logging. Transparency toward users. Human oversight. Robustness and cybersecurity. Conformity assessment procedures.
For these remaining nine areas, an SME must still demonstrate compliance on its own, relying on the text of the AI Act itself or on existing frameworks such as ISO/IEC 42001 (AI management system) or ISO 9001 (quality). CEN-CENELEC in fact designed EN 18286 to work alongside these two international standards: a company already certified to ISO 9001 or ISO/IEC 42001 can extend its existing system rather than build a new one.
Why this is useful for an SME, in practice
For an SME designing a high-risk AI system (automated recruitment, credit scoring, AI-assisted medical devices...), the practical benefit is twofold.
Less legal uncertainty
No duplicate quality system
A verifiable business argument
Key takeaway
Applying EN 18286 remains voluntary. An SME can still demonstrate Article 17 compliance by other means. But relying on the standard avoids having to prove, alone in front of a supervisory authority, that its "homemade" quality system actually meets each of the text's thirteen requirements.
The timeline is generous, but don't wait
Compliance deadlines for high-risk systems were pushed back by the "digital omnibus" regulation (EU) 2026/1744, in force since July 27, 2026: December 2, 2027 for systems listed in Annex III (human resources, education, critical infrastructure, biometrics...), and August 2, 2028 for systems embedded in products already regulated elsewhere (Annex I). This extra time, while welcome, should not encourage waiting: a quality management system takes several months to build, especially if existing processes need auditing and teams need training.
The European Commission states that more harmonised standards will follow for the nine areas still uncovered (risk management, data quality, cybersecurity...), without giving a precise date. The original standardisation mandate, given to CEN-CENELEC in June 2025, has since been extended to February 28, 2027.
FAQ
Must an SME apply the EN 18286 standard?
No. Applying EN 18286 is voluntary. An SME can demonstrate Article 17 compliance by other means, but it must then prove itself, point by point, that its quality management system meets the thirteen requirements of the text.
Is EN 18286 enough to fully comply with the AI Act?
No. It only covers the quality management system required by Article 17. Nine other AI Act areas (risk management, data quality, cybersecurity, transparency, human oversight...) still have no harmonised standard and must be addressed separately.
Who should care about this standard: all AI users?
Mainly providers of high-risk AI systems, meaning companies that develop or market these systems. An SME that simply uses an AI tool already on the market (a deployer) falls instead under Article 26 of the AI Act, with different obligations.
How does this relate to ISO 9001 or ISO/IEC 42001 certifications?
EN 18286 includes annexes that map its requirements to EN ISO 9001 and EN ISO/IEC 42001. A company already certified to either can extend its existing system rather than build a new one for the AI Act.
In summary
EN 18286 does not make the AI Act simpler as a whole: it remains a dense text, with nine out of ten areas still awaiting their harmonised standard. But on the quality management system, it finally offers a concrete, audited benchmark rather than a general obligation to interpret alone. For an SME designing a high-risk AI system, this is one piece of the compliance puzzle that can be addressed now, without waiting for the 2027 and 2028 deadlines.
To follow upcoming AI Act deadlines and prepare your company's AI compliance, check out our other resources on AI in business.
Sources: CEN-CENELEC (cencenelec.eu, "EN 18286:2026 published in OJEU"); CEN-CENELEC JTC 21 (jtc21.eu, "EN 18286 becomes the first harmonised standard under the EU AI Act"); ActuIA (actuia.com, "EU AI Act: first harmonised standard covers only quality system").
