It is the most awaited European standard of the AI Act construction site: EN 18286 on the quality-management system for the Regulation’s regulatory purposes. Public enquiry closed, formal vote concluded in June 2026, publication imminent. But for the presumption of conformity a further step will still be needed: citation in the Official Journal of the EU. A status update, based solely on public sources.
Among the deliverables of the joint technical committee CEN-CLC/JTC 21 supporting the AI Act, one occupies a special position: EN 18286, “Artificial Intelligence — Quality Management System for EU AI Act Regulatory Purposes”. This seems the right place to take stock, warning the reader that what follows rests exclusively on information made public by the institutions and standardisation bodies.
Article 17: the QMS as a provider obligation
The starting point is Article 17 of the AI Act, which requires providers of high-risk AI systems to establish a documented quality-management system, overseeing conformity with the Regulation’s requirements throughout the lifecycle: from the strategy for regulatory compliance to the design, development, testing and validation procedures, from data management to post-market monitoring. It is a product-compliance obligation, calibrated on the requirements of Section 2 of Chapter III: it must not be confused with the voluntary adoption of an organisational AI management system under ISO/IEC 42001, which answers to a different logic and purpose.
A European home-grown standard
Unlike much of the corpus under development, EN 18286 is born European. As declared by JTC 21, it is a “home-grown” standard, “designed to provide presumption of conformity with Article 17 of the Act”. Its scope, per the public catalogue abstract, is: “this document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems”. The Commission marked the October 2025 milestone: “on 30 October 2025, prEN 18286 […] became the first harmonised standard for AI to enter public enquiry”.
The accelerated path and the current status
The calendar was compressed by an exceptional decision of the CEN and CENELEC Technical Boards (14–16 October 2025 meeting): to ensure the availability of the AI Act standards by the fourth quarter of 2026, “in the case of a positive Enquiry vote”, the “direct publication of the drafts without a separate Formal Vote — a known and fully legitimate procedure” was allowed. As to progress, the public catalogue records, at the closing date of this contribution, the conclusion of the formal-approval phase in June 2026, with EN publication scheduled for the second half of July 2026 and formal status still “not published”. Consistently, the standard is “not harmonised”: no OJEU citation has yet occurred. Here is the legally decisive point, which we reiterate: the EN’s publication by CEN-CENELEC does not by itself activate the presumption of conformity. Article 40(1) reserves it to systems that conform to “harmonised standards, or parts thereof, the references of which have been published in the Official Journal of the European Union”: the Commission’s scrutiny and official citation will therefore be required. Only from that moment will conformity with EN 18286 count as presumption of conformity with Article 17.
What providers can do today
In the meantime, three operational lines. First, those developing systems destined to fall within high risk — with obligations applicable, by effect of the Digital Omnibus, from 2 December 2027 for Annex III and 2 August 2028 for Annex I — should set up their QMS now on the architecture of Article 17, which is the binding reference whatever happens to standardisation. Second, monitor the EN’s publication and, above all, the subsequent OJEU citation, which is the legally relevant event. Finally, assess integration with existing management systems — quality, information security and, where adopted, the AI management system — avoiding parallel, redundant structures.
Conclusions
EN 18286 is the first concrete link between the AI Act and the technical-organisational state of the art: its publication will close the drafting phase but open the no-less-delicate one of harmonisation and implementation. Meeting the fourth-quarter 2026 milestone set by the acceleration decision will say much about the European standardisation system’s ability to keep pace with regulation. In the light of the above, one wonders whether the double step — EN publication and OJEU citation — will be completed in time against the new high-risk calendar: until that moment the presumption of conformity of Article 40 does not operate, and providers remain exposed to a requirement-by-requirement demonstration of compliance, on a terrain that is at once technical, organisational and legal.