On 8 October 2026 the Official Gazette published Legislative Decree No 179 of 7 October 2026, which from 23 October 2026 punishes breach of the obligations in Article 16 of Regulation (EU) 2024/1689, the AI Act, with penalties “up to EUR 15 000 000 or, if higher, up to 3 per cent” (Article 23(2); our translation) (Official Gazette (Gazzetta Ufficiale)). Among those obligations is that of having a quality management system that complies with Article 17. The technical instrument for building it is available: in a note of 31 July 2026 CEN and CENELEC announced the publication of EN 18286, the European standard on the quality management system for Article 17, presented as the first standard supporting the implementation of the Regulation (CEN-CENELEC). Regulation (EU) 2026/1744, the Digital Omnibus on AI, has in the meantime rewritten Article 17(2). In our view the most practical question remains open: who, within the provider, builds and operates that system.
Article 17 of the AI Act: the required system and the proportionality of the new paragraph 2
Article 17(1) requires providers of high-risk AI systems to put “a quality management system in place that ensures compliance with this Regulation”, documented “in a systematic and orderly manner in the form of written policies, procedures and instructions” and including at least the thirteen aspects listed in points (a) to (m) (AI Act Service Desk). Content and timetable are set out in our in-depth analysis of what Article 17 requires and how much time is left.
The Digital Omnibus, in force since 27 July 2026, replaced paragraph 2: the implementation of the aspects in paragraph 1 “shall be proportionate to the size of the provider’s organisation, in particular, if the provider is an SME, including a start-up, or an SMC”, and providers shall, “in any event, respect the degree of rigour and the level of protection required” for the compliance of their systems (EUR-Lex). Proportionality concerns the manner of implementation, not the level of protection required. The same Regulation deferred the application of the high-risk rules to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems (EUR-Lex).
EN 18286: publication by CEN-CENELEC and reference in the Official Journal of the Union
According to CEN and CENELEC, EN 18286 specifies requirements and provides guidance for defining, implementing and maintaining a quality management system in organisations that provide AI systems, and is not specific to any sector (CEN-CENELEC). Publication by the European standardisation organisations, however, is not enough: the Commission explains that after that publication it assesses whether the standards meet the objectives and legal requirements of the AI Act, and that only at the end of this step are they referenced in the Official Journal of the Union, with the resulting presumption of conformity (European Commission). At the end of July CEN and CENELEC indicated that the Commission would publish the reference later in 2026 (CEN-CENELEC). As of 12 October 2026 EUR-Lex shows no act referencing EN 18286, nor any Commission implementing decision publishing references of harmonised standards for Regulation (EU) 2024/1689, and the Commission’s page on AI Act standardisation reports no such reference. Until it is referenced in the Official Journal of the Union, those applying EN 18286 do not benefit from the presumption of conformity. The lack of a reference does not, however, shift the calendar: Article 113, as amended, sets fixed dates, and recital 40 of the Digital Omnibus calls on the Commission to ensure in good time the instruments supporting compliance, standards included (EUR-Lex). As Nicola Fabiano notes, the mechanism that would have linked the dates to the availability of those instruments, originally proposed by the Commission, was abandoned (NicFab).
This has a practical effect on point (e) of Article 17, which requires an indication of the “technical specifications, including standards, to be applied” and, where harmonised standards are not applied in full, of the means to ensure compliance nonetheless. In our view, until it is referenced, EN 18286 enters the system as a standard chosen by the provider, and compliance with Article 17 must still be demonstrated aspect by aspect.
The national penalty: Legislative Decree No 179/2026 and the band of up to EUR 15 million
Article 16, point (c), of the AI Act requires providers to “have a quality management system in place which complies with Article 17” (AI Act Service Desk). The decree places Article 16 in the band of Article 23(2), which takes over the ceilings laid down for providers’ obligations in Article 99(4) of the AI Act (AI Act Service Desk). In setting the amount, account is taken of the criteria in Article 99(7) and of the “nature, substantive or formal, of the obligation breached” (paragraph 6); for SMEs and innovative start-ups the lower amount provided for in Article 99(6) applies (paragraph 7). We consider that a system existing only on paper can hardly be classified as a formal breach.
The decree does not refer to the Digital Omnibus on AI and does not make the penalties conditional on the application of the European obligations: the national penalty enters into force more than a year before the European obligation it enforces. In our view no penalty can be imposed for the lack of a system that is not yet required; the decree, however, does not say so.
The accountability framework: allocating the thirteen aspects between management and technical profiles
Point (m) requires “an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listed in this paragraph”. Who does what in the quality management system is a mandatory element of the system itself. Neither the AI Act nor the public information on EN 18286 associates the aspects of Article 17 with professional profiles: the allocation that follows is our own assessment, limited to the points where the link with a profile is supported by the text.
Point (b) concerns the techniques and procedures for “the design, design control and design verification”, and point (a) includes the procedures “for the management of modifications” to systems. These are tasks we attribute to the AI Product Manager, the role that governs the life cycle of AI-based products, in whose profile regulatory requirements enter product planning with priorities and owners. The strategy for regulatory compliance, which opens point (a), remains instead a decision for management.
Points (c) and (d) concern development, with quality control and quality assurance, and the “examination, test and validation procedures to be carried out before, during and after the development”, with their frequency. We attribute them to the AI Machine Learning Engineer and the management of technical debt in machine learning systems, a profile we described through automated pipelines for data, training, evaluation and release, geared to reproducibility. Model evaluation carried out automatically and repeatably offers, in our view, the documentary basis that point (d) requires; monitoring in operation can feed the system under point (h), for which responsibility is however broader.
Point (f) requires systems and procedures for data management, “including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention”, before and for the purpose of placing on the market. The natural reference is the AI Data Engineer, the profile that builds data pipelines, for whom we identified systematic validation, completeness and consistency checks, and traceability of origin and transformations. In our view point (f) describes, operation by operation, the work of those who build data pipelines.
Points (e), (g), (i), (j), (k), (l) and point (m) itself remain outside this allocation: technical specifications, risk management, reporting of serious incidents, communication with authorities and notified bodies, record-keeping, resource management and the accountability framework. These are the aspects in which the system requires management decisions, a quality function and legal expertise.
Critical aspects: certified competences, SMEs and alignment with the text of the standard
The first aspect concerns the nature of the roles referred to: competence profiles which, as we recalled in the articles cited, can be certified by bodies accredited under ISO/IEC 17024. Certification attests the competence of the person, not the conformity of the system, and does not shift the obligation that Article 16 places on the provider. Having certified professionals is not the same as having a compliant management system.
The second concerns smaller businesses. The Digital Omnibus replaced Article 63(1): SMEs, including start-ups, may comply with certain elements of the quality management system in a simplified manner, provided that they have no partner or linked enterprises, on the basis of Commission guidelines, with the aim, stated in recital 28, of “facilitating compliance for more innovators” (EUR-Lex). In the original text the option was available only to microenterprises (EUR-Lex), as Nicola Fabiano also recalls (NicFab). On the Commission’s page those guidelines are still listed among those in preparation (European Commission). In a small business, moreover, the three profiles will often coincide in one or two people: we consider this compatible with Article 17, provided that the framework under point (m) distinguishes who performs from who verifies, because proportionality does not reduce the “degree of rigour” required by paragraph 2.
The third concerns method: the allocation proposed is built on the text of the Regulation and not on the clauses of EN 18286, which is available only for a fee, and the alignment between the two will have to be carried out on the official text of the standard.
Conclusions
The provider retains the obligation to establish and document the system and, under point (m), to establish who is responsible for it; from 23 October 2026 breach of Article 16 is backed by a national penalty. What is missing is the reference of EN 18286 in the Official Journal of the Union and the Commission guidelines on the simplified system for SMEs. We consider it useful for providers of systems intended for high-risk uses to draw up now a responsibility matrix for the thirteen aspects, with an owner and a verifier for each, to document under point (e) the role assigned to EN 18286 and to establish which product, modelling and data engineering competences are missing from their staff. The deferral to 2027 and 2028 leaves time to build this organisation, provided that the work starts now.
Author: Valentina Grazia Sapuppo
