What happened
On 19 October the European Commission announced that the AI Act has its first harmonised standard. It is EN 18286:2026, "Artificial intelligence — Quality management system for EU AI Act regulatory purposes", prepared by the CEN-CENELEC committee JTC 21. The reference to it was published in the Official Journal of the EU through Commission Implementing Decision (EU) 2026/2274 on 14 October. The decision entered into force the same day.
The standard describes the quality management system that Article 17 of the AI Act requires from providers of high-risk AI systems. A provider that applies it gets a presumption of conformity with the Article 17 requirements the standard covers. Using it is voluntary. Anyone who takes another route has to show on their own that their quality system meets Article 17. The standard's informative annexes map it to ISO 9001 and ISO/IEC 42001, so a company with an existing system can extend it rather than build from scratch.
The Commission requested standards in ten areas. The other nine, including risk management, data, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment, do not yet have a standard cited in the Official Journal. No publication dates have been given for them.
Our read
We flag this as our interpretation. The first standard is not about how to build a safe model. It is about how a company manages the process in which an AI system is built, tested, changed and retired. That is good news for anyone who already runs a decent quality system, and bad news for anyone who hoped AI Act compliance could be bought as a product feature.
The most important question, though, is not "do we have the standard" but "are we a provider at all". Article 17 binds providers. Most companies that buy off-the-shelf AI systems are deployers, with separate obligations under Article 26. The line is thinner than it looks: whoever places a high-risk system on the market under their own name, or substantially modifies it, takes on the provider role under Article 25. A company that built a tool for assessing candidates or creditworthiness from a vendor's model and its own data can wake up with a manufacturer's obligations.
The second point is timing. Obligations for Annex III systems apply from 2 December 2027, as we covered in the new Digital Omnibus deadlines. That leaves about thirteen months, and a benchmark carrying a presumption of conformity exists today for only one of the ten areas. We expect, and this is speculation, that some of the remaining standards will not land before that date. In those areas compliance will have to be shown through your own documentation, without the presumption. The quality system is therefore the only piece you can close against a template today. It is worth doing now, because the rest will take more work.
Why it matters
Private Equity
In portfolio companies that sell AI products for recruitment, credit scoring or other Annex III uses, add one question to the review: is the quality management system mapped to EN 18286, and if not, who will do it and by when. "We have ISO 42001" is a good starting point, but it is not the same thing. The presumption of conformity comes from a standard cited in the Official Journal, and Decision 2026/2274 cites only EN 18286.
Enterprise
If you run a certified ISO 9001 or ISO/IEC 42001 system, commission a gap comparison against EN 18286. In parallel, inventory the internal AI tools that could fall under Annex III and, for each one, settle whether you are the deployer or the provider. Tools built in-house on someone else's model are where that answer most often changes.
SMB / mid-market
If you buy a ready-made AI tool rather than build your own, the standard applies to your vendor, not to you. For deployments in mid-sized companies, one question to the vendor of any tool that assesses people or their creditworthiness is enough: is your quality system aligned with EN 18286. No answer tells you something about the vendor's maturity before it becomes your problem.
One move for this week
Take the list of AI systems your company uses and note two things for each: whether it falls into the Annex III categories, and whether you have modified it or sell it under your own name. Every row with "yes" to both is a place where you may be the provider, and then EN 18286 is your starting point. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI