EN 18286 in six questions
Qué es
The European standard that sets out how to build the quality management system that Article 17 of the AI Act requires from the provider of a high-risk AI system. CEN-CENELEC published it in July 2026, and it is the first harmonised standard under the AI Act.
- Who
- The provider: the company that develops a high-risk AI system and places it on the market or puts it into service under its own name. Inside, quality and engineering build it, with management accountable.
- When
- Cited in the Official Journal since 14 October 2026. Article 17 applies to Annex III high-risk systems from 2 December 2027.
- Where
- In the conformity assessment of the system: in most cases the provider carries it out itself through internal control, and the market surveillance authority can ask for the evidence.
- Why
- It is voluntary, but whoever applies it is presumed to conform with what it covers. According to the AI Office, that includes Article 17.
- How
- With a management system that follows each AI system from design to withdrawal. Details below.
Who it applies to
It depends on the company's role with each system, not on the company as a whole.
| If the company… | EN 18286 |
|---|---|
| Develops a high-risk system and sells it or uses it under its own name | It is the standard written for the quality management system that Article 17 requires |
| Uses someone else's high-risk system | It is not required. It helps to know what to ask of the provider |
| Uses or develops AI that is not high-risk | It does not apply. For an AI management system, the standard is ISO/IEC 42001 |
A company that uses someone else's system can become its provider if it puts its name or trademark on it, makes a substantial modification or changes its intended purpose (Article 25). Knowing whether a system is high-risk is the first step: it is in the high-risk pillar.
What it asks for
It has the structure of any management system: context, leadership, planning, support, performance evaluation and management review. Three things are specific to this standard.
- It starts from the AI Act. It asks you to identify the legal requirements that apply to each system and to decide a strategy to meet them, including the conformity assessment route and how changes will be handled.
- It follows each AI system. Most of the standard covers its life cycle: design and development, verification and validation, data management, technical documentation, placing on the market, supply chain, modifications, post-market monitoring, serious incident reporting and withdrawal. It has a section for systems that keep learning in use.
- It refers to the other standards. The management system plans and controls the work of Articles 9 to 15, and each of them will have its own standard. The risk part, for example, assumes a risk management system that complies with Article 9, and the European standard for that article, prEN 18228, is still a draft. In the meantime, a template to identify the risks of an AI system.
What the citation in the Official Journal gives
The Commission cited the standard on 14 October 2026 in Implementing Decision (EU) 2026/2274, without restrictions, because it considers that the standard meets the requirements of the AI Act it aims to cover. From that day, whoever applies it is presumed to conform with what it covers. Its Annex ZA links it to Article 17 and to the first sentence of Article 11(1), on technical documentation, and according to the AI Office the presumption includes Article 17.
The presumption reaches what the standard covers, not the whole system. The product requirements of Articles 9 to 15 still need their own evidence, and their standards are still drafts. The status of each one is in the pillar table.
Where to start
- With ISO/IEC 42001: EN 18286 is built on top of it. Its Annex C maps the clauses of the two standards.
- With ISO 9001: the same, with Annex B.
- With your sector's quality system, such as ISO 13485 for medical devices: Article 17(3) allows what the AI Act asks for to be integrated into it, without running a separate one.
- Without a management system: you can start directly with EN 18286. ISO 42001 is not a prerequisite.
The standard is not free. It is sold by CEN-CENELEC through any of its national members, for example as BS EN 18286 from BSI in the United Kingdom. National standards bodies have until 31 January 2027 to publish their version.
How we build it with each client's team is in quality management system.
