EN 18286 has been published

On 19 October 2026, the European Commission published the reference to EN 18286 in the Official Journal of the EU. The standard covers the quality management system that Article 17 of the AI Act requires of providers of high-risk AI systems. That listing makes it the first harmonised standard under the AI Act.

Who this concerns

Article 17 applies to providers of so-called high-risk AI systems. These include diagnostic imaging software that falls under the medical device rules, obstacle detection modules built into a collaborative robot, and tools that screen CVs or score candidates. They also include the credit scoring models used by banks, exam marking and school guidance systems, safety components in energy networks, and decision support tools for granting social benefits. The list goes further than that.

A provider is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under their own name. A professional user can become a provider too, by substantially modifying a system or changing what it is meant to do. A company that simply uses an AI tool it bought is a deployer instead. Its obligations are lighter, and EN 18286 is not among them.

What the presumption of conformity changes

EN 18286 is so far the only AI management standard that lets a provider be presumed compliant with the AI Act, and only for the requirements of Article 17. In practice, the provider cites the standard in its EU declaration of conformity.

That declaration is only a statement. The presumption rests on genuinely applying the standard, which the provider must be able to show if checked, through its documentation and records. It therefore does not depend on holding a certificate. A provider without one still benefits, as long as the standard is really applied. As for the certificate, it does not bind the market surveillance authority, but it remains solid evidence.

Certification and regulatory assessment are different roles

Several players can appear in this picture, and they do very different things.

An accredited certification body steps in at the company's request. The company may choose to have its quality system certified against EN 18286. That certification is voluntary and no regulation requires it. A customer, on the other hand, can impose it on suppliers by contract, and it then becomes an efficient way for them to show how seriously they work. Certification bodies will first have to be accredited against this new standard before they can issue their first certificates.

A notified body is a private organisation appointed by a Member State to assess conformity before a product reaches the market. The law requires its involvement, but only in certain cases. That applies to products already subject to third party assessment, such as medical devices, and to some biometric systems. For most other high-risk systems, no third party is imposed and the provider may assess its own conformity.

The market surveillance authority is a public service. It checks systems after they have been placed on the market and it can impose penalties. It is the body that verifies, during an inspection, that the provider really applies the standard.

What about aviation

Civil aviation sits in Annex I, but in a section of its own. The AI Act does not apply directly to those products. Once the Commission adopts AI rules inside the aviation regulations, with support from EASA, it will have to take the technical requirements of the AI Act into account. Article 17, and therefore EN 18286, is not among those requirements.

AI systems intended exclusively for military or defence purposes fall outside the regulation altogether. A dual use system, civil and military, remains covered.

In practice, a supplier embedding AI in airborne equipment will follow EASA guidance rather than EN 18286. It can still become a provider under the AI Act through another activity, for instance by developing and selling a recruitment or industrial inspection tool to other companies.