AI Regulation Tracker / Standards and governance
Europe Sends Its First AI Act Harmonised Standard to Public Enquiry
Public enquiry ran October 30 to December 27, 2025; the draft is now moving toward a formal vote. prEN 18286 is the quality management system standard for the EU AI Act, the first of the harmonised AI standards to reach the public comment stage. It is not final and not yet citable for a compliance presumption.
The EU AI Act is written to lean on harmonised standards. When a company can follow a standard that has been cited in the Official Journal, it earns a presumption of conformity with the parts of the Act that standard covers. That is the mechanism that turns a broad legal obligation into something a quality team can actually implement. For a long time the harmonised standards for the AI Act existed only as work items. prEN 18286 is the first one that became a real, reviewable draft.
What it covers is the backbone of AI Act compliance. prEN 18286 sets out a quality management system for AI, mapping to Article 17 of the Act, which requires providers of high-risk AI to put a documented QMS in place. The draft is described as playing "a central and overarching role by providing systematic processes to ensure AI systems meet applicable regulatory requirements throughout their life cycle." In plain terms, it is the scaffolding standard. The other AI Act standards deal with specific risks and controls. This one describes how you run the management system that ties all of that together and keeps it running over the life of the system.
What stage is prEN 18286 actually at?
This is where precision matters, because it is easy to read a headline and assume the standard is done. It is not. The public enquiry, the stage where any stakeholder can submit comments through their national standards body such as DIN in Germany, AFNOR in France, or BSI in the UK, ran from October 30 to December 27, 2025. Those comments were then reviewed, and the draft moved on to a formal vote by the national standardization bodies. That is real progress, but a draft out for formal vote is still a draft. Until the standard is finalized, published, and cited by the Commission, it does not give you the presumption of conformity that a finished harmonised standard would.
Does prEN 18286 create any obligation right now?
No. A draft standard imposes nothing. The obligation comes from the AI Act itself, and the Article 17 quality management system duty attaches to high-risk AI providers on the Act's own timeline, not on this standard's. What prEN 18286 does is preview the shape of the QMS that regulators and notified bodies will expect to see. Reading it now tells you where the bar is being set before it becomes the official yardstick. Building to a draft you cannot yet cite is a strategic choice, not a legal requirement, and the reason to do it is lead time.
What should executives do while it is still a draft?
Treat prEN 18286 as an early look at the compliance target and get your house in order against it. Have your quality and compliance leads read the draft and compare it to whatever AI governance and quality processes you run today. Most organizations already have a management system for quality or information security they can extend rather than rebuild from scratch, and the sooner you see how prEN 18286 maps onto what you have, the cheaper the eventual adoption. Do not, however, tell a regulator or a customer that you comply with a harmonised standard that does not exist yet. The honest position is that you are aligning to the draft AI QMS standard in advance of its finalization. That is both accurate and a stronger competitive posture than waiting for the final text and then scrambling.
Questions professionals are asking
Is prEN 18286 a finished standard I can comply with?
No. It is a draft. Its public enquiry ran from October 30 to December 27, 2025, and it has since moved to a formal vote by the national standardization bodies. Until it is finalized, published, and cited by the Commission, it does not confer a presumption of conformity with the EU AI Act.
What does the standard cover?
It sets out a quality management system for AI, mapping to Article 17 of the EU AI Act, which requires high-risk AI providers to maintain a documented QMS. It is described as playing a central, overarching role, giving systematic processes to ensure AI systems meet regulatory requirements across their life cycle.
Who wrote it and why does it matter?
It was developed by CEN/CLC/JTC 21, the joint CEN and CENELEC technical committee on artificial intelligence. It matters because it is the first of the AI Act harmonised standards to reach public enquiry, which makes it the first concrete preview of what AI Act compliance will look like in practice.
What should we do before it is finalized?
Have quality and compliance teams read the draft and map it against your existing management systems so you are ready to adopt it quickly once it is published. Do not claim compliance with a standard that is not yet final. Frame your work honestly as pre-alignment to the draft AI QMS standard.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any standard or requirement applies to your situation with qualified counsel in the relevant jurisdiction.