Part of the AI Regulation News hub.
Commission Implementing Decision (EU) 2026/2274 publishes the reference of EN 18286:2026, the AI quality management system standard, in the Official Journal, which the decision says is the step that confers a presumption of conformity
The decision is two articles and one annex. Its legal work is to publish a reference. Whether a provider benefits depends on what the standard covers, and the standard itself is not part of the decision.
Bottom line: In force, but it creates no duty of its own. The decision publishes in the Official Journal the reference of one harmonised standard, EN 18286:2026. Nothing in its text that we read makes using the standard compulsory; its recitals tie publication to a presumption of conformity for the requirements the standard covers.
Who this affects: Providers of high-risk AI systems and the quality, compliance and regulatory-affairs leads who run their quality management systems; counsel advising them on AI Act conformity; and organisations already certified to ISO/IEC 42001 or ISO 9001 that are deciding what to add.
Issue date: Adopted 12 October 2026. Published in the Official Journal on 14 October 2026 (OJ L, 2026/2274, 14.10.2026). Under Article 2 it entered into force on the day of publication. The Commission's own news page is dated 19 October 2026, last updated 21 October 2026.
What changed: On the Commission's account, this is the first time the Annex to a Commission decision lists a harmonised standard drafted for the AI Act. It has one entry: EN 18286:2026, Artificial intelligence, Quality management system for EU AI Act regulatory purposes. The Commission page calls it the first harmonised standard supporting the AI Act to be published in the Official Journal.
Analysis: Read the decision for what it does not do. It does not reproduce the standard, set application dates, or say which parts of the AI Act's quality management requirement the standard fully covers. The presumption, in the decision's own words, attaches to the requirements covered by the standard. That makes the scope clause of EN 18286 the document to read, and we did not read it.
Primary sources: EUR-Lex: Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 · European Commission: First harmonised standard supporting the AI Act published in the Official Journal (19 October 2026)
- Instrument (EN)
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689
- Authority
- European Commission. The standard was drafted by CEN and Cenelec under a Commission standardisation request
- Jurisdiction
- European Union (the text is marked as having EEA relevance)
- Status
- In force. Entered into force on the day of publication in the Official Journal under Article 2
- Bindingness
- The decision is in force but publishes a reference; we found no provision in it that makes the listed standard compulsory
- Issue date / next deadline
- Adopted 12 October 2026; OJ L, 2026/2274, 14.10.2026. No compliance deadline appears in the decision
- Standard listed
- EN 18286:2026, Artificial intelligence - Quality management system for EU AI Act regulatory purposes (Annex, entry 1)
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj/eng
What the Commission published
Article 1 of the decision says that the reference of the harmonised standard for high-risk AI systems, listed in the Annex, is published in the Official Journal. Article 2 says the decision enters into force on the day of that publication. That is the entire operative text.
The Annex has a single row: EN 18286:2026, Artificial intelligence, Quality management system for EU AI Act regulatory purposes. The standard's own text is not reproduced or attached.
Why a reference in the Official Journal matters
The recitals explain the mechanism. Recital 1 recalls that, under Article 40 of the AI Act, high-risk AI systems or general-purpose AI models that conform to harmonised standards, once the references are published in the Official Journal, are to be presumed to conform to the requirements those standards cover. Recital 6 adds that the presumption runs from the date the reference is published, which is why the decision enters into force on that date.
A presumption of conformity is a procedural advantage, and the decision treats it as one. It does not say that a provider outside the standard is non-compliant, and it does not say that a provider inside it is immune from anything beyond the covered requirements.
The route the recitals trace
Recital 2 points to Implementing Decision C(2025) 3871 of 23 June 2025, a Commission request to CEN and Cenelec to draft harmonised standards for the AI Act. Recital 3 says the work corresponding to point 9 of Annex I to that request, on quality management systems for providers of AI systems including post-market monitoring processes, was completed and produced EN 18286:2026.
Recital 4 says the Commission assessed, together with CEN and Cenelec, whether the standard complies with the request. Recital 5 is the finding. We use it as this page's pull quote because it is the operative judgment in the decision.
What the Commission says the standard does
The decision itself says nothing about the standard's content beyond its title. The Commission's news page does. On the Commission's account, EN 18286 provides a legal pathway for providers of high-risk AI systems to meet the quality management system requirements of Article 17 of the AI Act, and providers who implement it get a presumption of conformity with the Article 17 requirements covered by the standard.
The same page says the standard is built around the AI system lifecycle rather than the organisation, and is designed to sit on top of existing management systems such as ISO/IEC 42001, ISO 9001 or a sectoral system like ISO 13485, rather than replace them. It also says the standard lets providers in regulated sectors integrate management systems instead of running separate ones. These are the Commission's characterisations; we have not tested them against the standard.
One more Commission claim needs a flag. The page says EN 18286 is the only AI quality management standard with a presumption of conformity. That fits the decision's Annex, which lists only this standard. It is the Commission's statement about the present position, not something the decision itself says.
Two dates, and which one counts
The decision carries 12 October 2026 as its date of adoption and 14.10.2026 as its Official Journal date, and Article 2 ties entry into force to publication. EUR-Lex shows 14 October 2026 as the first date of entry into force.
The Commission news page is headed Publication 19 October 2026 and says it was last updated on 21 October 2026. That is the date of the announcement, not of the decision. We use the Official Journal dates for the instrument.
The news page also says the publication comes ahead of the application of requirements for high-risk AI systems, with further harmonised standards expected to follow. The decision does not state application dates, and we do not draw any here.
What we did not verify
We opened the authentic Official Journal text of Implementing Decision (EU) 2026/2274 on EUR-Lex in English, including the recitals, both articles, the footnotes and the Annex, and the Commission news page of 19 October 2026. The quotations and figures here are checked against those two extracts.
We did not open EN 18286:2026 itself, which is a CEN and Cenelec publication, so we cannot say what its scope clause covers, which Article 17 paragraphs it addresses in full or in part, or how it relates to ISO/IEC 42001 in detail. We did not open Implementing Decision C(2025) 3871 or Article 40 of the AI Act directly; our statements about them rest on how this decision describes them.
We make no claim that using EN 18286 is required, that any market surveillance authority has said how it will treat a provider relying on the presumption, or that conformity with the standard satisfies the AI Act as a whole. The inference that the standard's scope clause is the document to read first is ours.
Publication of the reference is the trigger the decision describes for a presumption of conformity, limited to the requirements the standard covers. A provider weighing EN 18286 should get the standard, read what it says it covers, and map that against Article 17 before treating the presumption as settled. That is our advice on method, not a statement the decision makes.
Source File
https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj/eng
Open the EUR-Lex page for Implementing Decision (EU) 2026/2274 and confirm the date of 12 October 2026, the Official Journal date 14.10.2026, Articles 1 and 2, recitals 1, 5 and 6, and the one-row Annex. Then open the Commission page and confirm the Article 17 and ISO/IEC 42001 statements.
Standard EN 18286:2026 satisfies the requirements which it aims to cover and which is set out in Regulation (EU) 2024/1689. ยท Recital 5, Commission Implementing Decision (EU) 2026/2274, 12 October 2026
FAQ
Is EN 18286:2026 mandatory under the AI Act?
Nothing in the decision's text that we read makes it compulsory. The decision publishes the standard's reference, and its recitals tie that to a presumption of conformity for the requirements the standard covers. We have not read the standard or the AI Act article text directly.
What does the presumption of conformity cover?
On the decision's recital 1, the requirements covered by the standard. On the Commission's news page, the Article 17 quality management system requirements covered by the standard. Which requirements those are depends on the standard's own scope, which we did not open.
When did Implementing Decision 2026/2274 take effect?
Article 2 says it enters into force on the day of publication in the Official Journal. The Official Journal date is 14 October 2026, and the decision is dated 12 October 2026. The Commission's 19 October page is a news announcement.
Does the decision say when high-risk AI obligations apply?
No. The decision does not state application dates. The Commission page says only that publication comes ahead of the application of requirements for high-risk AI systems.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.