Orrick reported that the European Commission published EN 18286:2026 on October 14, 2026, as the first harmonized standard under the EU AI Act, through Commission Implementing Decision (EU) 2026/2274. The standard concerns AI quality management. For providers of high-risk AI systems, it can support a presumption of conformity, meaning a legal presumption that specified requirements are met, but only for requirements the cited standard covers. Applying harmonized standards is voluntary.
What Article 40 presumes
Article 40 of the EU AI Act limits the presumption of conformity to requirements or obligations covered by the relevant harmonized standard, or by a part of it. The European Commission’s Article 40 text states this general rule for high-risk AI systems and general-purpose AI models.
The Commission’s general wording covers both categories when a cited standard covers the relevant obligations. Orrick describes EN 18286 in connection with high-risk AI providers and Articles 11(1) and 17(1), which concern technical documentation and quality management. Those references describe the reported scope of this standard; Article 40’s general rule does not, by itself, extend that scope to general-purpose models.
The quality-management work attributed to EN 18286
A quality-management system (QMS) sets out how an organization manages the processes needed to meet its requirements. Orrick says EN 18286 calls on providers to identify applicable obligations, define their QMS’s scope and document a compliance strategy. That strategy includes conformity assessment, managing modifications, post-market monitoring and serious-incident reporting.
Orrick’s account also describes lifecycle controls for leadership and accountability, staff competence and resources, design and development, verification and validation, data management, supply-chain controls, non-compliance and management review. These are reported elements of the standard’s quality-management approach, rather than a clause-by-clause account.
Voluntary use alongside existing standards
Providers may choose whether to apply a harmonized standard, in whole or in part, and can demonstrate compliance by other means. The EU AI Act’s binding requirements and providers’ responsibility to assess relevant risks remain in force.
Orrick describes EN 18286 as complementary to ISO/IEC 42001, ISO 9001 and sector-specific QMS standards such as ISO 13485. Those standards can be integrated with it, but using them alone does not provide the AI Act presumption associated with a cited harmonized standard. Buying access to EN 18286 also does not certify a system or prove that a provider complies.
Article 40’s wider standardization objective
The European Commission AI Act Service Desk identifies its consolidated text as current to July 27, 2026. Article 40 includes an objective for standardization documents, including harmonized standards where appropriate, to facilitate joint compliance with the EU AI Act and relevant Union harmonization laws listed in Annex I. This broader objective sits within Article 40’s standardization framework; Orrick’s account of EN 18286 focuses on high-risk AI system providers.
