According to the Commission, the presumption covers the provider's quality system. The technical requirements that the system itself must meet, from risk management to cybersecurity, still have no published harmonised standard: nine of the ten areas of the Commission's standardisation request await theirs. A provider can align its quality system with EN 18286. It will have to demonstrate by its own means the rest of its product's compliance, before 2 December 2027 for Annex III systems. Article 17 targets the provider. A company that deploys a high-risk system falls under Article 26. If it substantially modifies it or markets it under its name, it becomes a provider (Article 25).

The Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 was published in the Official Journal of the European Union on 14 October. It entered into force the same day. It publishes the reference of a single standard: EN 18286:2026, "Artificial intelligence - Quality management system for the European AI regulation", developed by CEN and CENELEC. The European Commission announced the publication on 19 October. According to it, providers that implement the standard benefit from a presumption of conformity with the requirements of Article 17 of the regulation covered by the standard. The decision itself refers to the corresponding essential requirements, without citing an article.

As of 22 October, the AFNOR Editions store distributes the French version, NF EN 18286. The 52-page document, dated July 2026, has the status "in force"; its second printing dates from September 2026.

Article 17, thirteen items to document

Article 17 of Regulation (EU) 2024/1689 requires the provider to have a written quality management system. It takes the form of policies, procedures and instructions. It lists thirteen minimum aspects, from the strategy for regulatory compliance to the framework of management responsibilities, including test and validation procedures, data management, the risk management system of Article 9, post-market monitoring and reporting of serious incidents.

The Commission sees it as an operational translation of these requirements. It describes it as built around the AI system's life cycle rather than around the organisation. On its page dedicated to standardisation, it already presented the draft standard as a product-focused framework for the governance of this life cycle.

A presumption running since 14 October

The decision is based on Article 40 of the regulation, which it summarises in recital 1: systems conforming to a harmonised standard whose reference is published in the Official Journal are presumed to conform to the requirements covered by that standard. Its recital 6 makes the presumption run from the publication of the reference. It therefore applies since 14 October, five days before the Commission's announcement.

Applying the standard remains optional. The Commission recalls this: a provider can demonstrate its compliance by any other framework of its choice. It will then have to establish itself that its quality system meets Article 17.

ISO/IEC 42001, ISO 9001, ISO 13485: an additional layer

According to the Commission, EN 18286 is designed to be superimposed on existing international standards, such as ISO/IEC 42001, ISO 9001 or a sectoral quality system such as ISO 13485 for medical devices. It does not replace them. It allows providers in regulated sectors to integrate their management systems instead of running several in parallel. An organisation without ISO/IEC 42001 certification can use it to extend an existing quality system or build one.

The regulation already provided for this articulation. Its Article 17, paragraph 3, allows a provider subject to quality obligations under sectoral Union legislation to include the items required by the AI Act. A medical device manufacturer finds in the standard a recognised method for this integration.

Just over thirteen months before Annex III

Regulation (EU) 2026/1744, known as the digital omnibus on AI, entered into force on 27 July. It postponed the application of sections 1 to 3 of Chapter III, which contain the rules on high-risk systems. They will apply on 2 December 2027 for Annex III systems (including biometrics, employment, education and critical infrastructure) and on 2 August 2028 for those integrated into products falling under Annex I, section A. ActuIA detailed this new AI Act timetable.

The same omnibus supplemented Article 17, paragraph 2. The implementation of the quality system was already proportionate to the size of the provider; the text now expressly targets SMEs, start-ups and small mid-cap companies, without lowering the degree of rigour or the level of protection required.

Nine areas still without a harmonised standard

EN 18286 responds to point 9 of Annex I of standardisation request C(2025) 3871, addressed to CEN and CENELEC on 23 June 2025. Its draft had been the first to enter public enquiry, on 30 October 2025. The Commission requested standards in ten areas: risk management, governance and quality of datasets, logging, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. Only quality management has a published harmonised standard as of 22 October.

In its announcement of 19 October, the Commission indicates that other harmonised standards are to follow. It gives no date.

Our articles will then appear first in Google Top Stories.