EN 18286: the AI Act quality management system standard, what it covers and what it doesn’t
EN 18286 is the first harmonised standard for the AI Act and it is now published in the Official Journal. It helps providers of high-risk AI demonstrate the Article 17 quality management system. But it doesn’t cover everything: risk and data are still waiting for their own standards, and a quality standard does not replace an AI governance model.
What EN 18286 is
EN 18286:2026 is the first harmonised standard for the AI Act. It describes how to set up and maintain the quality management system (QMS) that Article 17 requires from providers of high-risk AI systems. CEN-CENELEC approved it in July 2026, and the Commission published its reference in the Official Journal of the EU on 14 October 2026 (Implementing Decision (EU) 2026/2274).
That publication is what gives it weight: if you apply it, you benefit from a presumption of conformity with the Article 17 requirements it covers. Put simply, you are assumed to comply with that part unless shown otherwise. Using it is voluntary; you can demonstrate compliance by other means, but then the burden of justifying it is on you.
It is not sector-specific: it applies to any provider of high-risk AI, whatever the industry.
What it covers and what it doesn't
EN 18286 covers the management system: how the provider organises itself to comply. That means the elements listed in Article 17: regulatory compliance strategy, design, development and verification procedures, data management, risk management, post-market monitoring, serious incident reporting, communication with authorities, record-keeping and accountability.
What it does not cover, and it's worth being clear about it:
- The detail of risk management. The standard requires a risk management system across the whole life cycle, but leaves the method to prEN 18228, which is still a draft.
- Dataset quality and governance. That is the scope of prEN 18284, also still in preparation. For high-risk systems, risk and data (Articles 9 and 10) usually weigh more than many other requirements.
- Other technical requirements, such as logging, accuracy, robustness or cybersecurity, which will have their own standards.
- A technical evaluation of the model. The standard assesses how the provider is managed, not whether the system performs well.
Until those other standards are published, risk and data compliance has to be demonstrated directly against the text of the AI Act.
How it fits with ISO 42001 and ISO 9001
| EN 18286 | ISO/IEC 42001 | ISO 9001 | |
|---|---|---|---|
| What it is for | Meeting the Article 17 QMS duty of the AI Act | Governing AI across the organisation | General quality management |
| Presumption of conformity with the AI Act | Yes, for what it covers | No | No |
| Stand-alone certificate | No: assessed within the AI system's conformity assessment | Yes | Yes |
| Continual improvement and impact assessment | Not its focus: “quality” means meeting legal requirements | Yes | Continual improvement, yes |
EN 18286 includes annexes that map its clauses to ISO 9001 and ISO/IEC 42001. They help you find your way, but they only pair clauses: holding one of those certificates does not mean you meet EN 18286. In practice, many high-risk providers will end up with ISO 42001 (for customers and internal governance) and EN 18286 (for the AI Act).
If you already have a quality management system
You don't need to build a second one alongside it. There are two different cases:
- If sectoral EU law already requires you to have a QMS (for example, the Medical Devices Regulation, where ISO 13485 is commonly used), Article 17(3) lets you include the AI Act elements in that system.
- If you have ISO 9001, which is voluntary, Article 17(3) does not refer to it. Even so, you can reuse what already works (document control, internal audits, management review) and add what is specific to the AI Act.
Financial institutions have their own rule (Article 17(4)): part of the obligation is deemed met through their internal governance rules.
Where do I start?
It depends on your starting point. “If you're starting from scratch, go straight to EN 18286” is risky advice: a management standard applied without a governance foundation behind it tends to end up as a document system nobody runs.
- First, know what you have. An AI systems inventory and risk classification. EN 18286 only concerns you if you are a provider of a high-risk system.
- If you are and have nothing in place: set up the governance basics first (owners, committee, risk method, data management) and build the QMS on top, following EN 18286.
- If you already have a sectoral QMS or ISO 9001: integrate, don't duplicate.
- If you already have ISO 42001: keep it and add what EN 18286 requires (compliance strategy, traceability, incident reporting deadlines, non-compliance handling).
- If you only use third-party AI (you are a deployer) or your systems are not high-risk, EN 18286 is not your priority.
A quality standard is not an AI governance model
EN 18286 helps you demonstrate one specific AI Act obligation. It does not decide which AI uses your organisation accepts, how responsibilities are split between business, IT and legal, or how impact on people is assessed. That is AI governance, and it's best settled before, or alongside. We cover it in AI governance vs data governance and in the guided AI Governance path.
Frequently asked questions
Is applying EN 18286 mandatory?
No. What is mandatory, for high-risk providers, is having the Article 17 quality management system. The standard is the most direct way to demonstrate it.
Can I get certified against EN 18286?
Not as a stand-alone certificate, the way ISO 42001 works. Compliance is assessed within the AI system's conformity assessment.
When do I need it ready?
When the high-risk obligations apply, which the Digital Omnibus postponed. See the up-to-date dates in the AI Act timeline.
Informational content; it does not constitute legal advice. Harmonised standards are paid and their text is protected: we only summarise general ideas from public sources. Review your case with a qualified professional.
What's your Data Governance maturity?
Free assessment with your priority gaps and the templates on the Data Governance path.