EN 18286

What it is

EN 18286 is titled Artificial intelligence. Quality management system for EU AI Act regulatory purposes. It was developed by CEN-CENELEC's technical committee JTC 21, and it is built around the quality management system the Act requires of providers of high-risk AI systems at Article 17.

CEN-CENELEC ratified it on 12 July 2026, describing it as the first European standard developed to support the implementation of the EU AI Act (CEN-CENELEC on the publication of EN 18286). BSI has published it in the UK as BS EN 18286:2026 (BSI on BS EN 18286:2026).

How to get a copy

You buy it from a national standards body. CEN-CENELEC agrees the text, and its national members publish and sell it in their own countries.

In the UK that is BSI, which lists BS EN 18286:2026 as current with a publication date of 31 July 2026 (BS EN 18286:2026 at BSI Knowledge). In other European countries the national body publishes an identical national version, and those national adoptions are due by January 2027 (Intertek on EN 18286). Whichever version you buy, the technical content is the same.

What the citation changes

Publishing a European standard is something CEN-CENELEC and the national bodies do. Citing one in the Official Journal of the EU is something the European Commission does, separately and afterwards. Only the second turns a standard into a harmonised standard for legal purposes: Article 40 gives a presumption of conformity to systems that conform to harmonised standards whose references have been published in the Official Journal.

For EN 18286 that second step came on 14 October 2026. Commission Implementing Decision (EU) 2026/2274, adopted on 12 October, published the standard's reference in the Official Journal and entered into force the same day. Its annex lists EN 18286:2026 with no restrictions attached (Commission Implementing Decision (EU) 2026/2274, citing EN 18286). It is the first standard to be cited under the Act.

In practice, a provider of a high-risk AI system whose quality management system conforms to EN 18286 is now presumed to meet the requirements of Article 17 that the standard covers. The presumption is about the quality management system alone. The Act's other requirements for high-risk systems, such as risk management, data governance, transparency, human oversight, accuracy and cybersecurity, still have to be met on their own terms, and no standard for any of them has been cited yet.

Why you may see a 2027 date attached to it

European standards carry two dates and they are easy to mix up. The date of ratification is when CEN-CENELEC approved the text, which for EN 18286 was 12 July 2026. A later date, usually around six months afterwards, is the deadline by which every national standards body has to publish an identical national standard and withdraw any conflicting ones.

That second date is an administrative deadline for the national bodies, not a sign that the standard is still pending. BSI met it within a fortnight. If you see a 2027 date next to EN 18286, that is what it refers to. It has no bearing on the citation, which took effect on 14 October 2026.

How it sits next to ISO 42001

They do different jobs and neither replaces the other. ISO/IEC 42001 is an international management system standard for governing AI across an organisation, and an accredited body can certify you against it (ISO/IEC 42001:2023). EN 18286 is European, and it is written around a specific legal requirement in a specific regulation.

CEN-CENELEC's own framing is that EN 18286 complements other standards and technical specifications covering areas such as risk management, data governance, transparency, cybersecurity, accuracy and post-market monitoring (CEN-CENELEC on the publication of EN 18286). That is worth taking at face value: it is the quality management layer, not a whole governance system.

If you already run an ISO 42001 management system, you extend it to meet EN 18286. You do not start again. The standard's own introduction encourages building on an existing management system, and Annexes B and C set out how its clauses correspond to ISO 9001 and ISO/IEC 42001 (Intertek on EN 18286). That makes an honest view of where your ISO 42001 position stands today a sensible first step, and the ISO 42001 readiness check gives you one theme by theme.

None of this changes the position on certification. The EU AI Office determined in May 2024 that ISO 42001 is not fully aligned with the Act and is not part of its harmonisation process (Cloud Security Alliance research note on prEN 18286), so an ISO 42001 certificate remains useful evidence of good governance and not a route to compliance. The standard-versus-Act guide works through that in full.

What is coming, and what to do now

EN 18286 is the first standard published in support of the Act and, so far, the only one cited in the Official Journal. Further standards covering other obligations under it are in development at JTC 21, and each will carry a presumption for the requirements it covers once it is cited.

For most organisations there is still nothing urgent here. If you provide a high-risk AI system, or expect to, building your quality management system to EN 18286 is now the most direct way to show you meet Article 17, and the presumption is available before the duty applies. Under Regulation (EU) 2026/1744 the high-risk obligations apply from 2 December 2027 for the stand-alone systems listed in Annex III, and from 2 August 2028 for AI built into products covered by Annex I (Regulation (EU) 2026/1744, the Digital Omnibus on AI). The timeline sets out the rest.

If you are a deployer rather than a provider, this standard is not aimed at you, and the risk assessment guide covers which duties are. For a UK organisation, the presumption matters for systems placed on the market or put into service in the EU, which is when the Act reaches you at all; the UK applicability guide covers when that is. The EU AI Act check works out which role you hold for each system.