EN 18286 and ISO/IEC 42001: which gives a presumption of conformity under the AI Act?

On 12 October 2026 the European Commission adopted Implementing Decision (EU) 2026/2274, which publishes in the Official Journal the reference of the European standard EN 18286:2026 “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”. The decision appeared in the Official Journal on 14 October 2026 and entered into force on the same day. In an announcement of 19 October 2026 the Commission described it as the first harmonised standard supporting the AI Act. The standard concerns the quality management system that providers of high-risk AI systems must maintain under AI Act Art. 17. This article examines what the presumption entails, how EN 18286 differs from the certifiable ISO/IEC 42001, and how buyers of high-risk AI can use it in contracts.

What is EN 18286, and from when does it give a presumption of conformity?

EN 18286:2026 was drafted by CEN and Cenelec in response to the Commission’s standardisation request C(2025) 3871 of 23 June 2025. It corresponds to point 9 of that request, on quality management systems for providers including post-market monitoring (recital 3), and according to recital 5 it satisfies the requirements it aims to cover. The reference is listed in the Annex without any restriction.

Under recital 6 the presumption applies from publication of the reference on 14 October 2026, which is why the decision entered into force that day (Article 2). The underlying obligations in Article 17 do not yet apply, however. Under AI Act Art. 113, as amended by Regulation (EU) 2026/1744, Chapter III, Sections 1 to 3, applies from 2 December 2027 to high-risk systems under Annex III and from 2 August 2028 to high-risk systems under Annex I.

What does AI Act Article 17 require of a quality management system?

Under AI Act Art. 17(1) providers of high-risk AI systems must put in place a quality management system that ensures compliance with the Regulation, documented in written policies, procedures and instructions. The system must cover at least thirteen aspects, among them a regulatory compliance strategy, procedures for design, testing and validation, data management, the risk management system under Article 9, post-market monitoring under Article 72 and an accountability framework for management and staff. The duty also follows from AI Act Art. 16(c).

Implementation is to be proportionate to the size of the provider without lowering the required level of protection (Article 17(2)). Providers subject to sectoral quality rules may integrate the aspects into those systems, and financial institutions largely satisfy the duty through their internal governance rules (Article 17(3) and (4)). Under AI Act Art. 63(1), as amended by the Omnibus Regulation, SMEs without partner or linked enterprises may comply with certain elements in a simplified manner under Commission guidelines.

How does the presumption of conformity under AI Act Article 40 work?

Under AI Act Art. 40(1) high-risk AI systems that conform to harmonised standards published in the Official Journal are presumed to conform to the corresponding requirements of the Regulation. The presumption is confined to what the standard in fact covers.

“to the extent that those standards cover those requirements or obligations”

The presumption is a rule of evidence, meaning that a provider applying the standard need not separately justify that its solution meets the requirements the standard covers. Non-compliance must then be established by the authority. The presumption also affects the choice of conformity assessment procedure. For high-risk biometric systems (Annex III, point 1), a provider that has applied harmonised standards may opt for internal control under Annex VI, whereas a provider that has not must use a notified body under Annex VII (AI Act Art. 43(1)).

The legal basis for the presumption is less clear-cut for Article 17 than for the technical requirements. The wording of Article 40(1) refers to the requirements in Chapter III, Section 2 (Articles 8 to 15), whereas Article 17 is located in Section 3. The Commission’s announcement nevertheless states that EN 18286 gives a presumption for Article 17, and the Omnibus Regulation has added to Article 40(2) that standardisation is to facilitate the presumption of conformity with the requirements in both Sections 2 and 3. In our assessment the presumption will be applied in practice, although the point has not been tested before the Court of Justice.

What is the difference between ISO/IEC 42001 and EN 18286?

ISO/IEC 42001:2023 is an international standard for artificial intelligence management systems, aimed at organisations that provide or use AI. In Norway it has been adopted as NS-EN ISO/IEC 42001:2026, published on 20 April 2026. The fact that the ISO standard has been given EN status does not make it a harmonised standard. Only a standard whose reference is published in the Official Journal has effect under Article 40, and as at 21 October 2026 that is EN 18286 alone.

According to the Commission, EN 18286 is built to sit on top of ISO/IEC 42001, ISO 9001 or sectoral standards such as ISO 13485, so that providers can extend an existing system rather than run several in parallel. A business already certified under ISO/IEC 42001 is thus well placed, although the certificate alone does not demonstrate compliance with Article 17.

What does the presumption not mean?

The presumption is rebuttable, and where the system is shown not to meet the requirements, the provider gains nothing from having followed the standard. A Member State or the European Parliament may also raise a formal objection to a harmonised standard under Regulation (EU) No 1025/2012, whereupon the Commission may restrict or withdraw the reference (Standardisation Regulation Art. 11).

Nor does the presumption extend to requirements the standard does not cover, and EN 18286 covers only the quality management system. It says nothing about accuracy, robustness and cybersecurity under Article 15, correct classification, or the deployer’s own obligations under Article 26. The provider must still carry out the conformity assessment, draw up the EU declaration of conformity under Article 47 and affix the CE marking under Article 48.

Do EN 18286 and the AI Act apply in Norway?

The AI Act has not been incorporated into the EEA Agreement. As at 21 October 2026 EEA-Lex lists both the Regulation and the Omnibus Regulation (EU) 2026/1744 as “under scrutiny” for incorporation. Implementing Decision (EU) 2026/2274 is marked as having EEA relevance, but it has no independent effect in Norway until the Regulation has been incorporated and implemented in Norwegian law.

Norwegian providers placing high-risk systems on the EU market must nevertheless comply from the dates applicable there. For Norwegian buyers, the standard already offers a verifiable benchmark of an adequate quality system at the provider, irrespective of when the Regulation becomes Norwegian law.

How can buyers of high-risk AI use EN 18286 in their contracts?

Buyers can use the standard as a contractual requirement and as a basis for audit. The aim is documentation that enables the buyer, as deployer, to use the system in accordance with the instructions for use and with adequate human oversight under AI Act Art. 26.

1. Require a quality management system conforming to EN 18286:2026 for the system concerned, with any departures described in writing.
2. Require a copy of the EU declaration of conformity and details of the conformity assessment procedure followed.
3. Agree a right to audit the quality system, directly or through an independent auditor, with access to procedures, test results and incident logs.
4. Require notice of substantial modifications, serious incidents and orders from supervisory authorities.
5. Treat ISO/IEC 42001 certification as an additional requirement, not as a substitute for compliance with Article 17.
6. Link breaches to specific remedies such as rectification, price reduction, termination and an indemnity against regulatory sanctions.

These requirements should be read together with the provider’s own usage terms, which already impose human oversight requirements for high-risk use, as discussed in the article on AI vendor terms for high-risk use. Buyers should also consider whether their own adaptations of the system could make them a provider under AI Act Art. 25(1), with a duty to maintain a quality management system of their own.

What should businesses do now?

Providers of AI systems that may be high-risk should obtain EN 18286:2026 from their national standardisation body and map the gap between their existing management system and the standard. Those already working to ISO/IEC 42001 or ISO 9001 should plan an extension of that system. The work must be completed before 2 December 2027 for Annex III systems, and before 2 August 2028 for Annex I systems, if the system is to be placed on the EU market.

Buyers should build the requirements above into new contracts and into renewals of existing contracts for high-risk AI, so that the provider undertakes to conform to the standard before the obligations apply. The board should be informed of which systems are affected and which requirements have been imposed, as discussed in the article on board responsibility for AI. Further material is available on the topic page on artificial intelligence. A contract that gives the buyer no right to audit the provider’s quality system leaves the buyer unable to verify that the basis for the presumption of conformity is in fact met.

Questions and answers

Next legal review: 1 March 2027