Does EN 18286:2026 give you presumption of conformity under the EU AI Act?
Written 6 September 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
No — not today. Article 40(1) grants presumption of conformity only to standards "the references of which have been published in the Official Journal of the European Union". EN 18286:2026 exists and is published by CEN-CENELEC. Its reference is not in the Official Journal on the sources we read.
Quick answer
- Presumption is a document, not a stamp. Article 40(1) attaches it to standards whose references have been published in the OJ under Regulation (EU) No 1025/2012 — publication by a standards body is a different act with a different effect.
- And it is bounded. Even for a cited standard, the presumption runs only "to the extent that those standards cover those requirements or obligations" (Article 40(1)). A cited standard is not a blanket.
- EN 18286:2026 is the quality management system standard, and the QMS duty is Article 17.
- Two public sources disagree about its status, and we name both below rather than pick one.
- Following it is still worth doing — and Article 17(1), point (e) says what to write down while no presumption exists.
What is a harmonised standard, and why is the presumption the whole value?
A standard is a technical document. A harmonised standard is one the Commission asked for under a standardisation request and whose reference has then been published in the Official Journal. Article 40(2) is the request side of that machinery: the Commission "shall issue, without undue delay, standardisation requests covering all requirements set out in Section 2 of this Chapter". Regulation (EU) 2026/1744 added a subparagraph to that same paragraph, asking the European standardisation organisations for deliverables that "facilitate the joint compliance and presumption of conformity" with Chapter III, Sections 2 and 3 and the Annex I legislation — one request covering both regimes rather than two.
The value sits in Article 40(1) and nowhere else. A high-risk system in conformity with a cited harmonised standard "shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter". Presumed. That word is the whole of it: it moves the burden. Without it, you are not non-compliant — you simply have to show your work by some other means, system by system.
Two limbs of Article 40(1) get dropped when this is summarised, and both change the answer:
1. The reference must be in the Official Journal. Not the standard — the reference to it, published by the Commission under Regulation (EU) No 1025/2012. 2. The presumption reaches only as far as the standard reaches. "To the extent that those standards cover those requirements or obligations." A standard covering the QMS does nothing for data governance.
What is EN 18286:2026, and which article does it serve?
CEN-CENELEC's own page, published 31 July 2026, states: "EN 18286: 2026 'Artificial intelligence - Quality management system for EU AI Act regulatory purposes', has been published." The same page ties it to Article 17.
Article 17 is the quality management system duty on providers of high-risk AI systems. It is not a document you write once: the system must be "documented in a systematic and orderly manner in the form of written policies, procedures and instructions" and must include at least the aspects the article lists — a compliance strategy, design control, development and quality assurance, test and validation procedures and their frequency, data management, the risk management system of Article 9, post-market monitoring, incident reporting under Article 73, communication with authorities, record-keeping, resource management and an accountability framework.
Article 17(2), as replaced by Regulation (EU) 2026/1744, makes implementation "proportionate to the size of the provider's organisation, in particular, if the provider is an SME, including a start-up, or an SMC". Proportionate implementation, not fewer aspects.
The duty is not yet live. Article 17 sits in Chapter III, Section 3, which applies from 2 December 2027 for systems high-risk under Annex III and 2 August 2028 for systems high-risk under Annex I (Article 113, third paragraph, point (c), as amended). The full timeline has the sequence.
It is published. Its reference is not in the Official Journal.
Two public sources say different things, and the difference is the point of this page:
| Source | Read | What it says |
|---|---|---|
| CEN-CENELEC's own page | published 31 July 2026 | EN 18286:2026 "has been published", tied to Article 17 |
| The Commission's standardisation page | last updated 3 August 2026 | describes it as a prEN in public enquiry since 30 October 2025, and states that no harmonised standard had been cited in the OJ as of 3 August 2026 |
We do not resolve that contradiction and we will not guess which page is stale. What follows from either reading is the same: no reference in the Official Journal means no Article 40(1) presumption today. If the Commission cites it tomorrow, the presumption arrives with the citation and not before.
What does that mean if you follow it today?
It means you are doing useful work that carries no legal shortcut, and the Regulation has a place for exactly that. Article 17(1), point (e) requires the quality management system to document the "technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements".
Read that as the drafting instruction it is. Following EN 18286 and recording that you follow it is not the end of the file; the file also has to say which requirements the standard does not reach and what you do about those. That paragraph is the one a notified body will read first, and writing it is not wasted work if the standard is later cited — the citation would turn part of it into a presumption, not delete it.
Nothing on this page says that following a standard makes you compliant. No standard can do that, and one whose reference is not in the Official Journal cannot even shift the burden.
What else is in the pipeline?
Four further drafts were in review when this page was written: prEN 18228 (risk management), prEN 18282 (cybersecurity), prEN 18229-1 (logging) and prEN 18288 (a computer-vision taxonomy). Their consultation closing dates are not in the reading this page rests on, so they are not stated here — an unmeasured date is worse than none.
Watch for one thing only: a reference published in the Official Journal. That is the event that changes an answer on this page.
What this means for you
If you are a provider of a high-risk AI system: Article 17 is yours, from 2 December 2027 or 2 August 2028 depending on which route makes the system high-risk. Buying and following EN 18286 is a reasonable way to build the system — and until its reference is cited, your file needs the Article 17(1), point (e) paragraph naming what the standard does not cover. Check first whether Article 17 reaches you at all: provider or deployer decides it, and Article 6(3) can take a system out of the high-risk tier entirely.
If you are a deployer: Article 17 is not your duty. It is worth asking a supplier which standards they apply and what their point (e) paragraph says, because that answer tells you more about their file than a certificate would. A deployer can become a provider by putting its name on a system or substantially modifying it, and Article 17 arrives with that role.
Where this page stops
We do not own EN 18286:2026, we have not pinned its text, and we do not quote it. Everything above quotes the Regulation — which we do pin — and describes CEN-CENELEC's and the Commission's own public pages with the dates they were read. The standard itself is sold by the national standards bodies; what it requires, in its own words, is not something this page can tell you.
FAQ
Is EN 18286:2026 a harmonised standard? It is a European standard published by CEN-CENELEC. "Harmonised" in the Article 40(1) sense requires the reference to be published in the Official Journal, and on the sources we read that has not happened. The word does real legal work and is not a synonym for "European".
If I certify to EN 18286, am I compliant with Article 17? No. Certification to a standard is evidence about your process; Article 17 is a duty owed to the Regulation. Without an OJ citation there is no presumption, so the burden of showing that the quality management system meets Article 17 stays with you, aspect by aspect.
Does the presumption apply to the whole Regulation once a standard is cited? No. Article 40(1) limits it to the requirements in Section 2 of Chapter III, or the Chapter V obligations where applicable, and only "to the extent that those standards cover those requirements or obligations". Coverage is read standard by standard.
When does Article 17 actually bite? 2 December 2027 for systems high-risk under Annex III, 2 August 2028 for systems high-risk under Annex I, under Article 113, third paragraph, point (c) as amended by Regulation (EU) 2026/1744. The quality management system has to exist before the system is placed on the market, not on the deadline.
Which of your systems carry Article 17 at all?
a short set of questions, more if your answers open follow-ups, no account, and the classification runs in your browser: answers stay there unless you choose to keep the result.