EU AI Act Harmonized Standards

The EU AI Act, Regulation (EU) 2024/1689, gives a presumption of conformity to high-risk AI systems and general-purpose AI models that conform to harmonized standards. Article 40(1) gives this effect only to a harmonized standard that has its reference in the Official Journal of the European Union. The European Commission page "Standardisation of the AI Act" gives this information: standards "translate legal requirements into common technical language, simplifying compliance for companies and other stakeholders". The use of a harmonized standard is voluntary.

Article 3(27) of the Act refers to Regulation (EU) No 1025/2012 for "harmonised standard".

Article 40(2) tells the Commission to make standardization requests for all the requirements of Chapter III Section 2. As applicable, it also tells the Commission to make standardization requests for the obligations of Chapter V Sections 2 and 3.

For high-risk AI systems, the standardization request is Commission Implementing Decision C(2025) 3871 of 23 June 2025. The decision applies only to CEN and CENELEC (Article 6 of the decision). Article 5 of the decision gives its end date: "This Decision shall expire on 28 February 2027." Annex ZA of EN 18286 identifies this standardization request as M/613.

CEN and CENELEC are European standardization organizations. They prepare these standards together in the committee CEN/CLC/JTC 21.

How presumption of conformity attaches

Article 40(1) of the EU AI Act gives the presumption of conformity for harmonized standards:

High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter or, as applicable, with the obligations set out in of Chapter V, Sections 2 and 3, of this Regulation, to the extent that those standards cover those requirements or obligations.

The legal condition is the publication of the reference of the standard in the Official Journal. A standard that has its reference in the Official Journal is cited in the Official Journal. The presumption applies only "to the extent that those standards cover those requirements or obligations". The presumption of conformity is not a certification. It is also not the result of a conformity assessment in Article 43.

The provisions that Article 40(1) names and the provisions that a standard is for are not always the same. Article 40(1) names Chapter III Section 2. It does not name Chapter III Section 3. Compare these points:

• Article 11 (technical documentation) is in Section 2.
• Article 17 (quality management system) is in Chapter III Section 3.
• Regulation (EU) 2026/1744 added a last subparagraph to Article 40(2). It tells the Commission to send a standardization request for "standardisation deliverables, including, as appropriate, harmonised standards, to facilitate the joint compliance and presumption of conformity with the requirements or obligations set out in Chapter III, Sections 2 and 3 of this Regulation".
• For EN 18286, Annex ZA gives the requirements of the Act that the standard is for. Table ZA.1 gives clauses for the first sentence of Article 11(1), which is in Chapter III Section 2. It also gives clauses for Article 17(1), which is in Chapter III Section 3. Annex ZA gives this information: from the citation of the standard, compliance with the Table ZA.1 normative clauses gives a presumption of conformity for the related requirements, in the scope of the standard. The reference of EN 18286:2026 is in Implementing Decision (EU) 2026/2274, in the Official Journal of 14 October 2026.

The Commission page "Standardisation of the AI Act" gives the steps to the Official Journal. First, CEN and CENELEC publish the harmonized standard. Then "the Commission assesses whether they meet the intended objectives and legal requirements of the AI Act". After this step, the reference of the standard is published in the Official Journal.

Article 41(4) refers to a harmonized standard that a European standardization organization adopted and that is "proposed to the Commission for the publication of its reference in the Official Journal of the European Union". For this standard, the Commission "shall assess the harmonised standard in accordance with Regulation (EU) No 1025/2012". The Commission, not CEN or CENELEC, publishes the reference.

The approval of a standard by CEN does not make sure that its reference is published, or how it is published. Article 43(1), subparagraph 2, point (d), refers to a harmonized standard that "has been published with a restriction". The reference of EN 18286:2026 is published without a restriction (see Annex ZA and presumption).

Article 41(1)(a) also refers to harmonized standards that "insufficiently address fundamental rights concerns" and to harmonized standards that "do not comply with the request".

Alternatives to harmonized standards

The European Commission page "Standardisation of the AI Act" tells providers: "The application of standards remains voluntary. Providers can choose any other framework to demonstrate their compliance with the AI Act."

Article 41(1) of the EU AI Act lets the Commission adopt implementing acts with common specifications. The Commission "may adopt" these implementing acts only when all of these conditions are fulfilled:

• The Commission sent a standardization request to one or more European standardization organizations (point (a)). The standardization request is for a harmonized standard. This standard is for the requirements of Chapter III Section 2 or, as applicable, the obligations of Chapter V Sections 2 and 3.
• One of these four conditions applies to that standardization request (point (a)):
  • No organization accepted the standardization request.
  • The harmonized standards are "not delivered within the deadline".
  • The harmonized standards "insufficiently address fundamental rights concerns".
  • The harmonized standards "do not comply with the request".
• No reference to a harmonized standard for these requirements or obligations is published in the Official Journal, and no such reference "is expected to be published within a reasonable period" (point (b)).

Article 41(5) applies to providers that do not comply with the common specifications. These providers "shall duly justify that they have adopted technical solutions that meet the requirements referred to in Section 2 of this Chapter or, as applicable, comply with the obligations set out in Sections 2 and 3 of Chapter V to a level at least equivalent thereto".

Article 43(1) is about high-risk AI systems in point 1 of Annex III. Subparagraph 2 gives the conditions in which the provider must follow the Annex VII procedure, with a notified body. One condition is that the provider did not apply the harmonized standard, or applied only part of it. See Conformity assessment and CE marking.

Standards that JTC 21 prepares for the EU AI Act

The CEN-CENELEC page on artificial intelligence names four "key standards under development" of CEN/CLC/JTC 21 for the EU AI Act. It also gives this information:

These standards will be supplemented by a number of more specific standards which address specific sections of the standardization request. This includes standards on datasets, bias, computer vision, cybersecurity, robustness, logging and natural language processing.

The EN numbers of the other work items come from the Bibliography of EN 18286.

Work item on the CEN-CENELEC page	EN number	Position and its source
"AI Quality Management System"	EN 18286:2026, "Artificial intelligence — Quality management system for EU AI Act regulatory purposes"	CEN approved it on 12 July 2026. On 31 July 2026, CEN-CENELEC news gave this information: the standard "has been published". The Commission published its reference in the Official Journal on 14 October 2026.
"AI Risk Management"	EN 18228, AI Risk Management	"Under preparation" when EN 18286 was published (July 2026)
"AI Trustworthiness Framework"	EN 18229-1, AI trustworthiness framework — Part 1: Logging, and EN 18229-2, AI trustworthiness framework — Part 2: Accuracy and robustness	"Under preparation" when EN 18286 was published (July 2026)
"AI Conformity Assessment"	No number in the EN 18286 Bibliography	"under development" (CEN-CENELEC page)
One of the "more specific standards", on datasets	EN 18284, Artificial Intelligence — Quality and governance of datasets in AI	"Under preparation" when EN 18286 was published (July 2026)

The CEN-CENELEC page on artificial intelligence gives access to "The full work programme of JTC 21".

How to use a harmonized standard

For a provider of a high-risk AI system, Annex IV of the EU AI Act gives the contents of the technical documentation. Point 7 of Annex IV is about the standards that the provider applied:

A list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union; where no such harmonised standards have been applied, a detailed description of the solutions adopted to meet the requirements set out in Chapter III, Section 2, including a list of other relevant standards and technical specifications applied;

WARNING 1 in Annex ZA of EN 18286 gives this condition: the presumption from the citation of 14 October 2026 continues only while the Official Journal keeps a reference to the standard.

Table ZA.1 of EN 18286 marks Article 17(2), 17(3) and 17(4) "Not covered", and some other rows have conditions. Its row for the first sentence of Article 17(1) tells that the use of EN 18286 is not sufficient to make sure that all the requirements of the Act are fulfilled. See EN 18286 Annex ZA and presumption of conformity.

Related pages

EN 18286

The voluntary quality management system standard for the EU AI Act, its Annex ZA, and the Modulos Frameworks

Conformity assessment and CE marking

The conformity assessment procedures of Article 43, Annex VI and Annex VII

EU AI Act overview

The EU AI Act, Regulation (EU) 2024/1689

Sources of this page

• The EU AI Act, Regulation (EU) 2024/1689, consolidated version of 27 July 2026: EUR-Lex. Articles 3(27), 40(1), 40(2), 41(1), 41(4), 41(5) and 43(1), Chapter III Sections 2 and 3, and Annex IV point 7.
• The Digital Omnibus on AI, Regulation (EU) 2026/1744: EUR-Lex. The last subparagraph of Article 40(2) of the EU AI Act.
• The Commission Implementing Decision C(2025) 3871 of 23 June 2025, the standardization request to CEN and CENELEC for high-risk AI systems: C(2025) 3871. Articles 5 and 6.
• The Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, in the Official Journal of 14 October 2026 (OJ L, 2026/2274): EUR-Lex. Article 1 and the Annex.
• The European Commission page "Standardisation of the AI Act" (“Last update” 3 August 2026).
• The CEN-CENELEC page "Artificial Intelligence" on JTC 21: CEN-CENELEC.
• The CEN-CENELEC news "EN 18286 in the Spotlight: Supporting Compliance with the AI Act" of 31 July 2026: CEN-CENELEC.
• EN 18286:2026 (European Standard of July 2026): the front page (approval by CEN on 12 July 2026), Annex ZA and the Bibliography.

Disclaimer

This page gives general information and is not legal advice.