Appearance
EU AI Act Harmonized Standards
The EU AI Act regulates AI systems through the product-safety machinery of the New Legislative Framework, and like other NLF acts it leaves the technical detail of compliance to harmonized standards: European standards developed by CEN and CENELEC on a mandate from the European Commission. For the AI Act, that mandate is standardization request M/613, and the drafting body is the joint technical committee CEN/CLC/JTC 21 (Artificial Intelligence).
Under Article 40(1) of the AI Act, a high-risk AI system or a general-purpose AI model that conforms to harmonized standards cited in the Official Journal of the European Union is presumed to conform with the requirements and obligations those standards cover, to the extent of that coverage. Presumption of conformity is an evidentiary effect, not a substitute for legal analysis: for the provisions a standard's Annex ZA lists, conformance with the standard counts as conformity with the corresponding legal requirement, within the limits of the standard's scope and subject to any conditions the Annex ZA row states. It is not blanket clearance; the obligation-by-obligation compliance work remains the provider's own.
How presumption of conformity attaches
A standard confers presumption only at the end of a fixed sequence:
- Drafting — JTC 21 develops the standard under the M/613 request, through enquiry (prEN) and formal-vote (FprEN) stages.
- Approval — CEN/CENELEC ratifies the final text as a European Standard (EN). The content is now stable, but no presumption attaches yet.
- OJ citation — the Commission assesses the standard against the request and cites it in the Official Journal. Presumption attaches from citation, and only for as long as the citation is maintained.
Two limits matter in practice. First, presumption is scoped by the standard's Annex ZA: an informative annex in each harmonized standard that lists, row by row, which provisions of the Regulation the standard covers and under which conditions. Provisions without a row get no presumption. Second, harmonized standards are voluntary: providers can instead comply with common specifications under Article 41, or demonstrate compliance with the legal requirements directly.
Status of the JTC 21 standards
| Standard | Subject | Status (July 2026) |
|---|---|---|
| EN 18286:2026 | Quality management system for EU AI Act regulatory purposes (Article 17) | Approved 12 July 2026. OJ citation pending; no presumption of conformity yet |
| prEN 18228 | AI risk management | Draft |
| prEN 18282 | Cybersecurity for AI systems | Draft |
| prEN 18284 | Quality and governance of datasets in AI | Draft |
| prEN 18229 (parts 1–2) | AI trustworthiness framework (logging, transparency, human oversight) | Draft |
EN 18286 is the first of the JTC 21 AI Act standards to reach final approval. The table lists the work items most relevant to high-risk providers, with statuses as of July 2026; the full JTC 21 program is broader. For the live state of the program and an interactive mapping of what each standard intends to cover, see Adam Leon Smith's EU AI Act harmonised standards map, an independent tracker built from the draft standards and the published CEN/CENELEC project scopes.
What this means for a compliance program
- The EN 18286 text is stable now. Approval fixes the content; only the citation step is outstanding. Aligning a quality management system to it today is building against the final text, not a moving draft.
- Track the OJ, not the standard. Presumption of conformity attaches once EN 18286:2026 is cited in the Official Journal of the European Union, and it lapses if the citation is withdrawn. The citation list, not the standard's publication status, is what a conformity assessment should reference.
- Presumption is partial by design. Some Annex ZA rows carry conditions, and some provisions are expressly not covered. Read the Annex ZA coverage of each standard before relying on it; for EN 18286, see the coverage section of the guide.
Related pages
EN 18286 QMS
The approved quality management system standard, its Annex ZA coverage, and the Modulos templates
Conformity assessment and CE marking
Where harmonized standards enter the Annex VI / Annex VII routes
EU AI Act overview
The Regulation the standards implement
Disclaimer
This page is for general informational purposes and does not constitute legal advice.