Docs

Appearance

EN 18286 Quality Management System for EU AI Act ​

EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, is a voluntary European Standard. CEN/CLC/JTC 21 prepared it, and CEN approved it on 12 July 2026. The standard gives requirements for a quality management system (QMS) of providers of AI systems. The primary group for the standard is the providers of high-risk AI systems that are placed on the market or put into service. The standard is for AI systems in all areas (Clause 1).

In EN 18286, quality is regulatory compliance with the EU AI Act as a minimum. It is also compliance with the law for the protection of fundamental rights, health and safety (3.1.23 and 3.1.26). EN 18286 is one voluntary method to conform to requirements of the AI Act. It is not the quality management system that Article 17 of the Act makes necessary for providers of high-risk AI systems. Annex ZA connects the standard only to Article 17(1) and to the first sentence of Article 11(1). Use of the standard is not sufficient to make sure that all the requirements of the Act are fulfilled.

Modulos gives the standard as 2 Frameworks, OFF-19 and MFF-19. The page Operationalizing in Modulos gives the set-up.

Status

A CEN-CENELEC page of 31 July 2026 gives this information: EN 18286:2026 “has been published”. In Article 40(1) of the EU AI Act, conformity with a harmonized standard gives a presumption of conformity only when the reference of the standard is published in the Official Journal.

By Implementing Decision (EU) 2026/2274, the Commission published the reference of EN 18286:2026 in the Official Journal on 14 October 2026. Recital (6) of the decision gives this information: compliance with a harmonized standard gives a presumption of conformity “from the date of publication of the reference of such standard in the Official Journal of the European Union”. For EN 18286, the presumption applies only to the provisions in Table ZA.1 of Annex ZA, on the conditions of each row (see Annex ZA and the EU AI Act). See the page Harmonized standards.

Key facts
Standards body
CEN and CENELEC, joint technical committee CEN/CLC/JTC 21
Instrument
Voluntary European Standard, prepared under standardization request M/613 (Annex ZA)
Approved
12 July 2026, by CEN (the EN is dated July 2026)
Published
Reported as published by CEN-CENELEC on 31 July 2026
National adoption
At the latest by January 2027
Official Journal
Reference published on 14 October 2026; presumption of conformity from that date, for the Annex ZA provisions
Annex ZA
Aims to cover Article 17(1) and the first sentence of Article 11(1); Article 17(2) to 17(4) not covered
Structure
Clauses 4–10; informative Annexes A, B (EN ISO 9001:2015), C (EN ISO/IEC 42001:2026) and ZA
Modulos Frameworks
OFF-19 (Organization level) and MFF-19 (AI System level)

Who the standard is for ​

EN 18286 is for providers of AI systems. Clause 0.1 tells providers of all types and locations, small or large, that they can use the standard. In clause 0.1, the standard adapts its requirements and guidance to help providers in the EU. It also adapts them to help providers that are not in the EU but are active in the EU market or want to be. One quality management system can include one or more AI systems. In the standard, a provider is a provider of high-risk AI systems, not of general-purpose AI models (3.2.5, Note 2).

  • Providers of high-risk AI systems — these providers are the primary group for the standard (Clause 1). Article 17(1) of the EU AI Act tells these providers that they “shall put a quality management system in place that ensures compliance with this Regulation”. Article 17 is in Section 3 of Chapter III. Article 113, point (c), with the changes of Regulation (EU) 2026/1744, gives the dates for Sections 1 to 3 of Chapter III:

    • From 2 December 2027 for high-risk AI systems in Article 6(2) and Annex III.
    • From 2 August 2028 for high-risk AI systems in Article 6(1) and Annex I.

    EN 18286 is one voluntary method to conform to requirements of the EU AI Act. Annex ZA connects it to Article 17(1) and marks Article 17(2) to 17(4) as not covered. See Article 17 on the page High-risk AI systems.

  • Providers with a sectoral quality management system — Article 17(3) applies to a provider with quality management system obligations, or an equivalent function, in “relevant sectoral Union law”. It lets this provider put the Article 17(1) “aspects” into that system. The condition is the sectoral Union law, not a standard. Clause 0.1 of EN 18286 tells providers that they can extend a sectoral quality management system, and not use a different system. Its example is EN ISO 13485 for medical devices. Table ZA.1 marks Article 17(3) as not covered.

  • Financial institutions — Article 17(4) has a different rule for providers that are financial institutions. It applies when Union financial services law gives requirements for their internal governance. For these providers, the obligation to have a quality management system “shall be deemed to be fulfilled” when they comply with the internal-governance rules of that law. This rule does not apply to points (g), (h) and (i) of Article 17(1). Article 17(4) adds: “To that end, any harmonised standards referred to in Article 40 shall be taken into account.” Table ZA.1 marks Article 17(4) as not covered.

  • Deployers and users — EN 18286 is not for deployers as such. But in some conditions, a distributor, importer, deployer or other third party can be a provider (3.2.5, Note 1). Article 25(1) of the EU AI Act makes the third party the provider of a high-risk AI system in one of these conditions:

    • It puts its name or trademark on a high-risk AI system that was placed on the market or put into service before, “without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated”.
    • It makes a substantial modification to such a high-risk AI system, and the system stays high-risk.
    • It changes the intended purpose of an AI system “which has not been classified as high-risk and has already been placed on the market or put into service”, and the system becomes high-risk. This AI system can be “a general-purpose AI system”.

    A “user” (3.3.5) is not a deployer. In EN 18286, a user is a person who has interaction with a deployed AI system. See Article 25 on the page Roles and responsibilities.

Structure of the standard ​

EN 18286 has one quality management system. Clauses 4 to 10 hold its requirements, and Annexes A, B, C and ZA are informative.

Above, the 4 groups of EN 18286 clauses are clauses 4 to 7, clause 8, clause 9, and clause 10. Some items in the groups show the Modulos Framework that holds them, and clause 9 has parts in the 2 Frameworks (see EN 18286 in Modulos). These groups are not a part of the standard. Annex ZA connects clauses from all groups to Article 17(1) and to the first sentence of Article 11(1).

The page Harmonized standards gives the Article 40(1) mechanism of the EU AI Act with its limits. The section Annex ZA and the EU AI Act gives the Annex ZA condition for a presumption of conformity from compliance with the clauses that Table ZA.1 shows.

Clause 0.2 sets the verbal forms. With “shall”, the standard gives a requirement. With “should”, it recommends. With “may”, it lets the provider do something. With “can”, it tells that something is possible.

Part of EN 18286ItemsPage
Clauses 1 to 3Scope, Normative references (none), and Clause 3 in 4 parts: 3.1 management systems, 3.2 the EU AI Act, 3.3 AI systems, 3.4 risk managementThis page
4 Quality management systemThe QMS, the applicable regulatory requirements, the scope of the QMS, the strategy for regulatory compliance, and documented informationThe QMS clauses
5 LeadershipTop management, the quality policy, and roles, responsibilities and authoritiesThe QMS clauses
6 PlanningRisks to the operation of the QMS, and quality objectivesThe QMS clauses
7 SupportResources, competence, communication, and awarenessThe QMS clauses
8 AI system realizationLife cycle processes, risk management, inception, design and development, verification and validation, data management, retirement, identification, continuous learning, and product documentationLifecycle and operations
9 Operations and control (9.1 to 9.5)Placing on the market and putting into service, support services, supply chain, modifications, and post-market monitoringLifecycle and operations
9 Operations and control (9.6 and 9.7)Reporting serious incidents, and non-complianceIncidents and non-compliance
10 Performance evaluationManagement review, and planning of changesThe QMS clauses
Annex AConsultation of interested parties about risks to fundamental rights, health and safetyNone
Annexes B and CClause correspondence with EN ISO 9001:2015 and EN ISO/IEC 42001:2026This page
Annex ZARelation between the standard and Regulation (EU) 2024/1689Annex ZA and presumption

The life cycle processes are part of the one quality management system of EN 18286 (4.1 and 8.1.1). The Table ZA.1 row for the first sentence of Article 17(1) shows clauses 5 and 6, and parts of clauses 4 and 10: 4.1 to 4.3, 4.4.1, 4.4.3, 10.1.1.1, 10.1.3 and 10.2. It also shows 8.1.1, 8.1.4, 8.1.5, 8.3.1.1 and 9.7. Modulos divides the clauses between an Organization level and an AI System level (see EN 18286 in Modulos). The 2 levels are the Modulos structure and not a part of the standard.

Table ZA.1 shows clauses from all clause groups, but not all clauses. For example, 8.6 and 9.2 have no row. EN 18286 has no clause on continual improvement. Improvement comes from different clauses, for example management review (10.1) and planning of changes (10.2). See Clause 10 on the page The QMS clauses.

Annex ZA and the EU AI Act ​

Annex ZA of EN 18286 is informative. Annex ZA identifies the standardization request for the standard as M/613 C(2025)3871. Table ZA.1 in Annex ZA shows clauses of the standard against Article 17(1) of the EU AI Act, with its points (a) to (m). It also shows clauses against the first sentence of Article 11(1). The table marks Article 17(2), 17(3) and 17(4) as not covered, and 4 rows have conditions. Table ZA.1 has no row for Article 9, 72 or 73 as such.

In Annex ZA, compliance with the clauses that Table ZA.1 shows gives a presumption of conformity for the related requirements, only in the scope of the standard. The presumption applies from the citation of 14 October 2026, and it continues only while the Official Journal keeps the reference (Annex ZA, WARNING 1). The page Annex ZA and presumption gives each row of Table ZA.1 with its clauses and conditions.

EN 18286, ISO 9001 and ISO/IEC 42001 ​

EN 18286 gives the correspondence of its clauses with 2 other management system standards. Annex B gives the correspondence with EN ISO 9001:2015, and Annex C with EN ISO/IEC 42001:2026. ISO published a new version, ISO 9001:2026, on 16 September 2026, but Annex B is for the 2015 version. The 2 annexes give the correspondence of clauses and subclauses only, not of requirements or “concepts”. Thus, they help to find related clauses, but they do not make the standards equivalent. Quality in EN 18286 is regulatory compliance, and it is different from quality in EN ISO 9001 (3.1.23, Note 2).

ISO/IEC 42001:2023 gives requirements for an AI management system in all organizations that supply or use AI systems. EN 18286 gives requirements for a quality management system of providers of AI systems, for the regulatory purposes of the EU AI Act. The 2 standards use different names for the condition when a requirement is not fulfilled:

  • EN 18286 uses “non-compliance” (3.1.15) when an applicable regulatory requirement is not fulfilled.
  • ISO/IEC 42001 uses “nonconformity” (3.16) when a requirement (3.14) is not fulfilled. Here, a requirement is not only a regulatory requirement.

ISO/IEC 42001 has a clause on continual improvement (10.1), and EN 18286 has no such clause. Only EN 18286 has an Annex ZA for the EU AI Act. In Modulos, EN 18286 and ISO/IEC 42001 are different Frameworks. The page Control overlap shows the Controls that are in the 2 Frameworks, and the page ISO/IEC 42001 and the EU AI Act compares ISO/IEC 42001 with the EU AI Act and EN 18286.

EN 18286 in Modulos ​

Modulos gives EN 18286 as 2 Frameworks. OFF-19 at the Organization level holds clauses 4 to 7 and 9.6 to 10. MFF-19 at the AI System level holds clause 8 and clauses 9.1 to 9.5. The page Operationalizing in Modulos gives the set-up and a Requirement table for each Framework. It also gives the Role tag on the Requirements and the work that is not in the Frameworks.

Annex ZA and presumption

Table ZA.1 row by row, with the conditions and the rows that are not covered

The QMS clauses

Clauses 4–7 and 10: Quality management system, Leadership, Planning, Support, and Performance evaluation

Lifecycle and operations

Clause 8 and clauses 9.1–9.5: the requirements of the standard for each AI system

Incidents and non-compliance

Clauses 9.6 and 9.7, and Articles 20 and 73 of the EU AI Act

Operationalizing in Modulos

OFF-19 and MFF-19: the Requirement table of each Framework and the steps to set up the standard in Modulos

ISO/IEC 42001 and the EU AI Act

ISO/IEC 42001 compared with the EU AI Act and EN 18286

Frequently asked questions about EN 18286 ​

The page Frequently asked questions about EN 18286 gives short information about the standard, presumption of conformity, Annex ZA, and Modulos.

Sources of this page ​

  • EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, version of July 2026, approved by CEN on 12 July 2026. This page uses the approval date on the first page, the European foreword, 0.1, 0.2, Clause 1, and 3.1.15, 3.1.23, 3.1.26, 3.2.5 and 3.3.5. It also uses the names of the clauses, Annexes B and C, and Annex ZA with Table ZA.1.
  • CEN-CENELEC, page of 31 July 2026 about EN 18286: CEN-CENELEC.
  • The Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, which publishes the reference of EN 18286:2026 in the Official Journal of 14 October 2026: EUR-Lex. Article 1, recital (6), and the Annex.
  • EU AI Act, Regulation (EU) 2024/1689, version of 27 July 2026 with the changes of Regulation (EU) 2026/1744: EUR-Lex. Articles 11(1), 17, 25(1), 40(1), and 113 (point (c)).
  • ISO/IEC 42001:2023, Clause 1, 3.14, 3.16 and 10.1, to compare the 2 standards: ISO.
  • ISO, page of 16 September 2026 about the publication of ISO 9001:2026: ISO.

Disclaimer

This page gives general information and is not legal advice.