Appearance
EN 18286 Annex ZA: Table ZA.1 and presumption of conformity
Annex ZA of EN 18286:2026 shows the relation between the standard and the EU AI Act, Regulation (EU) 2024/1689. Annex ZA is informative. It names the requirements of the Regulation "aimed to be covered" by EN 18286. Annex ZA gives this information:
- EN 18286 was prepared for the standardization request M/613, C(2025) 3871, of the Commission.
- EN 18286 is one voluntary method to conform to requirements of the Regulation.
- From the citation of EN 18286 in the Official Journal, conformity with the clauses in Table ZA.1 gives a presumption of conformity. The presumption is for the related requirements of the Regulation and of the related EFTA regulations. It applies only in the scope of EN 18286.
Table ZA.1 is a correspondence between EN 18286 and the Regulation. Each row gives a provision of the Regulation and the clauses of EN 18286 for that provision. Some rows have a remark. Three rows have the mark "Not covered".
Article 40(1) of the AI Act names the requirements of Chapter III, Section 2, where Article 11 is. Article 17 is in Chapter III, Section 3, and Annex ZA shows the relation between the standard and Article 17(1). The page Harmonized standards gives the Article 40 mechanism, with its limit "to the extent that those standards cover those requirements or obligations", and the last subparagraph of Article 40(2).
Official Journal
The Commission published the reference of EN 18286:2026 by Implementing Decision (EU) 2026/2274, in the Official Journal of 14 October 2026. The Annex of the decision gives the reference without a restriction. The presumption of conformity applies from that date, only for the provisions in Table ZA.1 and on the conditions of each row. It continues only while the Official Journal keeps the reference. See WARNING 1 and WARNING 2 of Annex ZA. The page EN 18286 gives the dates of the standard.
Table ZA.1, row by row
Table ZA.1 of EN 18286 has 19 rows. The table on this page gives the rows in the sequence of Table ZA.1. For each row, it gives the text of the provision of the AI Act, the clauses of EN 18286, and the remark of Table ZA.1. In the AI Act, "SME" is a "micro, small or medium-sized enterprise as defined in Article 2 of the Annex to Recommendation 2003/361/EC" (Article 3, point (14a)). "SMC" is a "small mid-cap enterprise as defined in point (2) of the Annex to Recommendation (EU) 2025/1099" (Article 3, point (14b)).
| Provision of the AI Act | Text of the provision | EN 18286 clauses | Remark in Table ZA.1 |
|---|---|---|---|
| Article 11(1), first sentence | "The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date." | 8.9.2 | Covered on the condition that the technical documentation contains all the items of Annex IV of the Regulation. |
| Article 17(1), first sentence | "Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation." | 8.1.1, 8.1.4, 8.1.5, 4.1, 4.2, 4.3, 4.4.1, 4.4.3, 5, 6, 8.3.1.1, 9.7, 10.1.1.1, 10.1.3, 10.2 | When applied, EN 18286 does not as such make sure that all regulatory requirements of the Regulation are fulfilled. It is necessary to examine, apply and verify the legal requirements one at a time. Each solution that is adopted becomes a part of the quality management system (QMS) in the sense of the AI Act. |
| Article 17(1), second sentence, first part | "That system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions" | 4.1, 4.2, 4.5, 5.2, 6, 8.3.1.1, 10.1.1.1, 10.1.3, 10.2 | Covered on the condition that, as a minimum, points (a) to (m) of Article 17(1) are documented. |
| Article 17(1)(a) | "a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system" | 4.4.1, 9.4, 8.3.1.1, 8.8 | No remark. |
| Article 17(1)(b) | "techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system" | 8.1.1, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.3.2, 8.4.2 | No remark. |
| Article 17(1)(c) | "techniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system" | 4.1, 4.2, 4.3, 4.4.1, 4.4.3, 4.5, 5, 6, 8.1.1, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.3.2.2, 8.3.2.4, 8.4.2, 8.4.3.1, 8.5, 9.3.5, 9.7.1, 9.7.2.1, 9.7.3, 10.1.1.1, 10.1.3, 10.2 | No remark. |
| Article 17(1)(d) | "examination, test and validation procedures to be carried out before, during and after the development of the high-risk AI system, and the frequency with which they have to be carried out" | 8.1.1, 8.1.3, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.4.3.1 | No remark. |
| Article 17(1)(e) | "technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used to ensure that the high-risk AI system complies with those requirements" | 4.4.3 | No remark. |
| Article 17(1)(f) | "systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purpose of the placing on the market or the putting into service of high-risk AI systems" | 8.5 | No remark. |
| Article 17(1)(g) | "the risk management system referred to in Article 9" | 8.2 | On the condition that the risk management system that is used complies with Article 9. |
| Article 17(1)(h) | "the setting-up, implementation and maintenance of a post-market monitoring system, in accordance with Article 72" | 9.1, 9.5 | No remark. |
| Article 17(1)(i) | "procedures related to the reporting of a serious incident in accordance with Article 73" | 9.6.1, 9.6.2.1 | No remark. |
| Article 17(1)(j) | "the handling of communication with national competent authorities, other relevant authorities, including those providing or supporting the access to data, notified bodies, other operators, customers or other interested parties" | 7.3, 9.7.2.2 | No remark. |
| Article 17(1)(k) | "systems and procedures for record-keeping of all relevant documentation and information" | 4.5, 8.7, 8.9.2, 8.9.3, 9.1, 9.5.3 | No remark. |
| Article 17(1)(l) | "resource management, including security-of-supply related measures" | 7.1, 7.2, 9.3 | No remark. |
| Article 17(1)(m) | "an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listed in this paragraph" | 5.1, 5.3, 7.4 | No remark. |
| Article 17(2) | "The implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the provider's organisation, in particular, if the provider is an SME, including a start-up, or an SMC. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation." | No clause | Not covered. EN 18286 does not as such make sure that the implementation of points (a) to (m) of Article 17(1) is "proportionate". |
| Article 17(3) | Providers of high-risk AI systems with quality management system obligations, or an equivalent function, in “relevant sectoral Union law” can put the Article 17(1) “aspects” into the quality management systems of that law. See Who the standard is for. | No clause | Not covered. |
| Article 17(4) | Article 17(4) is for providers that are financial institutions "subject to requirements regarding their internal governance, arrangements or processes under Union financial services law". For them, the obligation to have a QMS, "with the exception of paragraph 1, points (g), (h) and (i)", is "deemed to be fulfilled" when they comply with the "rules on internal governance arrangements or processes" of that law. "To that end, any harmonised standards referred to in Article 40 shall be taken into account." | No clause | Not covered. |
Three points help to read Table ZA.1:
- Table ZA.1 divides Article 17(1) into rows. The first sentence of Article 17(1) is the obligation to have a QMS. The first part of the second sentence requires that the QMS is documented "in a systematic and orderly manner in the form of written policies, procedures and instructions". The remaining part of the second sentence requires that the QMS includes "at least the following aspects", which are points (a) to (m). Each point has a row.
- Table ZA.1 gives all of clause 5 and all of clause 6 on some rows. Clause 5 is on the row for the first sentence and on point (c). Clause 6 is on the row for the first sentence, on the row for the first part of the second sentence, and on point (c). Other rows give only subclauses of clause 5: 5.2 on the row for the first part of the second sentence, and 5.1 and 5.3 on point (m).
- Table ZA.1 gives clause 8.2, the risk management system for each AI system, for points (b), (c), (d) and (g). Only the row for point (g) has the condition about Article 9.
Clauses and provisions with no row in Table ZA.1
Table ZA.1 of EN 18286 has no row for Article 9, Article 72 or Article 73 of the AI Act as such. Table ZA.1 gives clauses for the points of Article 17(1) that refer to these articles:
- Point (g), "the risk management system referred to in Article 9": clause 8.2, with the condition about Article 9.
- Point (h), post-market monitoring "in accordance with Article 72": clauses 9.1 and 9.5. Clause 9.5.3 is also on point (k).
- Point (i), serious-incident procedures "in accordance with Article 73": clauses 9.6.1 and 9.6.2.1. Clause 9.6.2.2 has no row.
The obligations of Article 72 and Article 73 are on the EU AI Act page Post-market monitoring and serious incidents.
Table ZA.1 of EN 18286 has no row for 11 clauses, and Annex ZA does not refer to a presumption of conformity for them. Clause 0.2 of EN 18286 gives four verbal forms. "Shall" is for a requirement, and "should" is for a recommendation. "May" is for a permission, and "can" is for a possibility or a capability. The 11 clauses do not all use the same verbal form:
| Clause | Contents | Verbal form |
|---|---|---|
| 4.4.2 | Essential requirements | None (information only) |
| 8.1.2 | Life cycle stages of the processes and procedures | "can" |
| 8.3.1.2 | Consultation with affected persons | "should" (to "consider" consultation) |
| 8.4.1 | Verification and validation, general | None (information only) |
| 8.4.3.2 | Consultation with interested parties | "should" (to "consider" consultation) |
| 8.6 | Retirement | "should" for the retirement processes, and "shall" to inform the deployer of all retirement measures for the deployer |
| 8.9.1 | Product documentation, general | "shall" in one sentence about all of 8.9. The requirements are in 8.9.2 and 8.9.3, which have rows. |
| 9.2 | Support services | "should" |
| 9.6.2.2 | Contents of the serious-incident procedures | "should" |
| 10.1.1.2 | Internal reporting process | "can" for the process, and "should" for its functions |
| 10.1.2 | Management review input | "should" |
Table ZA.1 gives clauses from each of clauses 4 to 10, but not each subclause.
Article 11(1) of the AI Act, as amended by Regulation (EU) 2026/1744, has a second subparagraph. This subparagraph contains this sentence: "SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner." Table ZA.1 has a row only for the first sentence of Article 11(1). The condition of that row is that the technical documentation contains all the items of Annex IV. Annex ZA does not refer to the "simplified manner".
WARNING 1 and WARNING 2 of Annex ZA
Annex ZA of EN 18286 ends with WARNING 1 and WARNING 2:
- WARNING 1 — the presumption of conformity applies only while the Official Journal of the European Union continues to show a reference to EN 18286. Annex ZA recommends frequent checks of the Official Journal.
- WARNING 2 — other Union legislation can apply to the products in the scope of EN 18286.
Related pages
EN 18286 overview
The structure and dates of EN 18286, and its Frameworks in Modulos
Clauses 4–7 and 10
Clauses 4–7 and 10: Quality management system, Leadership, Planning, Support, and Performance evaluation. Table ZA.1 gives them for the first sentence of Article 17(1) and the first part of its second sentence. Table ZA.1 also gives them for points (a), (c), (e), (j), (k), (l) and (m).
Clause 8 and clauses 9.1–9.5
Clause 8, AI system realization, and clauses 9.1–9.5 of clause 9, Operations and control. Table ZA.1 gives them for the first sentence of Article 11(1). For Article 17(1), Table ZA.1 gives them for the first sentence and the first part of the second sentence. Table ZA.1 also gives them for points (a) to (d), (f) to (h), (k) and (l).
Clauses 9.6 and 9.7
These clauses are for serious incidents and non-compliance. Table ZA.1 gives them for the first sentence of Article 17(1) and for points (c), (i) and (j).
Conformity assessment and CE marking
Harmonized standards in the Annex VI and Annex VII procedures of Article 43
Sources of this page
- EN 18286:2026 (European Standard of July 2026). Provisions used: Annex ZA (Table ZA.1, WARNING 1 and WARNING 2), clause 0.2, and the other clauses on this page.
- Regulation (EU) 2024/1689 (AI Act), consolidated version of 27 July 2026: Articles 3(14a), 3(14b), 11(1), 17(1) to 17(4), 40(1) and 40(2), and Chapter III, Sections 2 and 3.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): the second subparagraph of Article 11(1), Article 17(2), and the last subparagraph of Article 40(2).
- The Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, in the Official Journal of 14 October 2026 (OJ L, 2026/2274): Article 1, recital (6), and the Annex.
Disclaimer
This page gives general information only. It is not legal advice.