Appearance
EN 18286 Annex ZA: full coverage table and presumption of conformity
Annex ZA is the part of EN 18286:2026 that connects the standard to the EU AI Act. It is an informative annex, prepared under the Commission's standardization request M/613, and its Table ZA.1 lists, provision by provision, which requirements of Regulation (EU) 2024/1689 the standard's clauses correspond to. Citation in the Official Journal of the European Union is the switch: from that point, conformance with the clauses a row lists can be relied on as presumption for that row's AI Act provision, bounded by the standard's scope and by whatever qualification the row carries.
Status
Presumption of conformity attaches once EN 18286:2026 is cited in the Official Journal of the European Union. As of July 2026 the standard is approved but not yet cited; the table below describes what the citation will activate. See how presumption attaches.
Table ZA.1, row by row
The table below renders every row of Table ZA.1 with the AI Act provision, a plain-language label, the EN 18286 clauses listed against it, the row's condition where one is stated, and the Modulos Requirements that own or contribute to the row.
| AI Act provision | What it requires | EN 18286 clauses | Condition / note | Modulos Requirements |
|---|---|---|---|---|
| Article 11(1), first sentence | Technical documentation drawn up before the AI system is placed on the market or put into service and kept up to date | 8.9.2 | Covered provided the technical documentation contains all elements listed in Annex IV of the Regulation | MRF-388 |
| Article 17(1), first sentence | A quality management system ensuring compliance with the Regulation | 8.1.1, 8.1.4, 8.1.5, 4.1, 4.2, 4.3, 4.4.1, 4.4.3, 5, 6, 8.3.1.1, 9.7, 10.1.1.1, 10.1.3, 10.2 | Qualified: standard conformance alone does not fulfill the Regulation; each applicable legal requirement needs its own compliance determination, with the adopted measures folding into the QMS in the Regulation's sense | ORF-410–ORF-413, ORF-415–ORF-418, ORF-421, ORF-422, MRF-380, MRF-382 |
| Article 17(1), second sentence, first part | The system documented in a systematic and orderly manner as written policies, procedures and instructions | 4.1, 4.2, 4.5, 5.2, 6, 8.3.1.1, 10.1.1.1, 10.1.3, 10.2 | Covered provided that at least the aspects of Article 17(1)(a) to (m) are documented | ORF-410, ORF-411, ORF-414, ORF-416, ORF-418, ORF-422, MRF-382 |
| Article 17(1)(a) | Strategy for regulatory compliance, including conformity assessment procedures and management of modifications | 4.4.1, 9.4, 8.3.1.1, 8.8 | ORF-413 (strategy), MRF-385 (modifications, continuous learning), MRF-382 (inception) | |
| Article 17(1)(b) | Techniques, procedures and systematic actions for design, design control and design verification | 8.1.1, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.3.2, 8.4.2 | MRF-382 (owner), MRF-380, MRF-381, MRF-383 | |
| Article 17(1)(c) | Techniques, procedures and systematic actions for development, quality control and quality assurance | 4.1, 4.2, 4.3, 4.4.1, 4.4.3, 4.5, 5, 6, 8.1.1, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.3.2.2, 8.3.2.4, 8.4.2, 8.4.3.1, 8.5, 9.3.5, 9.7.1, 9.7.2.1, 9.7.3, 10.1.1.1, 10.1.3, 10.2 | ORF-410–ORF-418, ORF-421, ORF-422, MRF-380–MRF-384, MRF-386 | |
| Article 17(1)(d) | Examination, test and validation procedures before, during and after development, and their frequency | 8.1.1, 8.1.3, 8.1.4, 8.1.5, 8.2, 8.3.1.1, 8.4.3.1 | MRF-383 (owner), MRF-380–MRF-382 | |
| Article 17(1)(e) | Technical specifications and standards to be applied, and the means used where harmonized standards do not fully cover the requirements | 4.4.3 | ORF-413 | |
| Article 17(1)(f) | Systems and procedures for data management across acquisition, collection, analysis, labeling, storage, filtration, mining, aggregation and retention | 8.5 | MRF-384 | |
| Article 17(1)(g) | The Article 9 risk management system as part of the QMS | 8.2 | Subject to use of a risk management system compliant with Article 9 | MRF-381 |
| Article 17(1)(h) | Setting up, implementing and maintaining a post-market monitoring system | 9.1, 9.5 | MRF-387 (monitoring), MRF-448 (identification at market placement) | |
| Article 17(1)(i) | Procedures for reporting a serious incident in accordance with Article 73 | 9.6.1, 9.6.2.1 | ORF-420 | |
| Article 17(1)(j) | Handling of communication with authorities, notified bodies, other operators, customers and other interested parties | 7.3, 9.7.2.2 | ORF-419 (communication), ORF-421 (market-surveillance notification) | |
| Article 17(1)(k) | Systems and procedures for record-keeping of all relevant documentation and information | 4.5, 8.7, 8.9.2, 8.9.3, 9.1, 9.5.3 | MRF-388 (owner), ORF-414, MRF-448, MRF-387 | |
| Article 17(1)(l) | Resource management, including security-of-supply measures | 7.1, 7.2, 9.3 | ORF-419 (resources, competence), MRF-386 (supply chain) | |
| Article 17(1)(m) | An accountability framework setting out the responsibilities of management and other staff | 5.1, 5.3, 7.4 | ORF-415, ORF-417, ORF-419 | |
| Article 17(2) | Proportionality of implementing the (a)–(m) aspects to the size of the provider's organization | none | Not covered. The standard does not by itself ensure the proportionality of implementing the Article 17(1)(a) to (m) aspects | none |
| Article 17(3) | none | Not covered | none | |
| Article 17(4) | none | Not covered | none |
Three structural points help in reading the table. First, the chapeau rows (the Article 17(1) first and second sentences and point (c)) span clauses across the whole standard, so many Requirements contribute to them without any single one owning them. Second, Clauses 5 and 6 are listed as whole clauses on the rows that name them, so all of their subclauses sit inside those rows. Third, clause 8.2 appears on four rows, (b), (c), (d) and (g), but carries its own condition only on row (g); the standard requires that a life-cycle-wide risk management system exists and points to prEN 18228 for the risk management process itself.
What sits outside the table
Not every normative clause of EN 18286 has a presumption row. Retirement (clause 8.6) is not listed in Table ZA.1 at all; the Modulos Requirement MRF-449 captures it so that every normative clause traces to a Requirement, but no presumption attaches to it. The serious-incident good-practice list (9.6.2.2), the optional concern-reporting mechanism (10.1.1.2) and the management-review input list (10.1.2) are likewise normative or recommended content outside the correspondence. And two AI Act provisions the enquiry draft had mapped are absent from the final table: there is no Article 72 row and no Article 73 row; clause 9.5 enters through the Article 17(1)(h) row (its subclause 9.5.3 also on row (k)) and clause 9.6 through the Article 17(1)(i) row.
Staying valid
The standard's Annex ZA carries two warnings worth restating. First, check the current OJ list before relying on the presumption: the benefit exists only while the standard's reference stays on the published list, and it ends if the reference is withdrawn. Second, the AI Act is not the only law in play; other Union legislation can apply to the same products, and this presumption says nothing about, for example, GDPR or sectoral product law.
How the platform records this
Each Requirement in the OFF-19 and MFF-19 templates records, in its detail text, the Table ZA.1 rows it contributes to and any row conditions, so the presumption trail is auditable from inside a project. Every EN 18286 Requirement also carries the standing marker "Presumption of conformity attaches once EN 18286:2026 is cited in the Official Journal of the European Union"; when citation happens, that status line is the sweep target.
Related pages
EN 18286 overview
The standard, its status, and how Modulos models it
The QMS clauses (4–7, 10)
The organization layer behind the chapeau rows
Lifecycle and operations (8, 9.1–9.5)
The per-system clauses behind rows (a)–(h) and (k)–(l)
Conformity assessment and CE marking
Where presumption enters the Annex VI / VII routes
Source attribution
Annex ZA (informative) of EN 18286:2026, prepared under the Commission's standardization request M/613 to provide one voluntary means of conforming to requirements of Regulation (EU) 2024/1689. The table above restates Table ZA.1's correspondence and remarks in the documentation's own words; for conformity-assessment purposes, verify against the published standard.
Disclaimer
This page is for general informational purposes and does not constitute legal advice.