Docs

Appearance

EN 18286 Quality Management System for EU AI Act ​

EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, is a European Standard prepared by CEN/CLC/JTC 21 under the European Commission's standardization request M/613 and approved by CEN/CENELEC on 12 July 2026. It is the first of the JTC 21 AI Act standards to reach final approval, and it specifies the quality management system that Article 17 of the EU AI Act requires from providers of high-risk AI systems. "Quality" in the standard's sense is compliance with the applicable regulatory requirements of the AI Act.

Modulos models the standard as two paired framework templates: OFF-19 for the organization-scope duties where the quality management system resides, and MFF-19 for the per-AI-system realization and operational duties. This page orients you on the standard; Operationalizing in Modulos covers the rollout.

Status

Approved by CEN/CENELEC on 12 July 2026. Presumption of conformity attaches once EN 18286:2026 is cited in the Official Journal of the European Union; as of July 2026 it has not yet been cited. See how presumption attaches.

Key facts
Standards body
CEN/CENELEC, technical committee CEN/CLC/JTC 21
Instrument
European Standard under standardization request M/613 (Standard label in Modulos)
Approved
12 July 2026
Presumption of conformity
Pending OJ citation; Annex ZA covers Articles 17(1) and 11(1) first sentence
Structure
Clauses 4–10; Annexes A, B (ISO 9001), C (ISO/IEC 42001), ZA
Modulos templates
OFF-19 (organization) + MFF-19 (application): 24 Requirements, 83 Controls

Who the standard is for ​

  • Providers of high-risk AI systems are the primary audience: Article 17 obliges them to operate a quality management system, and this standard is the harmonized route to it.
  • Any provider of AI systems can use it; the standard applies irrespective of size, nature or location, and is tailored to organizations operating in or entering the EU market.
  • Providers with a sector-specific regulatory QMS (EN ISO 13485 for medical devices is the standard's own example) can extend that system to fulfill the AI Act duties rather than run a second, parallel one; the standard is written to support that. A general ISO 9001 system gets a clause-correspondence map in Annex B, not an integration claim.
  • Deployers are not the addressees. The standard reaches them only indirectly, through duties the provider owes them (instructions for use, retirement measures, incident channels).

What the standard covers ​

The normative clauses split into an organization layer, where the quality management system itself lives, and a per-AI-system layer covering realization and operations. The Modulos templates follow the same split, and Annex ZA runs through all of it: every clause band contributes rows to the presumption table.

ClauseWhat it holdsModulos scope
4 — Quality management systemEstablishing the QMS, identifying regulatory requirements, scope, the strategy for regulatory compliance, documented informationOFF-19
5 — LeadershipTop-management commitment, the quality policy, roles, responsibilities and authoritiesOFF-19
6 — PlanningRisks to the functioning of the QMS itself, quality objectives and planning to achieve themOFF-19
7 — SupportResources, competence, communication (including with authorities and notified bodies), awarenessOFF-19
8 — AI system realizationLife cycle processes, the AI system risk management system, inception through design and development, verification and validation, data management, retirement, identification, continuous learning, product documentationMFF-19
9 — Operations and controlPlacing on the market and putting into service, support services, supply chain, modifications, post-market monitoring (9.1–9.5 on the application side); serious incidents and non-compliance (9.6–9.7 at organization level)MFF-19 / OFF-19
10 — Performance evaluationManagement review and planning of changesOFF-19

Two design points are worth knowing before reading the clauses. The standard carries no continual-improvement obligation: the duty is to maintain the effectiveness of the quality management system, evaluated through management review. And its risk clause (8.2) requires that a life-cycle-wide risk management system exists while pointing to prEN 18228 for the risk management process itself; the process depth is that standard's subject.

What Annex ZA covers ​

Annex ZA Table ZA.1 defines exactly which AI Act provisions the standard covers, and it is deliberately narrow:

  • Article 17(1) — the quality management system duty, including all of points (a) to (m): the compliance strategy, design and development controls, examination and test procedures, technical specifications, data management, the Article 9 risk management system, post-market monitoring, serious-incident reporting, authority communication, record-keeping, resource management, and the accountability framework.
  • Article 11(1), first sentence — technical documentation drawn up before the AI system is placed on the market or put into service and kept up to date (clause 8.9.2).

Several rows carry conditions, headed by the chapeau caveat that EN conformance alone is not a compliance finding for any individual obligation. Expressly not covered: Articles 17(2)–(4). There is also no Article 72 row; the enquiry draft's post-market monitoring mapping did not survive into the final Annex ZA. The full table, every row's clauses and conditions, and the owning Modulos Requirements are on Annex ZA and presumption.

What changed from the prEN draft ​

The final standard revises the enquiry draft substantially:

  • Clauses renumbered and restructured, and the draft's "nonconformity" vocabulary replaced by non-compliance, defined as non-fulfilment of applicable regulatory requirements.
  • New identification and traceability duties (clauses 8.7 and 9.1): a unique reference for each conformity-assessed version, plus unique identification of each AI system placed on the market or put into service so it stays traceable through the distribution chain.
  • Retirement is an explicit life cycle stage (clause 8.6), with a mandatory duty to inform each deployer of all measures the deployer has to perform.
  • Continuous-learning governance (clause 8.8): pre-determined changes documented at design time, verified and validated per change, logged, and reflected in the technical documentation and instructions for use.
  • Support services (clause 9.2) recommended for deployers and users, including a feedback channel for risk reports.
  • Explicit serious-incident deadlines (clause 9.6): reporting is triggered once a causal link between the AI system and the incident is established or reasonably plausible, and runs on outer limits counted from the provider's awareness of the event: 2 days for critical-infrastructure cases, 10 days for a death, 15 days otherwise.
  • Non-compliance handling with a remedial menu (clause 9.7): bring the system into compliance, withdraw, disable or recall it, with market surveillance authorities informed when a system presents a risk.
  • The environmental-sustainability clause was deleted; the final standard carries no such requirement.
  • Annex ZA rescoped to Article 17(1) and the first sentence of Article 11(1); the draft's Article 72 mapping is gone.

Relationship to ISO 9001 and ISO/IEC 42001 ​

Annex B maps the standard's clauses to EN ISO 9001:2015 and Annex C to EN ISO/IEC 42001:2026. Both annexes map clauses and subclauses only, not requirements and concepts, so they are navigation aids for organizations that already run those systems, not equivalence claims. The practical difference: ISO/IEC 42001 is a certifiable AI management system standard with its own purpose; EN 18286 exists to implement Article 17 and to carry presumption of conformity once cited. An existing ISO 42001 program gives a conceptual running start on the management shell, but the direct template overlap in Modulos is modest (the documented-information Control family); the mechanical evidence reuse comes from the EU AI Act estate. EN 18286 vs ISO/IEC 42001 has the numbers.

How Modulos operationalizes the standard ​

Modulos ships the standard as OFF-19 (13 Requirements, ORF-410–ORF-422, 37 distinct Controls) and MFF-19 (11 Requirements, MRF-380–MRF-388 plus MRF-448/MRF-449, 46 distinct Controls). Most Controls are reused from the platform's existing estates, the EU AI Act families above all; EN-specific overlays carry what only this standard demands, such as continuous-learning change governance, retirement communication to deployers, the serious-incident timelines, and non-compliance detection with market corrective action. Each Requirement's detail records its Annex ZA rows, so the presumption trail is visible where the work happens.

Annex ZA and presumption

The full Table ZA.1, row by row, with conditions and owning Requirements

The QMS clauses

Clauses 4–7 and 10: the organization layer (OFF-19)

Lifecycle and operations

Clause 8 and 9.1–9.5: the per-AI-system layer (MFF-19)

Incidents and non-compliance

Clauses 9.6–9.7: deadlines, remedial menu, notifications

Operationalizing in Modulos

OFF-19 + MFF-19 rollout: Requirements, Control estate, and the 1.0.26 upgrade

EN 18286 vs ISO/IEC 42001

Regulatory QMS vs certifiable AIMS: when you need which, or both

Source attribution ​

EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, was prepared by CEN/CLC/JTC 21 and approved by CEN/CENELEC on 12 July 2026. The standard is available through CEN/CENELEC national members. Statements about Annex ZA on this page reflect Table ZA.1 of the approved text; verbatim conditions are paraphrased closely and should be verified against the published standard.

Disclaimer

This page is for general informational purposes and does not constitute legal advice.