Operationalizing EN 18286 in Modulos

EN 18286:2026 is a voluntary European Standard for a quality management system (QMS) for the regulatory purposes of the EU AI Act. CEN approved it on 12 July 2026. Modulos gives EN 18286 as two Frameworks with the name EN 18286 Quality Management System for EU AI Act:

• OFF-19 at the Organization level, for clauses 4 to 7 and 9.6 to 10.
• MFF-19 at the AI System level, for clause 8 and clauses 9.1 to 9.5.

This page gives the decisions before you add the Frameworks, and the steps in Modulos. It also gives the Requirement table of each Framework, the Role tag, and the work that the Frameworks do not hold. On this page, "you" is the organization that sets up EN 18286 in Modulos. The page EN 18286 gives the dates of the standard, its structure, and the law.

Recommended AI System structure

For EN 18286, Modulos uses two levels of AI System. EN 18286 has one QMS, and its life cycle processes are part of that QMS (clauses 4.1 and 8.1.1). The Organization level and the AI System level are the Modulos structure, not a structure of the standard.

AI System	Framework	Clauses of EN 18286 in the Framework
The organization AI System	OFF-19	Clauses 4 to 7, 9.6, 9.7 and 10: the QMS, Leadership, Planning, Support, Reporting serious incidents, Non-compliance, and Performance evaluation
One AI System for each AI system in the QMS	MFF-19	Clause 8 and clauses 9.1 to 9.5: AI system realization, and Operations and control, for that AI system

• The QMS is in OFF-19 one time. The AI Systems with MFF-19 hold the work for each AI system. They do not hold a copy of the QMS.
• The QMS scope gives the AI Systems. Modulos recommends one AI System with MFF-19 for each AI system in the QMS. In clause 4.3, the provider determines which AI systems the QMS includes: one AI system or a set of AI systems.

Organization AI Systems

Frameworks at the Organization level, for example OFF-19, attach to the organization AI System that your organization has (Type Organization in the AI Registry). The AI Registry does not make new organization AI Systems. If your organization does not have one, contact Modulos for help before you add the Framework.

Decisions before you add the Frameworks

The provider makes three decisions before it adds the EN 18286 Frameworks in Modulos. EN 18286 does not give a sequence for these decisions. Clause 4.3 uses the regulatory requirements that the provider identifies in clause 4.2. Clause 4.2 also tells the provider to put these requirements into the strategy for regulatory compliance (clause 4.4).

• Is your organization the provider? The standard is for the provider (clause 1). Article 25(1) of the EU AI Act gives the conditions in which a distributor, importer, deployer or other third party “shall be considered to be a provider of a high-risk AI system”. See Who the standard is for and Article 25.
• Which AI systems does the QMS include? Clause 4.3 tells the provider to determine which AI systems are in the QMS. When it sets the limits of the QMS, it uses the regulatory requirements of clause 4.2 and the intended purpose of the AI systems. This decision gives the AI Systems that get MFF-19. See Clause 4.
• Which method do you use for Article 17? Article 17(1) of the EU AI Act tells providers of high-risk AI systems that they “shall put a quality management system in place that ensures compliance with this Regulation”. EN 18286 is one voluntary method to conform to requirements of the Regulation (Annex ZA). Table ZA.1 in Annex ZA shows clauses of the standard only against Article 17(1) and the first sentence of Article 11(1). It marks Article 17(2), 17(3) and 17(4) as not covered. The dates for Article 17 are in Article 113, point (c) (see Who the standard is for). See Annex ZA and presumption and Article 17.

Steps in Modulos

You, the organization that sets up EN 18286, add the EN 18286 Frameworks to Modulos with these steps. Do them after the three decisions: the provider, the AI systems in the QMS, and the Article 17 method. The Requirement table of each Framework gives the Requirement for each clause.

1. Add OFF-19 to your organization AI System.
2. Add MFF-19 to the AI System of each AI system in the QMS.
3. Do the work for the Controls of each Requirement.
4. Let the Requirement Owner examine the work and mark the Requirement Fulfilled. See Reviews & Statuses.
5. Add the EU AI Act Frameworks for the obligations of the Regulation. See Other Frameworks in Modulos.
6. If you use the presumption of conformity, monitor the Official Journal frequently for the reference to EN 18286 (Annex ZA, WARNING 1). The presumption continues only while the Official Journal keeps the reference.

Organization Requirements (OFF-19)

The Organization Framework OFF-19 has these Requirements for EN 18286. Each row gives the name of the Requirement in Modulos, its clauses, and the page for these clauses.

Requirement	Name in Modulos	EN 18286 clauses	Page for the standard
ORF-410	Quality management system — general	4.1	Clause 4
ORF-411	Identifying regulatory requirements	4.2	Clause 4
ORF-412	Scope of the quality management system	4.3	Clause 4
ORF-413	Strategy for regulatory compliance	4.4	Clause 4
ORF-414	Documented information	4.5	Clause 4
ORF-415	Management responsibility	5.1	Clause 5
ORF-416	Quality policy	5.2	Clause 5
ORF-417	Roles, responsibilities and authorities	5.3	Clause 5
ORF-418	Planning — QMS risks, quality objectives	6.1, 6.2	Clause 6
ORF-419	Support — resources, competence, communication	7.1–7.4	Clause 7
ORF-420	Reporting serious incidents	9.6	Clause 9.6
ORF-421	Non-compliance and corrective action	9.7	Clause 9.7
ORF-422	Performance evaluation — review and planning of changes	10.1, 10.2	Clause 10

AI System Requirements (MFF-19)

The AI System Framework MFF-19 has these Requirements for EN 18286. The rows are in the sequence of the clauses.

Requirement	Name in Modulos	EN 18286 clauses	Page for the standard
MRF-380	Determining life cycle stages and realization processes	8.1	Clause 8
MRF-381	Actions to address risks (risk management system)	8.2	Clause 8
MRF-382	Inception, design and development	8.3	Clause 8
MRF-383	Verification and validation	8.4	Clause 8
MRF-384	Data management	8.5	Clause 8
MRF-449	Retirement of AI systems	8.6	Clause 8
MRF-448	Identification and traceability of AI systems	8.7, 9.1	Clause 8, Clauses 9.1–9.5
MRF-385	Support services, modifications and continuous learning	8.8, 9.2, 9.4	Clause 8, Clauses 9.1–9.5
MRF-388	Product documentation (technical documentation and instructions for use)	8.9	Clause 8
MRF-386	Supply chain	9.3	Clauses 9.1–9.5
MRF-387	Post-market monitoring	9.5	Clauses 9.1–9.5

The Role tag on the Requirements

In Modulos, each Requirement of OFF-19 and MFF-19 has the tag "Role: Provider". The tag shows that the Requirement is for the provider of the EU AI Act (Article 3(3)). EN 18286 is also for providers of AI systems (clause 1).

Modulos wants to use Role tags in a subsequent release, to remove Requirements from the scope of an Organization or AI System without that Role. All Requirements of OFF-19 and MFF-19 have the same tag. Thus, the tag does not make a difference between two Requirements of these Frameworks.

Work that the Frameworks do not hold

The EN 18286 Frameworks OFF-19 and MFF-19 do not hold these items. The provider does this work in other Frameworks or in its processes.

• The Official Journal reference to EN 18286. The reference of EN 18286:2026 is in the Official Journal from 14 October 2026, by Implementing Decision (EU) 2026/2274. Article 40(1) of the EU AI Act gives a presumption of conformity for a harmonized standard with its reference published there. The presumption continues only while the Official Journal keeps the reference (Annex ZA, WARNING 1). See How presumption of conformity attaches.
• The obligations of the EU AI Act. EN 18286 is voluntary, but the EU AI Act is law. The EU AI Act Frameworks hold its obligations, for example Article 17 (quality management system), Article 72 (post-market monitoring), and Article 73 (reporting of serious incidents).
• Article 17(2) to 17(4), and Articles 72 and 73 as such. Table ZA.1 marks Article 17(2), 17(3) and 17(4) as not covered. It has no row for Article 72 or Article 73 as such. Its rows for points (h) and (i) of Article 17(1) show the clauses on post-market monitoring and on procedures to report serious incidents. See Clauses and provisions with no row in Table ZA.1.
• A sectoral quality management system. Article 17(3) lets a provider of high-risk AI systems with quality management system obligations, or an equivalent function, in “relevant sectoral Union law” put the Article 17(1) “aspects” into that system. See Who the standard is for.
• The conformity assessment. Article 43 of the EU AI Act gives the conformity assessment procedures, and some of them include a notified body. A presumption of conformity is not the result of a conformity assessment. See Conformity assessment and CE marking.

Other Frameworks in Modulos

The EU AI Act has two Frameworks in Modulos: OFF-1 at the Organization level and MFF-1 at the AI System level. OFF-1 attaches to the same organization AI System as OFF-19. See Operationalizing the EU AI Act in Modulos.

Some Controls of OFF-19 and MFF-19 are also in other Frameworks. The page Control overlap shows these Controls. The page ISO/IEC 42001 and the EU AI Act compares ISO/IEC 42001 with the EU AI Act and EN 18286.

Related pages

EN 18286 overview

Dates, structure and Annex ZA of EN 18286

Harmonized standards overview

Presumption of conformity and the JTC 21 standards

Frameworks in Modulos

Framework mapping and versions in Modulos

Operating model

How AI Systems, Requirements, Controls and Evidence fit together

Sources of this page

• EN 18286:2026, European Standard of July 2026, approved by CEN on 12 July 2026. This page uses the first page of the standard, clauses 1, 4.1 to 4.4 and 8.1.1, the clause names, and Annex ZA with Table ZA.1 and WARNING 1.
• Regulation (EU) 2024/1689 (EU AI Act), consolidated text of 27 July 2026: EUR-Lex. This page uses Articles 3(3), 11(1) (first sentence), 17(1) to 17(4), 25(1), 40(1), 43, 72, 73, and 113 (point (c)).
• The European Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, in the Official Journal of 14 October 2026: EUR-Lex. This page uses Article 1 and the Annex.
• Modulos, the Frameworks OFF-19 and MFF-19.

Disclaimer

This page gives general information only. It is not legal advice.