EN 18286 Clauses 4 to 7 and 10: QMS, Leadership, Planning, Support, and Review

EN 18286:2026 is a voluntary European Standard for a quality management system (QMS) for providers of AI systems. Its primary scope is organizations that place on the market or put into service high-risk AI systems. This page tells you the requirements of clause 4 (Quality management system), clause 5 (Leadership), clause 6 (Planning), clause 7 (Support), and clause 10 (Performance evaluation).

In the standard, "shall" shows a requirement, "should" shows a recommendation, "may" shows a permission, and "can" shows a possibility or a capability (clause 0.2). The requirements of the standard apply only to a provider that uses the standard. The law for the provider is the EU AI Act. Article 17(1) tells providers of high-risk AI systems to “put a quality management system in place”. EN 18286 is one voluntary method to conform to Article 17(1) (see Who the standard is for).

Article 17 applies from the dates in Article 113 point (c). See Who the standard is for for these dates.

Clause 8 and clauses 9.1 to 9.5 are on Lifecycle and operations. Clauses 9.6 and 9.7 are on Incidents and non-compliance. EN 18286 has one QMS. Modulos puts clauses 4 to 7, 9.6, 9.7, and 10 in the Organization Framework OFF-19 (see Clauses 4–7 and 10 in Modulos).

Clause 4 — Quality management system

Clause 4 of EN 18286 gives the requirements for the QMS of the provider. The subclauses are about the general requirements, the regulatory requirements, the scope, the strategy for regulatory compliance, and the documented information.

4.1 General. EN 18286 requires the provider to establish and maintain the QMS as the standard requires. The provider does this to give protection to health, safety and fundamental rights, as specified in the applicable regulatory requirements. The provider also establishes and maintains each process, procedure, and other work that is necessary for the effectiveness of the QMS. This effectiveness is about compliance with the applicable regulatory requirements through the applicable life cycle stages (see clause 8.1).

4.2 Regulatory requirements. EN 18286 requires the provider to identify the applicable regulatory requirements and to do a systematic review of them. The provider includes the regulatory requirements that it identified in its strategy for regulatory compliance (clause 4.4). Clause 4.3 b) 1) uses the same requirements to set the limits of the QMS scope.

4.3 Scope. EN 18286 requires the provider to determine the scope of its QMS. The provider determines the AI system, or the group of AI systems, that the QMS includes. Then it sets the limits of the scope. For these limits, it considers the regulatory requirements of clause 4.2 and the intended purpose of the AI systems. Thus, one QMS can include one AI system or more.

4.4 Strategy for regulatory compliance. EN 18286 requires the provider to determine and apply a compliance strategy for the regulatory requirements that it identified in clause 4.2 (clause 4.4.1.1). In the standard, a strategy is the general method to get compliance. It is not the methods and measures that the provider uses. The strategy includes a minimum of these six items:

• Compliance with the essential requirements (clause 4.4.2)
• The regulatory requirements for post-market monitoring (clause 9.5)
• The regulatory requirements for serious incidents (clause 9.6)
• Data management (clause 8.5)
• The selection and use of the applicable conformity assessment procedures. A NOTE in the clause refers to Article 43 of the EU AI Act.
• Modifications to the AI systems (clause 9.4)

When the provider makes the strategy, it considers a minimum of these items (clause 4.4.1.2):

• The intended purpose of the AI systems
• The areas where the AI systems are used
• The conformity assessment procedures that the applicable regulatory requirements require

The strategy is available as documented information (clause 4.5).

Clause 4.4.2 gives seven essential requirements. They are the requirements of Section 2 of Chapter III of the EU AI Act:

Article of the EU AI Act	Essential requirement
Article 9	Risk management system
Article 10	Data and data governance
Article 11	Technical documentation
Article 12	Record-keeping
Article 13	Transparency and provision of information to deployers
Article 14	Human oversight
Article 15	Accuracy, robustness and cybersecurity

Clause 4.4.3.1 tells the provider to select one or more of these methods for each applicable essential requirement:

• Harmonized standards that are cited in the Official Journal
• Common specifications that an implementing act adopted
• Other standards
• Other technical specifications

Clause 4.4.3.2 tells the provider to record each applicable essential requirement that it complies with by harmonized standards or common specifications. The provider records them in the technical documentation. More records are necessary if one of these conditions occurs:

• The provider uses other standards or other technical specifications for an essential requirement.
• The annexes of a harmonized standard that the provider applies document limits. Because of these limits, the standard does not fully or sufficiently include the essential requirements.

In these conditions, the provider records in the technical documentation the essential requirements that the harmonized standards or common specifications do not fully include. For these requirements, the provider also records its measures. The record of these measures includes a “detailed description” of how the provider complies with each applicable essential requirement.

Table ZA.1 has only clause 4.4.3 in the row for Article 17(1)(e) of the EU AI Act. Point (e) is about the “technical specifications, including standards, to be applied” and, “where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2, the means to be used”. Clause 4.4.2 has no row in Table ZA.1. Annex ZA shows that compliance with clause 4.4.3 gives a presumption of conformity with Article 17(1)(e), in the scope of the standard. This presumption applies from the citation of EN 18286 in the Official Journal on 14 October 2026, by Implementing Decision (EU) 2026/2274. See Annex ZA and presumption.

4.5 Documented information. EN 18286 requires the provider to establish and maintain documented information of the QMS that shows that the QMS agrees with the standard (clause 4.5.1). This documented information has these properties:

• It gives full information about the measures that make sure that the AI systems in the QMS comply with their applicable regulatory requirements. This information includes the QMS scope, the quality policy, and the quality objectives. It also includes references to the documented processes and procedures, and the interaction of the QMS processes.
• It is available to notified bodies and competent authorities.
• It is clear, it is easy to access, and it is version-controlled. It is easy to find the related information, and this information is in an official language of the European Union.

Clause 4.5 also has these requirements:

• Operational documented information (4.5.2). The provider makes sure that the documented information that it finds necessary to plan, operate, and control the QMS processes is written and maintained.
• Changes (4.5.3). The related competent personnel (clause 7.2) do a review of each change to documented information and give approval for it.
• Control of documented information (4.5.4.1). The provider controls documented information. The control makes sure that documented information is “suitable” for use when and where it is necessary. This includes the selection of format and media. The control also includes protection (for example of confidentiality and integrity), storage and “preservation”, control of changes, retention and disposal, and “linkage”, identification, and “description” of documented information.
• External documented information (4.5.4.2). The provider identifies, as “appropriate”, and controls the documented information from external sources that it finds necessary to plan and operate the QMS.
• Documented procedure (4.5.4.3). A documented procedure gives the controls for approval before release, and for review, change, and approval again. It also gives the controls to identify the version in use and to identify changes. Its controls also make sure that the control of clause 4.5.4.1 gets its results.

Retention. Clause 4.5.4.1 tells the provider to keep documented information for the period that the applicable regulatory requirements give. Clause 4.5.4.1 also gives a minimum period for documented information about AI systems that went through development and testing. This information stays available for a minimum of the lifetime of each AI system, as the provider sets it. The period is also not less than the retention period of each item of documented information that comes as a result. These minimums apply unless the applicable regulatory requirements set a different period.

For a provider of a high-risk AI system, Article 18(1) of the EU AI Act gives the legal retention rule. It tells the provider, “for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities” the technical documentation, the QMS documentation, and the other items of Article 18(1). Article 18(3) adds a rule for providers that are financial institutions “subject to requirements regarding their internal governance, arrangements or processes under Union financial services law”. These providers maintain the technical documentation as part of the documentation that Union financial services law tells them to keep.

Article 18 applies from the dates in Article 113 point (c) (see Who the standard is for).

Clause 5 — Leadership

Clause 5 of EN 18286 gives the requirements for top management and for the roles in the QMS.

5.1 General. EN 18286 requires top management to show leadership and commitment for the QMS. Top management shows this when it does these tasks:

• It establishes the quality policy (clause 5.2).
• It makes sure that the quality objectives are established (clause 6.2.1).
• It gives “appropriate” resources, roles, functions, and responsibilities in the organization of the provider (clause 5.3).
• It makes sure that resources are available (clause 7.1).
• It makes sure that the QMS requirements are part of the processes of the provider, and that the QMS is established and maintained with effectiveness.
• It makes sure that the QMS gets its quality objectives.
• It does management reviews (clause 10.1).

A NOTE adds that top management can show commitment when it helps a culture of responsible development and use of AI systems.

5.2 Quality policy. EN 18286 requires top management to establish a quality policy with these properties:

• It gives a framework to set quality objectives.
• It includes a commitment to obey the applicable requirements, “in particular” the regulatory requirements.
• It aligns with the strategy for regulatory compliance (clause 4.4).
• It includes a commitment to maintain QMS effectiveness (clause 5.2 d)).
• It is part of the QMS documented information.
• The personnel in the QMS scope who work for the provider receive it and know it (clause 7.4).

The provider is permitted to include the quality policy in a more general policy.

5.3 Roles, responsibilities, and authorities. EN 18286 requires the provider to give the supervision of the QMS, and the responsibilities for it, to personnel with related expertise and experience. Where applicable, this includes responsibilities at top management level (clause 5.3.1). Top management sets who is responsible for these three items, but it keeps the accountability for them:

• The reports to top management on the performance of the QMS
• The establishment of the AI system risk management, and its oversight (clause 8.2)
• The determination and review of the regulatory requirements and of the state of the art for all AI systems in the QMS scope

The provider gives the roles, with their responsibilities and authorities, to persons in its organization. It makes them known in the organization, also when roles give information to other roles. It records them in documented information. Clause 5.3.2 gives these requirements for the roles and responsibilities:

• The roles align with the quality policy and the quality objectives.
• The provider sets the responsibilities and the authority to make decisions for all AI systems in the QMS scope (clause 4.3). Where “appropriate”, the provider can set them at the level of the organization, a function, or a role, and not for each AI system.
• Responsibilities are given to monitor the regulatory requirements of clause 4.2 and to do the necessary work for them. This includes the risks to fundamental rights, health and safety.
• Responsibilities are identified for all processes that the standard requires in all stages of the AI system life cycle. This includes the processes that the regulatory requirements require. It also includes the roles that the provider includes in consultation or gives information to.

Top management makes sure that the personnel who control, do, and verify work that has an effect on quality have the necessary authority and autonomy. This includes the authority to “intervene” and to do the related actions. The provider gives the accountability and responsibilities for two items to one person or more, each with a “specific” role:

• The oversight of the implementation of the risk management system
• The approval of risk control measures

Clause 6 — Planning

Clause 6 of EN 18286 tells the provider how to plan the QMS. Clause 6.1 is about the risks to the operation of the QMS, and clause 6.2 is about quality objectives. Risks to the QMS are different from the risks of the AI systems, which clause 8.2 is about.

6.1 Risks to the QMS. When the provider plans the QMS, it uses the regulatory requirements of clause 4.2 to determine the risks for which actions are necessary (clause 6.1.1). These actions are necessary for two results:

• To make sure that the QMS can get the results that it is for
• To prevent or decrease unwanted effects of the QMS

Then the provider plans the actions for these risks (clause 6.1.2). It also plans how it puts the actions into its QMS processes and implements them, and how it evaluates the effectiveness of the actions. When it determines the actions, it considers a minimum of these items (clause 6.1.3):

• The strategy for regulatory compliance (clause 4.4)
• The AI technologies that it uses
• The information and help from other organizations across the AI system life cycle that are necessary for compliance with the regulatory requirements
• The resources and competence that are available (clauses 7.1 and 7.2)

6.2 Quality objectives. EN 18286 requires the provider to establish quality objectives for the functions, levels, products, and processes that are necessary for the QMS (clause 6.2.1). The quality objectives agree with the quality policy, and they have these properties:

• They can be verified.
• They consider the applicable requirements, “in particular” the applicable regulatory requirements.
• The provider does a review of them at regular intervals and changes them where necessary to keep regulatory compliance through the AI system life cycle.
• They are part of the QMS documented information.

When the provider plans how to get its quality objectives, it determines these items (clause 6.2.2):

• The work that it will do, with the related processes and their quality criteria (clause 8.1)
• The necessary actions
• The persons who are responsible, with their responsibilities and roles (clause 5.3)

Clause 7 — Support

Clause 7 of EN 18286 gives the requirements for resources, competence, communication, and awareness.

7.1 Resources. EN 18286 requires the provider to determine and supply the resources that are necessary to establish, implement, and maintain the QMS. The provider considers a minimum of these items:

• Personnel and their competences
• Knowledge about the use and the technology of the AI systems
• Infrastructure, for example for design and development and for testing
• Measures for “security-of-supply” (clause 9.3)

Table ZA.1 has clauses 7.1, 7.2, and 9.3 in the row for Article 17(1)(l) of the EU AI Act, which is about “resource management, including security-of-supply related measures”.

7.2 Competence. EN 18286 requires the provider to do these tasks (clause 7.2.1):

• Determine the necessary competences of the personnel that do work with an effect on the performance and effectiveness of the QMS.
• Make sure that these personnel are competent for their roles because of education, training, or experience. Make sure that they stay competent.
• Where necessary, do actions to get or increase the necessary competences.
• Document the processes for these tasks.

Clause 7.2.2 tells the provider to make sure that the related personnel know their quality management duties and the QMS processes. The related personnel also have, or can get, the competences to know the regulatory requirements of clause 4.2 and the intended purpose. Clause 7.2.3 tells the provider to evaluate the effect of these four items on the competency requirements:

• The intended purpose of each AI system and its reasonably foreseeable misuse
• The type of the AI technologies and of the data that the AI system processes
• The relation between the intended purpose, the reasonably foreseeable misuse, and the risks in the risk management system, which include “significant” effects on affected persons
• The usability and accessibility of the AI systems for their different “intended users”, which include persons with disabilities

7.3 Communication. EN 18286 requires the provider to plan the internal and external communication that the applicable regulatory requirements make necessary (clause 7.3.1). The provider determines the information, the time, the persons, and the method of the communication. The provider makes sure that communication is easy to access. Communication does not “exclude” interested parties because of “disability, proficiency, or age”. As “appropriate”, the provider adapts the communication to the “needs and characteristics” of the interested parties.

Clause 7.3.2 gives the communication for regulatory purposes:

• Procedures (7.3.2.1). The provider makes and maintains procedures for communication with national competent authorities, other authorities, notified bodies, and other operators. The procedures also include “customers” (which include deployers) and, as applicable, other interested parties.
• Information (7.3.2.2). As the applicable regulatory requirements require, the provider gives information to the related interested parties about three items. These items are non-compliance of the AI system, an AI system presenting a risk, and serious incidents. The NOTEs refer to Articles 20(1), 20(2), and 73 of the EU AI Act.
• Reasoned request (7.3.2.3). A competent authority can send a reasoned request. Then the provider gives the documented information and the information that shows compliance. The provider has procedures to do this in an “appropriate” time. A NOTE refers to Article 21(1) of the EU AI Act.
• Compliance information (7.3.2.4). The provider has processes to identify, collect, and send or make available the information that shows the initial and continuous compliance of the AI systems. This includes information “requested” by a competent authority in compliance with the regulatory requirements. One example is logs that the AI system makes automatically and that the provider controls.

Table ZA.1 has clauses 7.3 and 9.7.2.2 in the row for Article 17(1)(j) of the EU AI Act. Article 17(1)(j) is about “the handling of communication” with authorities, notified bodies, other operators, customers, and other interested parties.

7.4 Awareness. EN 18286 requires that the persons who work for the provider in the QMS scope know these three items:

• The quality policy
• How their work and their role help the effectiveness of the QMS
• The “implications” if they do not conform to the QMS requirements

Table ZA.1 has clauses 5.1, 5.3, and 7.4 in the row for Article 17(1)(m) of the EU AI Act, which is about “an accountability framework setting out the responsibilities of the management and other staff”.

Clause 10 — Performance evaluation

Clause 10 of EN 18286 gives the requirements for management review (clause 10.1) and planning of changes (clause 10.2).

10.1 Management review. EN 18286 requires a review of the effectiveness of the full QMS (clause 10.1.1.1). This review includes the protection that the QMS gives to health, safety and fundamental rights.

The review uses clear criteria that the provider can measure, which are “quantitative”, “qualitative”, or the two. The provider establishes and documents procedures for a review of the QMS at “planned intervals”. The review makes sure that the QMS continues to have suitability, adequacy, and effectiveness, and it identifies necessary changes. The review includes these items:

• The quality policy and the quality objectives
• The compliance of the organization with its policies and procedures
• The monitoring of the effectiveness of risk control measures
• The interested parties, “particularly” affected persons
• The actions for risks to the QMS (clause 6.1.2)
• Changes to the applicable regulatory requirements

Clause 10.1.1.1 also has these requirements:

• The review process at intervals is “proportionate” to the risks that each AI system can cause. This applies on the condition that the provider keeps the “degree of rigour” and the level of protection of health, safety and fundamental rights.
• The review process includes top management at intervals.
• An investigation of a serious incident can find that the QMS or its measures are not sufficient. In that condition, the provider makes sure that one more review of the QMS occurs, which is not one of the reviews at “planned intervals”.
• The provider keeps documented information about the reviews, which includes their recommendations (clause 4.5).

Clause 10.1.1.2 lets the provider make a concern-reporting process about the role of the provider for an AI system across its life cycle. For such a process, the standard recommends functions. Examples are confidentiality or anonymity, competent personnel, escalation to management, and protection from reprisals.

Clause 10.1.2 recommends inputs to the review. Examples are feedback from interested parties, complaints, reports to regulatory authorities, and audits. Other examples are the monitoring of the QMS processes and of the AI system in operation, and corrective actions. New or changed regulatory requirements and standards are also inputs.

Clause 10.1.3 tells the provider to document the review output. The output includes each improvement that is necessary to keep the suitability, adequacy, and effectiveness of the QMS. It also includes the necessary changes for new or changed regulatory requirements, and changes to the necessary resources.

Table ZA.1 has clauses 10.1.1.1, 10.1.3, and 10.2 in three rows of Article 17(1) of the EU AI Act. These rows are the first sentence, the first part of the second sentence, and point (c) on “development, quality control and quality assurance”. Clauses 10.1.1.2 and 10.1.2 have no row in Table ZA.1.

10.2 Planning of changes. When the provider finds that changes to the QMS are necessary, EN 18286 requires the provider to do these tasks (clause 10.2.1):

• Document the procedures for the changes.
• Make the changes with a plan and with control.
• Keep documented information about the changes.

A new AI system can come into the QMS, or an AI system in the QMS can have a substantial modification. Then the provider examines if a review of the QMS processes of clause 4.1 is necessary for that AI system and its properties (clause 10.2.2). If a review is necessary, the provider does the review. If the review finds that changes to the processes are necessary, the provider changes them. Before the provider changes a QMS process, it evaluates the effect of the change on the QMS and on each AI system in the QMS. It controls the change as the standard requires (clause 10.2.3).

Improvement and change. EN 18286 has no continual-improvement clause. The standard requires the provider to keep the effectiveness of the QMS. Improvement and change come from these clauses:

• The commitment in the quality policy to maintain QMS effectiveness (clause 5.2 d))
• The monitoring of the effectiveness of processes, with corrective action (clause 8.1.4)
• The experience from use that post-market monitoring collects, to find necessary corrective action or “preventive action” (clause 9.5.1 e))
• The steps for non-compliance, which include “preventive action” and changes to the QMS (clause 9.7.1 e) and f))
• The management review and its output (clauses 10.1.1.1 and 10.1.3 a))
• The planning of changes (clause 10.2)

Clauses 4–7 and 10 in Modulos

In Modulos, the Organization Framework OFF-19 has clauses 4 to 7, 9.6, 9.7, and 10 of EN 18286. You add it to the organization AI System. The Organization Requirement table gives the Requirements of OFF-19 and their clauses.

Related pages

EN 18286 overview

The standard, its dates, its structure, and Annex ZA

Lifecycle and operations

Clause 8 and clauses 9.1–9.5 for each AI system

Incidents and non-compliance

Clauses 9.6 and 9.7, and Articles 20 and 73 of the EU AI Act

Annex ZA and presumption

The rows of Table ZA.1 for these clauses

Sources of this page

• EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, European Standard of July 2026, approved by CEN on 12 July 2026. Clauses: 0.2, 1, 4.1 to 7.4, 8.1.4, 9.5.1, 9.7.1, 10.1, and 10.2, and Table ZA.1 of Annex ZA.
• Regulation (EU) 2024/1689 (EU AI Act), consolidated text of 27 July 2026, as amended by Regulation (EU) 2026/1744. Provisions: Articles 17(1), 18(1), 18(3), and 113 point (c).
• The Commission Implementing Decision (EU) 2026/2274 (OJ L, 2026/2274, 14 October 2026), Article 1 and the Annex: EUR-Lex.

Disclaimer

This page gives general information. It is not legal advice.