EU AI Act Harmonised Standard prEN 18286 – Quality Management Systems for AI

Applies To

Overview

prEN 18286 entered the public enquiry phase as a candidate harmonised standard under the EU AI Act, placing it on a formal path toward publication in the Official Journal of the European Union. Once published as a harmonised standard, conformity with its provisions will confer a legal presumption of conformity with the AI Act obligations it is mapped to, primarily those relating to quality management systems. The standard is relevant to both AI providers establishing internal quality processes and deployers who must verify that procured systems meet regulatory requirements. Its development is coordinated through CEN and CENELEC under a standardisation request from the European Commission. Organisations submitting comments during the public enquiry phase can influence the final text, making early engagement strategically valuable. The timeline for finalisation and Official Journal citation remains subject to the standard development process.

Key Requirements

• •Establishes quality management system (QMS) requirements specifically tailored to AI systems within the EU AI Act's scope
• •Conformity with the published standard will create a presumption of conformity with the AI Act provisions the standard is mapped to
• •Applicable to AI providers as defined under the AI Act; relevant to deployers conducting due diligence on procured systems
• •Public enquiry is open, meaning national standards bodies are collecting comments from interested parties before finalisation
• •Once cited in the Official Journal, use of the standard becomes a primary conformity pathway for affected high-risk AI systems
• •No penalties attach to the standard itself; non-use means loss of the presumption of conformity, requiring alternative conformity demonstration under the AI Act

What Your Organization Must Do

• →Register to submit comments through your national standards body during the public enquiry window to influence QMS requirements before the standard is finalised.
• →Map current internal AI quality management processes against the draft prEN 18286 text to identify gaps that will require remediation.
• →Brief procurement and legal teams so that vendor contracts can reference alignment with prEN 18286 as a conformity criterion for high-risk AI systems.
• →Monitor the European Commission's standardisation page and the Official Journal for citation of this and other harmonised AI Act standards, as citation triggers the presumption of conformity mechanism.
• →Update your AI conformity documentation framework to designate prEN 18286 as a target standard, with a planned gap assessment once the final text is published.
• →Engage your notified body or conformity assessment partner now to understand how prEN 18286 will be incorporated into their assessment methodology.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Does conformity with prEN 18286 automatically satisfy EU AI Act quality management requirements for high-risk AI systems?

Once prEN 18286 is cited in the Official Journal of the EU, conformity with its provisions will create a legal presumption of conformity with the AI Act obligations it covers. This presumption is rebuttable but significantly reduces the burden of proof in a regulatory assessment. The standard has not yet been cited, so this mechanism is not yet active.

What happens if an organisation chooses not to use prEN 18286 as its conformity pathway?

Non-use of a harmonised standard does not constitute a violation, but the organisation loses the presumption of conformity it would otherwise provide. Alternative conformity demonstration is still permitted under the AI Act, though it typically requires more extensive documentation and justification. Notified bodies will scrutinise alternative approaches more closely.

Can AI deployers rely on prEN 18286 for due diligence on third-party procured systems, or is it only relevant to providers?

The standard is primarily directed at AI providers establishing quality management systems, but it is explicitly relevant to deployers conducting procurement due diligence. Compliance teams can use the draft text to define vendor contractual requirements, helping ensure procured high-risk AI systems meet the underlying AI Act obligations. Updating vendor contracts now is advisable.

What is the current status of prEN 18286 and when is it expected to be published as a finalised harmonised standard?

prEN 18286 is currently in the public enquiry phase, meaning national standards bodies are collecting stakeholder comments before finalisation. No confirmed publication date or Official Journal citation date has been announced, as the timeline depends on the CEN/CENELEC standards development process. Organisations should monitor the European Commission standardisation page for updates.

How does prEN 18286 relate to ISO 9001, and can existing ISO 9001 certification substitute for it?

prEN 18286 is specifically tailored to AI quality management within the EU AI Act's scope, addressing requirements that generic ISO 9001 certification does not cover. Existing ISO 9001 processes may provide a useful foundation, but they are unlikely to satisfy the AI-specific provisions of the harmonised standard without supplementary controls. A formal gap assessment against the prEN 18286 draft text is recommended.

How can organisations influence the final requirements of prEN 18286 before it is adopted?

Organisations can submit formal comments through their national standards body during the open public enquiry window, which is the primary mechanism for influencing the final text. Early engagement is strategically valuable because post-enquiry changes are limited once the draft advances. Compliance and legal teams should coordinate submissions to address provisions with significant operational impact.