What it is
A harmonised standard is a technical document developed by one of three recognised European standards organisations — CEN, CENELEC, or ETSI — at the formal request of the European Commission, to support a specific piece of EU law. The law itself states broad legal obligations (“providers must implement a quality management system,” for instance); the harmonised standard translates that obligation into detailed, testable technical specifications that an engineering team can actually build against.
The mechanism that makes harmonised standards powerful is the “presumption of conformity.” Once the Commission publishes a reference to a harmonised standard in the Official Journal of the EU, a company that builds its product in line with that standard is legally presumed to comply with the corresponding requirement in the underlying law. Using the standard remains voluntary — a company can still try to demonstrate compliance by other means — but doing so is slower, more expensive, and carries more legal risk, since the company bears the burden of proving compliance itself rather than relying on a pre-approved template. In practice, this makes harmonised standards the default compliance pathway for most firms.
This model is not new or specific to AI. The EU has used harmonised standards for decades to implement product-safety law for everything from toys to medical devices. What is new is applying the same machinery to AI systems, where the underlying law is the AI Act.
Why it matters for AI governance and narratives
The AI Act sets out high-level obligations for “high-risk” AI systems — human oversight, risk management, data governance, a quality management system — but it does not specify exactly how a company proves it has met them. Harmonised standards are where that specificity gets written, largely by technical committees working behind the public eye, with industry representatives heavily involved in the drafting. This matters for how the AI Act’s meaning gets contested: the legislative text is set by elected lawmakers, but the operational substance of “compliance” is set later, by standards bodies, in a process with far less political visibility. Observers of AI governance — including the Commission’s own officials — have flagged this as a legitimacy question: a law can be strict on paper while the standards that operationalise it are shaped substantially by the industry being regulated.
The publication of the first AI Act harmonised standard is also a marker of regulatory maturity. Until a harmonised standard exists for a given AI Act requirement, high-risk providers face uncertainty about what compliance looks like in practice. Each new standard narrows that uncertainty — and narrows the space in which companies, regulators, and civil society groups can argue about what the law actually demands.
Key facts and dates
EN 18286:2026, titled “Artificial intelligence — Quality management system for EU AI Act regulatory purposes,” is the first harmonised standard published to support the AI Act. It was developed by CEN and CENELEC, the European standards bodies, and its reference was published in the Official Journal of the European Union via Commission Implementing Decision (EU) 2026/2274 in October 2026.
The standard covers the quality management system obligations in Article 17 of the AI Act, which requires providers of high-risk AI systems to establish documented processes covering the system’s full lifecycle, including post-market monitoring. Providers that implement EN 18286 benefit from a presumption of conformity with the Article 17 requirements it covers. The standard is designed to sit on top of existing management-system standards — such as ISO/IEC 42001 (AI management systems) or ISO 9001 (general quality management) — rather than requiring companies to build a separate, parallel compliance system from scratch, including for organisations already running sector-specific systems like ISO 13485 in medical devices.
EN 18286 is the first of a planned broader suite of AI Act harmonised standards; additional standards addressing risk management, cybersecurity, and logging requirements are understood to be in development through the same CEN-CENELEC process (Joint Technical Committee 21). The AI Act’s own high-risk system requirements are phased in through 2027–2028, so EN 18286 is arriving well ahead of the deadlines it will help companies meet.
Where to learn more
- First harmonised standard supporting the AI Act published in the Official Journal — European Commission’s official announcement
- EN 18286 in the Spotlight: Supporting Compliance with the AI Act — CEN-CENELEC, the standard’s developer
- Standards and the EU AI Act: legitimacy, state of play, and future challenges — academic analysis of the legitimacy questions raised by delegating technical substance to standards bodies
- EN 18286 is published: the first AI Act harmonised standard, and what it does not give you yet — practitioner analysis of scope and limits