Summary
- What they are: EU-endorsed technical standards. If a provider follows a harmonised standard whose reference is published in the Official Journal (OJ), it is presumed to meet the matching AI Act requirements (Art. 40). Using them stays voluntary; providers may prove compliance another way.
- Who writes them: CEN and CENELEC, through Joint Technical Committee JTC 21 (set up June 2021), at the Commission's request.
- The request: first issued in May 2023 as C(2023)3215 (M/593). Replaced on 23 Jun 2025 by C(2025)3871 (M/613), updated to match the final AI Act text. The Commission lists ten areas: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment.
- Delays: the drafts ran late. In Oct 2025 CEN and CENELEC adopted exceptional fast-track measures (publish after a positive enquiry vote without a separate formal vote; a small drafting group to finish six of the most delayed drafts), targeting availability by Q4 2026. The original April 2025 delivery deadline is reported only by secondary sources.
- Status on 19 Oct 2026: one harmonised standard cited. Implementing Decision (EU) 2026/2274 (adopted 12 Oct, published and in force 14 Oct 2026) lists EN 18286:2026, Artificial intelligence, Quality management system for EU AI Act regulatory purposes. It gives presumption of conformity for the Art. 17 QMS requirements it covers. The other nine areas have no cited standard yet; the Commission says more are expected to follow.
Who it applies to
- Mainly providers of high-risk AI systems placing them on the EU market, including non-EU providers (the AI Act reaches them through Art. 2). Hence extraterritorial: true, inherited from the AI Act.
- Notified bodies and market surveillance authorities use them as the reference for assessments.
Key dates
- CEN and CENELEC set up Joint Technical Committee JTC 21 on AI
- First standardisation request on AI, C(2023)3215 (M/593), issued to CEN and CENELEC
- Amended request C(2025)3871 (M/613) adopted, aligned with the final AI Act text; it repeals C(2023)3215
- CEN and CENELEC Technical Boards (14 to 16 Oct) adopt exceptional measures to speed up JTC 21 drafts, aiming for Q4 2026
- prEN 18286 (AI quality management system) becomes the first AI Act harmonised standard draft to enter public enquiry
- AI Omnibus (Regulation (EU) 2026/1744) in force; high-risk dates fixed at 2 Dec 2027 and 2 Aug 2028
- Commission Implementing Decision (EU) 2026/2274 adopted, citing EN 18286:2026
- Decision published in OJ L and in force; presumption of conformity for Art. 17 QMS starts
Full date record
| Date | Event |
|---|---|
| 2021-06 | JTC 21 established |
| 2023-05 | First request C(2023)3215 (M/593) |
| 2025-06-23 | Amended request C(2025)3871 (M/613), repealing the first |
| 2025-10-14 to 2025-10-16 | CEN and CENELEC Boards adopt fast-track measures |
| 2025-10-30 | prEN 18286 enters public enquiry |
| 2026-07-27 | AI Omnibus in force; fixed high-risk dates |
| 2026-10-12 | Implementing Decision (EU) 2026/2274 adopted |
| 2026-10-14 | EN 18286:2026 reference published in OJ; presumption of conformity starts |
| 2027-12-02 | High-risk rules apply to Annex III systems |
| 2028-08-02 | High-risk rules apply to Annex I product systems |
| Not stated in the source | Dates for the remaining harmonised standards |
Penalties and enforcement
- No penalty for not using a standard. The AI Act's own fines (see EU AI Act) apply if the legal requirement is not met.
- Without a cited standard, a provider must show compliance through its own technical documentation, which a notified body or authority can challenge more easily.
What it means for an Indian company
- Indian providers selling high-risk AI into the EU (HR tech, credit scoring, edtech, biometrics) should look at EN 18286 now. The Commission says it is built around the AI system lifecycle and designed to sit on top of ISO/IEC 42001, ISO 9001 or a sector QMS rather than replace them.
- If you already hold ISO/IEC 42001, run a gap check against EN 18286 under SC-AI-039 Conformity assessment and certification readiness; 42001 alone does not give presumption of conformity.
- For the other nine areas, keep using international standards such as ISO/IEC 23894 (risk) as interim evidence, and log each new OJ citation in SC-AI-009 Regulatory applicability register and horizon scanning.
- Related controls: SC-AI-001 AI governance policy approved by the board or top management and SC-AI-019 Change management and approval gates (QMS backbone), SC-AI-005 AI risk assessment, SC-AI-032 Logging and record keeping, SC-AI-026 Human oversight and override.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when EU AI Act Harmonised Standards is done.
Glossary
- Harmonised standard: a European standard made at the Commission's request; once its reference is in the OJ it gives presumption of conformity.
- Presumption of conformity: authorities assume you comply with the covered requirement unless they prove otherwise.
- CEN-CENELEC JTC 21: the joint European committee drafting AI standards.
- Standardisation request (M/593, M/613): the Commission's formal order to the standards bodies, listing what to write.
- prEN / EN: draft European Norm / final European Norm.
- QMS: quality management system; Art. 17 of the AI Act requires one for high-risk providers.
Key takeaways
- One harmonised standard cited so far: EN 18286:2026 (AI QMS), OJ 14 Oct 2026 via Decision (EU) 2026/2274.
- The other nine requested areas have no cited standard yet; no dates are stated officially.
- The request is now M/613 (C(2025)3871, 23 Jun 2025), which repealed M/593.
- The Omnibus fixed high-risk dates (2 Dec 2027, 2 Aug 2028), so standards delays no longer shift deadlines.
Official sources
- Commission Implementing Decision (EU) 2026/2274, EUR-Lex, accessed 2026-10-19
- Commission news, 19 Oct 2026: first harmonised standard supporting the AI Act published in the OJ, accessed 2026-10-19
- Commission: Standardisation of the AI Act, accessed 2026-10-19
- Commission FAQ: Understanding the standardisation of the AI Act, accessed 2026-10-19
- Rolling Plan for ICT Standardisation 2026: Artificial Intelligence (Interoperable Europe), accessed 2026-10-19
- CEN-CENELEC news, 23 Oct 2025: decision to accelerate AI standards, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.