EN 18286 and ISO 42001: which standard you need for the AI Act
In short. Since 14 October 2026, Regulation (EU) 2024/1689 (the AI Act) has its first harmonised standard. It is EN 18286, which covers the Article 17 quality management system for providers of high-risk AI systems. ISO 42001 remains voluntary and does not grant a presumption of conformity. If your company only uses third-party AI, EN 18286 does not apply to you.
Contents
- What EN 18286 is and what changed in October 2026
- Why ISO 42001 does not grant a presumption of conformity with the AI Act
- Which standard you need depending on your role under the AI Act
- When a company that only uses AI becomes a provider
- What EN 18286 adds if you already have ISO 42001
- What EN 18286 does not solve yet
- What to do on Monday morning
- Frequently asked questions
What EN 18286 is and what changed in October 2026
EN 18286 is the European standard that turns the quality management system required by Article 17 of the AI Act into auditable requirements for anyone placing high-risk AI systems on the market.
Its official title is "Artificial intelligence — Quality management system for EU AI Act regulatory purposes". It was developed by the joint technical committee CEN-CENELEC JTC 21. Its reference was published in the Official Journal of the EU on 14 October 2026, through Commission Implementing Decision (EU) 2026/2274 of 12 October. The Decision entered into force on the day of its publication.
It is the first harmonised standard under the AI Act and, for now, the only one: the annex to the Decision contains a single entry.
According to the European Commission and committee JTC 21, a provider that applies EN 18286 benefits from a presumption of conformity with the quality management system requirements of Article 17 covered by the standard.
There is a nuance worth knowing. Article 40(1) of Regulation (EU) 2024/1689 grants a presumption of conformity, literally, with "the requirements set out in Section 2 of this Chapter", which are Articles 8 to 15. Article 17 sits in Section 3. Decision 2026/2274 refers in general terms to the requirements the standards cover. The standard includes an Annex ZA that maps each clause to the requirements of the regulation it supports, and that is where to look for the exact scope. Our reading is that the presumption applies to Article 17 to the extent that Annex ZA covers it, and that it does not extend to the other product requirements.
In one sentence: EN 18286 is the first harmonised standard under the AI Act, published in the Official Journal on 14 October 2026, and it only covers the quality management system that Article 17 requires from providers of high-risk systems.
Why ISO 42001 does not grant a presumption of conformity with the AI Act
ISO/IEC 42001 does not grant a presumption of conformity with Regulation (EU) 2024/1689 because it is not a harmonised standard: its reference does not appear in the Official Journal of the EU. It is an international management system standard, voluntary and certifiable, published by ISO in December 2023.
The Commission itself explains why it was not adopted as is. In its FAQ on AI Act standardisation, updated on 10 March 2026, it says:
"although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system that is required under the AI Act".
In other words, ISO 42001 helps you build an AI management system, but its goals and definitions do not match the quality system the regulation requires. That is why the Commission requested a new standard.
The difference lies in what each one looks at. ISO 42001 certifies how an organisation manages AI. EN 18286, according to the Commission, is built around the lifecycle of the AI system rather than around the organisation, and is designed to sit on top of ISO/IEC 42001, ISO 9001 or a sectoral system such as ISO 13485. Its informative annexes map it to ISO 9001 and ISO/IEC 42001, according to JTC 21.
What we have already published on what ISO 42001 is really for, and who shouldn't bother still holds. ISO 42001 helps you bid for public contracts, pass a large client's due diligence and organise your documentation. A presumption of conformity before the authority only comes from a harmonised standard.
Which standard you need depending on your role under the AI Act
The standard you need depends on your role under Regulation (EU) 2024/1689 far more than on your sector or size. The regulation distinguishes between the provider, who develops an AI system and places it on the market under its own name or trademark (Article 3(3)), and the deployer, who uses it under its own authority (Article 3(4)).
Article 17 only requires providers of high-risk AI systems to have a quality management system. The deployer's obligations are in Article 26: use the system according to its instructions, assign competent human oversight, monitor its operation, keep the logs automatically generated by the system for at least six months, to the extent they are under its control, and, where it is an employer, inform workers and their representatives. A quality management system is not among them.
| Your role | Does Art. 17 apply? | EN 18286 | ISO 42001 |
|---|---|---|---|
| Provider of a high-risk system (Annex III or Annex I) | Yes | The route to demonstrate Art. 17 with a presumption of conformity | A good foundation, but no presumption |
| Provider of AI that is not high-risk | No | You don't need it | Optional: clients, tenders, internal order |
| Deployer of a high-risk system | No; Art. 26 applies | Does not apply | Optional; organises the Art. 26 evidence |
| Company using general-purpose AI for support tasks | No | Does not apply | Probably not worth it yet |
Most medium-sized Spanish companies fall into the last two rows, and for them EN 18286 changes nothing. The Article 4 AI literacy requirement still applies to them, in force since 2 February 2025. So does Article 26, if they use a high-risk system. The rest of the obligations are covered in our articles on regulation.
High-risk obligations have two dates following Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. Annex III systems are subject to them from 2 December 2027. Annex I systems, linked to regulated products, from 2 August 2028. This is set by Article 113 of the consolidated text.
In one sentence: EN 18286 only affects those who develop and place on the market a high-risk AI system; companies using third-party AI remain subject to Article 4 and, if the system is high-risk, Article 26.
When a company that only uses AI becomes a provider
A company that uses an AI system becomes the provider of a high-risk system in the three cases set out in Article 25(1) of Regulation (EU) 2024/1689. From that moment, Article 17 applies to it and, with it, EN 18286.
- You put your name or trademark on a high-risk system already on the market.
- You make a substantial modification to a high-risk system and it remains high-risk.
- You change the intended purpose of a system that was not high-risk and turn it into one that is.
The third case is the one most often missed. A general-purpose model that starts being used to screen candidates or to decide access to a service can fall under Annex III without anyone having approved it as a project.
| Situation | Does it make you a provider? |
|---|---|
| You use a third party's high-risk system without modifying it, for example to screen job applications | No; you have the deployer's obligations (Art. 26) |
| You sell under your own brand a high-risk system developed by someone else | Yes (Art. 25(1)(a)) |
| You substantially modify a high-risk system you were already using | Yes (Art. 25(1)(b)) |
| You build on a general-purpose model a tool that makes decisions about people in an Annex III area | Probably yes (Art. 25(1)(c)); requires case-by-case analysis |
That is why the first step is never choosing a standard. First you need to know your role in each system you use, and that comes from an inventory. If the inventory is wrong, the role is wrong and so is the standard.
What EN 18286 adds if you already have ISO 42001
If you have an ISO 42001 system and you are the provider of a high-risk system, EN 18286 mainly adds the obligations that only exist in Regulation (EU) 2024/1689. An international standard cannot anticipate them, because they depend on European authorities and procedures.
Article 17(1) lists thirteen aspects of the quality management system, from point (a) to point (m). Some, such as risk management, data management or resource management, have an equivalent in an AI management system. Others refer to procedures of the regulation itself:
| Aspect of Art. 17(1) | What it requires | Refers to |
|---|---|---|
| Regulatory compliance strategy (point a) | Includes conformity assessment and the management of modifications | Art. 43 |
| Risk management (point g) | The regulation's risk management system | Art. 9 |
| Post-market monitoring (point h) | Collecting and analysing data from the system once in use | Art. 72 |
| Reporting of serious incidents (point i) | Reporting them to the market surveillance authority | Art. 73 |
| Communication (point j) | With national authorities, notified bodies, customers and other operators | Art. 17(1)(j) |
Size matters too. Following the Digital Omnibus, Article 17(2) requires the system to be proportionate to the size of the provider, in particular if it is an SME, a start-up or a small mid-cap enterprise. Article 63 allows SMEs, including start-ups, that have no partner or linked enterprises to comply with certain elements of the system in a simplified manner. It does not extend to small mid-cap enterprises and does not exempt them from any other obligation under the regulation, including Articles 9 to 15, 72 and 73.
In one sentence: If you already have ISO 42001 you don't start from scratch with EN 18286; what you are missing are the pieces that only exist in the AI Act: post-market monitoring, reporting of serious incidents and communication with the authorities.
What EN 18286 does not solve yet
EN 18286 does not certify that your high-risk AI system complies with Regulation (EU) 2024/1689. It covers the quality management system. The product requirements (risk management, data, logging, transparency, human oversight, accuracy, robustness and cybersecurity) still have no published harmonised standard.
According to JTC 21, EN 18286 is the first deliverable under the standardisation request, not the last. The amended request runs until 28 February 2027, and several of the core drafts are being revised after their public enquiry. Until they are published, anyone placing a high-risk system on the market has to demonstrate by their own means that the product meets those requirements.
Two uncertainties are worth stating out loud:
- There is no publication date for the remaining harmonised standards. The end of the request sets the working deadline, and it does not guarantee publication by that date.
- Spain has still not settled who supervises each case or under which penalty regime. The draft law that designated AESIA lapsed on 6 October 2026. The regulation applies regardless, but the authority before which you will rely on the presumption is pending a new law.
Nor is there a Spanish version of the standard yet. UNE is processing it as PNE-EN 18286 but has not published it, and AENOR sells EN 18286:2026 in English, French and German.
What to do on Monday morning
Three steps that don't require hiring anyone:
- Mark your role for each AI system you use: provider, deployer or neither. If you already have an AI inventory, add that column. If you don't, start there.
- Check the three cases in Article 25(1) against that inventory, paying attention to changes of purpose. That is where providers who didn't know they were providers turn up.
- If "high-risk provider" appears in any row, get EN 18286 and compare its Annex ZA with your current system, whether ISO 42001, ISO 9001 or none. If it appears in none, your priority is Article 4 and, if you use a high-risk system, Article 26. To organise that evidence without going as far as a full ISO, there is the AI Ready Seal, and what it documents is reused if you later implement ISO 42001.
Conclusions
- EN 18286 is the first and, for now, only harmonised standard under Regulation (EU) 2024/1689, published in the Official Journal of the EU on 14 October 2026.
- EN 18286 covers the Article 17 quality management system, and is only relevant to those placing high-risk AI systems on the market.
- ISO 42001 remains voluntary and does not grant a presumption of conformity with the AI Act, although it is a foundation for implementing EN 18286.
- A company that only uses third-party AI does not need EN 18286, unless it becomes a provider under one of the cases in Article 25(1).
Frequently asked questions
Is EN 18286 mandatory?
No. Harmonised standards are voluntary. What is mandatory is the Article 17 quality management system for providers of high-risk AI systems. EN 18286 is the route to demonstrate it with a presumption of conformity with the Article 17 requirements covered by the standard. Those who don't use it have to demonstrate compliance by other means.
If I have ISO 42001, do I comply with Article 17 of the AI Act?
Not automatically. ISO 42001 is not cited in the Official Journal of the EU and does not grant a presumption of conformity. The Commission states that its goals and definitions are not aligned with the regulation's quality system. Much of its evidence can be reused, but pieces such as post-market monitoring and the reporting of serious incidents are missing.
Does EN 18286 replace ISO 42001?
No. According to the Commission, it is designed to build on standards such as ISO/IEC 42001 or ISO 9001. ISO 42001 manages AI across the whole organisation. EN 18286 covers the quality system the regulation requires from providers of high-risk systems.
Does EN 18286 affect me if my company uses ChatGPT, Copilot or Gemini?
No, unless you use one of them for an Annex III high-risk purpose and become a provider under Article 25(1). For ordinary use, what applies to you is the Article 4 AI literacy requirement and your own usage policies.
Sources
- Regulation (EU) 2024/1689 (AI Act), consolidated text as of 27 July 2026: Articles 3, 4, 17, 25, 26, 40, 63 and 113. EUR-Lex.
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, OJ L series of 14 October 2026. EUR-Lex.
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI). EUR-Lex.
- European Commission: "First harmonised standard supporting the AI Act published in the Official Journal", 19 October 2026.
- European Commission: FAQ on AI Act standardisation, updated on 10 March 2026.
- CEN-CENELEC JTC 21: "EN 18286 becomes the first harmonised standard under the EU AI Act", October 2026.
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system. ISO.
Antonio Vílchez García is Compliance Manager at Montevive AI, where he leads AI governance and compliance with the AI Act, the GDPR, and alignment with the ENS and ISO 27001/42001. He holds a degree in Computer Engineering with a specialisation in Information Systems and a Master's in Business Process Management and Technologies from the University of Granada. LinkedIn
Provider, deployer or neither? If you want to work it out with us, the first conversation lasts half an hour, is free of charge, and we reply within 24 working hours: talk to us.
This article is for information purposes and does not constitute legal advice.
Get the AI Radar every Monday
The AI news that matters to your company, picked and summed up in a short email (in Spanish). Unsubscribe whenever you like.