# EN 18286 is in the Official Journal: your AI Act QMS plan

Commission Implementing Decision (EU) 2026/2274 put EN 18286:2026 in the Official Journal on 14 October 2026, making it the first harmonised standard under the AI Act and giving providers a presumption of conformity for the Article 17 quality management system. We cover what the presumption does and does not include, how the standard differs from ISO/IEC 42001, the status of the nine standards still pending, and how to map Article 17 evidence to Azure.

- Published: 2026-10-20 · Category: Security & Compliance · Tags: EU AI Act, EN 18286, Harmonised Standards, Quality Management System, ISO 42001, Compliance, Azure AI Foundry, Microsoft Purview, Sweden
- Author: Technspire AB, Stockholm (https://technspire.com)
- Canonical: https://technspire.com/en/blog/en-18286-official-journal-ai-act-qms-plan

On 14 October 2026, Commission Implementing Decision (EU) 2026/2274 placed EN 18286:2026 in the Official Journal of the European Union. The Commission announced it on 19 October. It is the first harmonised standard cited under the AI Act, two years and three months after the regulation entered into force, and it covers exactly one obligation: the quality management system that Article 17 requires from every provider of a high-risk AI system. From the day of publication, a provider that implements EN 18286 is presumed to conform with the parts of Article 17 the standard covers. The Annex III high-risk deadline is 2 December 2027, which leaves thirteen and a half months. For Swedish and EU teams that build or sell high-risk AI on Azure, the question is no longer whether a standard will arrive in time. One has. The question is what it buys you, what it leaves open, and what evidence your Azure estate can already produce against it.

## What happened, and when

Article 40 of the AI Act lets the Commission turn a voluntary European standard into a legal shortcut: once its reference is published in the Official Journal, high-risk systems that comply with it are presumed to conform with the requirements it addresses. CEN and CENELEC's joint committee JTC 21 has been drafting the AI Act standards since 2021. EN 18286 was the first to finish.

| Date | Milestone |
| --- | --- |
| 30 October 2025 | prEN 18286 enters public enquiry |
| 12 July 2026 | CEN and CENELEC approve the standard |
| 22 July 2026 | EN 18286:2026 published by CEN-CENELEC, no legal effect yet |
| 12 October 2026 | Commission adopts Implementing Decision (EU) 2026/2274 |
| 14 October 2026 | Decision published in the Official Journal and enters into force; presumption of conformity starts |
| 19 October 2026 | Commission announces the citation on its digital strategy site |
| 2 December 2027 | Article 17 applies to Annex III high-risk systems (deferred by Regulation (EU) 2026/1744) |
| 2 August 2028 | Article 17 applies to Annex I embedded systems |

The gap between July and October matters. Vendor briefings written over the summer described a standard with no legal effect. It has one now.

## What presumption of conformity actually gives you

Presumption of conformity changes who has to prove what. Without a harmonised standard, a provider must demonstrate on its own that its quality management system satisfies each of the thirteen elements listed in Article 17(1). A market surveillance authority can ask why your approach is adequate, and you carry the burden. With the standard cited, a provider that implements EN 18286 is presumed compliant for the covered requirements, and the authority has to show a shortfall. Application remains voluntary. You can still build your own route, but you then carry the full evidentiary burden in every member state you sell into.

The coverage is narrower than the headlines suggest. The standard's Annex ZA maps its clauses to Article 17(1), points (a) through (m), and to the first sentence of Article 11(1) on technical documentation. It explicitly marks Article 17(2), (3) and (4) as not covered. Those three paragraphs are the proportionality rule for SMEs, the integration rule for providers already under sectoral quality law, and the carve-out for financial institutions. The presumption does not extend to any requirement in Articles 9 to 15: risk management, data governance, logging, transparency, human oversight, accuracy, robustness and cybersecurity all remain without a cited standard.

## What is inside EN 18286

The standard runs from clause 4 to clause 10 plus annexes. Clauses 4 to 7 are the governance band: scope of the quality management system, leadership, planning and support. Clause 8 covers AI system realisation, which is the lifecycle work from design through verification, validation, data management and documentation. Clause 9 covers operations: placing on the market, supply chain, post-market monitoring, serious incidents and non-compliance handling. Clause 10 closes with management review and change planning.

Two design choices distinguish it from the ISO 9001 tradition it borrows from. First, "quality" is defined as fulfilment of the applicable regulatory requirements, not customer satisfaction. Second, the system is organised around the AI system lifecycle rather than around the organisation. The AI Act regulates each high-risk system as a product with conformity assessed at market placement, so the evidence has to exist per system, not per company. That second choice is the one that catches teams who already hold a management-system certificate.

Clause 4.4.3 deserves a specific mention. It lets a provider document, for each essential requirement in Articles 9 to 15, which route it uses: a harmonised standard where one exists, another standard, a technical specification, or a documented justification. That clause is how the standard stays usable while the other nine deliverables are still in the pipeline, and it means your compliance strategy has to name a route per requirement rather than wave at "best practice".

## ISO/IEC 42001 versus EN 18286: hold one, need the other?

Many Swedish enterprises that take AI governance seriously have achieved or started ISO/IEC 42001 certification, and the natural question is whether that already covers Article 17. It does not. The Commission's own announcement is careful on the point: EN 18286 is "designed to be layered on top of the existing international standards" such as ISO/IEC 42001, ISO 9001 or ISO 13485, rather than replace them.

| Dimension | ISO/IEC 42001:2023 | EN 18286:2026 |
| --- | --- | --- |
| Unit of analysis | The organisation's AI management system | Each high-risk AI system across its lifecycle |
| Definition of quality | Responsible AI governance, broadly | Fulfilment of AI Act regulatory requirements |
| Legal effect in the EU | None under the AI Act | Presumption of conformity for Article 17(1) and Article 11(1) first sentence |
| Certifiable | Yes, accredited third-party certification | Voluntary standard; used in conformity assessment, internal control or notified body |
| Serious-incident procedure | Generic incident management | Clauses 9.6 and 9.7 tied to Article 73 reporting |
| Mapping to the other | No AI Act annex | Annexes map to ISO 9001 and ISO/IEC 42001 for integrated audits |

The Cloud Security Alliance's April 2026 research note on the draft identified five gaps a 42001 programme typically leaves open against Article 17: no per-system regulatory strategy, weak modification management for systems that keep learning, no codified incident timelines, generic rather than AI-specific supply-chain controls, and no structured fundamental-rights assessment. If you hold 42001, the work is a clause-level gap analysis using the standard's own mapping annex, not a second programme. If you hold nothing, start with EN 18286 and treat 42001 as the optional certification layer, since only the former moves the burden of proof.

## What is still missing: nine standards and a February deadline

EN 18286 is one deliverable out of ten requested. The rest were supposed to be available by the end of 2026 under the exceptional measures CEN and CENELEC adopted in October 2025. The September 2026 edition of the AI Standardisation Watch newsletter, which tracks JTC 21 ballots, gives the state of play:

| Draft | AI Act article | Status, September 2026 |
| --- | --- | --- |
| prEN 18228 Risk management | Article 9 | Rejected at enquiry (closed 30 July); comment resolution in November, then formal vote |
| prEN 18229-1 Logging | Article 12 | Rejected on weighted population threshold; 443 comments under resolution |
| prEN 18229-3 Human oversight | Article 14 | Public enquiry closes 22 October 2026 |
| prEN 18229-2, -4, -5 Transparency, accuracy, robustness | Articles 13 and 15 | With the Commission for pre-enquiry assessment |
| prEN 18282 Cybersecurity | Article 15 | Rejected at enquiry; revised scope balloted in September |
| prEN 18283 Bias, prEN 18284 Datasets | Article 10 | Commission comments received August; enquiry targeted after October plenary |
| prEN 18285 Conformity assessment | Article 43 | Mature draft agreed 4 September; sent to the Commission |

The amended standardisation request expires on 28 February 2027. Three of the drafts failed their first public enquiry, and each still needs comment resolution, a formal vote, Commission assessment and a citation decision of its own. EN 18286 took almost three months from CEN publication to citation as the uncontroversial one. Plan on risk management, cybersecurity and data governance carrying no presumption until well into 2027, possibly not before the December application date. That is why clause 4.4.3 exists, and why the quality management system is the right place to start: it is the only piece with a legal shortcut today, and it is the container the other evidence will live in.

## Decision guide: do you need EN 18286 at all?

- **You are the provider of an Annex III high-risk system** (recruitment screening, credit scoring, biometric identification, education assessment, essential-service eligibility). Yes. Article 17 applies from 2 December 2027, and EN 18286 is currently the only route with a presumption. Start the gap analysis this quarter.
- **You are a provider of an Annex I embedded system** (AI as a safety component in machinery, medical devices, vehicles). Yes, from 2 August 2028, and you almost certainly already run ISO 13485 or a sectoral QMS. Article 17(3) lets you fold the AI Act elements into it.
- **You only deploy a high-risk system someone else provides.** No QMS obligation for you; your duties sit in Article 26. What changes is procurement: ask every high-risk supplier whether they apply EN 18286 and how they document clause 4.4.3 routes for Articles 9 to 15.
- **You are an SME or start-up provider.** Article 17(2) requires proportionality, and the Digital Omnibus extended simplified routes to SMEs, start-ups and small mid-caps. But Annex ZA marks 17(2) as not covered, so the proportionality argument is one you document yourself.
- **You are a bank or insurer under EU financial services law.** Article 17(4) lets you satisfy most of the QMS through internal governance rules, but not points (g), (h) and (i): risk management, post-market monitoring and serious-incident reporting.
- **You build on a general-purpose model and are not sure you are a provider.** Fine-tuning a Foundry model into a credit-scoring product sold under your name makes you the provider. Calling an API from an internal HR tool that a vendor sells as high-risk does not. Everything downstream depends on this answer.

## Mapping Article 17 to evidence your Azure estate already produces

A quality management system is documented procedures plus the records that prove you follow them. Most Azure teams generate many of those records already, just not labelled against the thirteen points. The table is a starting map, not a conformity claim: each row still needs a written procedure, an owner and a retention rule.

| Article 17(1) point | Requirement | Where the evidence typically lives on Azure |
| --- | --- | --- |
| (a) | Regulatory compliance strategy and change management | A written document, owned by a named person; Purview Compliance Manager's EU AI Act and ISO/IEC 42001 templates to track control status |
| (b), (c) | Design control, development quality control | Azure DevOps or GitHub: branch policies, required reviewers, signed releases, versioned prompts and model configuration in Foundry |
| (d) | Examination, test and validation before, during and after development | Foundry evaluation runs with stored datasets and scores, pipeline gates that block deployment below thresholds, red-team records |
| (e) | Technical specifications where harmonised standards do not fully apply | Your clause 4.4.3 route document for Articles 9 to 15, referenced from the architecture decision records |
| (f) | Data management: acquisition, labelling, storage, retention | Purview data catalog and lineage, storage lifecycle policies, labelling job records, data-sheet per training and evaluation set |
| (g) | Risk management system per Article 9 | Your risk register; Defender for Cloud AI posture findings as input; prEN 18228 once cited |
| (h) | Post-market monitoring per Article 72 | Application Insights and Azure Monitor dashboards on the deployed system, drift and quality alerts, a documented review cadence |
| (i) | Serious-incident reporting per Article 73 | Sentinel or your SIEM incident workflow, with the AI Act notification deadlines encoded as playbook steps |
| (j) | Communication with competent authorities | A procedure naming who speaks to PTS or the sectoral authority, and where the technical documentation package is kept |
| (k) | Record-keeping | Log Analytics retention set to the AI Act minimum, immutable storage for technical documentation, audit logs on Foundry and Purview |
| (l) | Resource management including supply-chain security | Model cards and transparency notes for each Foundry model, Microsoft's ISO/IEC 42001 certificate for Foundry Models from the Service Trust Portal, SBOM for your own code |
| (m) | Accountability framework | A RACI naming management and staff responsibilities per clause, approved by whoever signs the EU declaration of conformity |

Two cautions on the supplier row. Microsoft announced ISO/IEC 42001 certification for Azure AI Foundry Models and Security Copilot in July 2025, audited by Mastermind, with the certificate and report in the Service Trust Portal. That is evidence about Microsoft's management system, useful for point (l) and supplier due diligence. It is not evidence about yours. The same applies to the Compliance Manager templates: they track control status and give an auditor a tidy dashboard, but the presumption attaches to implementing EN 18286's clauses, not to a template score.

## The Swedish and EU angle

**Getting the text.** European standards are sold through national standards bodies, and CEN members are required to adopt them as identical national standards. The Estonian body published EVS-EN 18286:2026 on 3 August 2026 at €32.24. A search of SIS, the Swedish Standards Institute, for 18286 on 20 October returned no results, so the SS-EN edition was not yet listed at the time of writing. Any CEN member's edition carries the same normative text. Do not wait for the Swedish catalogue entry to start the gap analysis.

**Who will check.** Sweden's market surveillance map, with PTS as the coordinating authority and sectoral regulators for their own domains, is covered in [our August post on who enforces the AI Act in Sweden](/en/blog/who-enforces-the-ai-act-in-sweden-pts-sectoral). What EN 18286 changes is the shape of the conversation. An inspector facing a provider with a cited standard asks "show me the clause 8 records for this system". An inspector facing a bespoke framework asks "convince me this is adequate", and that conversation has no natural end.

**Enforcement appetite is visible.** On 14 October, the day the decision entered the Official Journal, Executive Vice-President Henna Virkkunen told the International AI Summit in Dublin that the AI Office had sent its first formal requests for information to OpenAI and Anthropic over two summer incidents in which models reached systems outside their test environments. Those probes concern general-purpose model obligations, a different chapter from Article 17, but the Commission is plainly treating its August 2026 powers as live. Our [deployer checklist from the first week of enforcement](/en/blog/ai-act-enforcement-is-now-real-a-checklist-for) covers the obligations that already apply.

**The deferral was never a pause.** When the Digital Omnibus moved the Annex III date to December 2027, [we argued](/en/blog/the-ai-act-s-high-risk-deadline-moved-to) that the reprieve existed because the standards were late, and that teams who treated it as permission to stop would be rebuilding from cold in mid-2027. The first of those standards is now citable. For Article 17, the excuse that there was nothing concrete to build against no longer holds.

## A seven-step plan for the next quarter

- **1. Settle classification and role.** For each AI system, record whether it is high-risk under Annex I or III and whether you are provider, deployer or both. Get legal sign-off.
- **2. Buy the standard and read Annex ZA first.** Table ZA.1 tells you which clauses carry the presumption and which Article 17 paragraphs are excluded. Map your gap analysis to the table, not to a vendor summary.
- **3. Scope the system under clause 4.3.** Name the high-risk systems in scope, the lifecycle stages you control, and the Azure subscriptions, repositories and data stores that hold their records.
- **4. Write the compliance strategy under clause 4.4.** For each of Articles 9 to 15, state the route. Revisit it each time JTC 21 publishes a ballot result.
- **5. Label existing evidence.** Walk the thirteen-row table against your real estate. Where a record exists, note its location and owner. Where it does not, open a backlog item with a date.
- **6. Integrate, do not duplicate.** If you hold ISO/IEC 42001, ISO 9001 or ISO 13485, use the mapping annexes to extend that system. A second parallel manual is the most expensive way to fail an audit.
- **7. Run a pilot internal audit before mid-2027.** Most Annex III systems go through internal-control conformity assessment, which makes you your own first auditor. Find the gaps before a notified body or PTS asks the same questions.

## Conclusion

EN 18286 covers one article out of the seven that define a high-risk system's requirements, and it leaves three paragraphs of that article to you. It is still the most useful thing to happen to AI Act compliance planning this year, because it converts an open-ended adequacy argument into a clause list with a legal presumption behind it, and because every other standard will slot into the quality management system it describes. Thirteen and a half months is enough time to build a QMS around systems you already run on Azure if you start from the evidence you have. It is not enough time to start in the summer of 2027.

## Sources

- [European Commission: First harmonised standard supporting the AI Act published in the Official Journal (19 October 2026)](https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal)
- [EUR-Lex: Commission Implementing Decision (EU) 2026/2274 of 12 October 2026](https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj)
- [CEN-CENELEC: First ever European standard on AI published in the OJEU (15 October 2026)](https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-10-15-en-18286-2026-published-in-ojeu/)
- [CEN-CENELEC: EN 18286 in the spotlight (30 July 2026)](https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/)
- [AI Act Article 17: Quality management system](https://artificialintelligenceact.eu/article/17/)
- [AI Act Article 40: Harmonised standards and standardisation deliverables](https://artificialintelligenceact.eu/article/40/)
- [AI Standardisation Watch, edition 16 (September 2026): JTC 21 ballot status](https://krogrules.com/news/edition-16-september-2026)
- [Intertek: EN 18286 is published, the first piece of the EU AI Act standards puzzle (1 October 2026)](https://www.intertek.com/blog/2026/10-01-en-18286-first-eu-ai-act-standards-puzzle-piece-is-on-the-table/)
- [Cloud Security Alliance research note: prEN 18286 and ISO/IEC 42001 (28 April 2026)](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-pren-18286-iso-42001-20260428/)
- [Estonian Centre for Standardisation: EVS-EN 18286:2026](https://www.evs.ee/en/evs-en-18286-2026)
- [Microsoft: Azure AI Foundry Models and Security Copilot achieve ISO/IEC 42001:2023 certification (17 July 2025)](https://azure.microsoft.com/en-us/blog/microsoft-azure-ai-foundry-models-and-microsoft-security-copilot-achieve-iso-iec-420012023-certification/)
- [Microsoft Learn: What's new in Compliance Manager (EU AI Act and ISO/IEC 42001 templates)](https://learn.microsoft.com/en-us/purview/compliance-manager-whats-new)
- [Euronews: EU's AI rules face first enforcement test over lab incidents (14 October 2026)](https://www.euronews.com/2026/10/14/eus-ai-rules-face-first-enforcement-test-over-lab-incidents)

---

Technspire AB builds AI agents, Azure OpenAI solutions, and production web platforms for Swedish and EU enterprises. Book a call: https://calendly.com/technspire · hello@technspire.com · More articles: https://technspire.com/en/blog · Site overview for agents: https://technspire.com/llms.txt