Article 17 of the AI Act asks providers of high-risk AI systems to keep a quality management system. The first harmonised standard for the law is about exactly that.
Fact
The facts: on 19 October 2026 the European Commission announced on its digital policy site that the reference to the first harmonised standard supporting the AI Act has been published in the Official Journal of the EU. The standard is EN 18286:2026 (Artificial intelligence - Quality management system for EU AI Act regulatory purposes), developed by CEN and CENELEC. It gives providers of high-risk AI systems a route to meet the quality management system requirements of Article 17. It was published through Commission Implementing Decision (EU) 2026/2274 and gives those who apply the standard a presumption of conformity with the covered requirements of Article 17. The standard is built around the AI system lifecycle rather than the organisation, and is designed to be layered on existing standards: ISO/IEC 42001, ISO 9001 or sectoral systems such as ISO 13485. The Commission calls it a milestone ahead of the application of the requirements for high-risk systems and says further harmonised standards are expected. The page was updated on 21 October.
A presumption of conformity sounds legal, and it means something simple. You apply the standard, and for the requirements it covers, you are presumed to have met them. Only those: for the other obligations under the AI Act, the Commission's page claims nothing like it.
The law asks for a quality system. The standard shows what one looks like.
If you already hold ISO/IEC 42001 or ISO 9001, you don't start from zero: the standard is designed to sit on top of them. In regulated sectors it explicitly allows management systems to be merged into one instead of running separately. If you don't have ISO/IEC 42001 and plan to put high-risk systems on the EU market, you can use EN 18286 either to extend the system you have or to build a new one. I am describing the Commission's announcement, not the text of the standard.
In the Commission's words, EN 18286 is the only AI quality management standard that carries a presumption of conformity. More will follow, but for now with no names and no deadline.
The visual is generated code-art, no third-party images.