The AI Act’s first standard is here: what your buyers should require

On 19 October 2026, the European Commission published in the Official Journal the reference of the AI Act’s first harmonised standard: EN 18286, “Artificial Intelligence — Quality Management System for EU AI Act Regulatory Purposes”, cited by Implementing Decision (EU) 2026/2274. One line in the Official Journal, but a concrete change for anyone who buys or builds a high-risk AI system.

What the standard says

EN 18286 describes the quality management system that a provider of a high-risk AI system must put in place under Article 17 of the AI Act: compliance policy, design control, testing and validation, data management, post-market monitoring, incident reporting, responsibilities.

Its legal value comes down to one phrase: presumption of conformity. A provider that applies a harmonised standard cited in the Official Journal is presumed to meet the requirements it covers. It no longer has to prove on its own, point by point, that its organisation satisfies Article 17.

What it does not say

• It covers one area out of ten. The Commission asked the European standardisation bodies (CEN and CENELEC, committee JTC 21) for standards on ten topics: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. Nine are still to come.
• It does not replace ISO/IEC 42001. The international AI management system standard remains a good foundation, but it is not cited in the Official Journal and therefore gives no presumption of conformity with the AI Act.
• It does not bring the deadline forward. Obligations for Annex III high-risk systems apply on 2 December 2027. The standard simply marks out a path to get there.

Why buyers are concerned

The obligation falls on providers. But the buyer chooses the provider, and lives with the system long after 2027. A published standard changes the conversation: the question is no longer “are you compliant?”, to which everyone answers yes, but “do you apply EN 18286, and can you show it?”.

What to require in your next tenders

1. A statement: does the provider apply EN 18286, fully or partly, and since when?
2. Evidence: quality manual, testing and validation procedures, post-deployment monitoring plan.
3. A commitment to follow the nine standards to come, with a compliance timeline.
4. An audit right over the quality system, not just the product.
5. A reporting clause for serious incidents, with a deadline, towards you and not only towards the authority.

A published standard turns a compliance promise into a question you can check. Ask it.

The question to ask on Monday morning

To your procurement team: “Do our next three tenders involving AI ask the provider whether it applies EN 18286, and with what evidence?”