The EU’s AI Act has been law for over two years, but businesses building AI have kept asking the same awkward question: what does “compliant” actually look like in practice? Last week Brussels started answering it. The European Commission has published the reference to the first harmonised standard supporting the AI Act in the Official Journal of the EU, through Commission Implementing Decision (EU) 2026/2274.
The standard is EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes. It sounds dry, and it is. But for anyone who builds AI tools that could end up classed as “high-risk”, it’s the first official, ready-made route to meeting part of the law, rather than guessing.
What’s actually happened
EN 18286 was written by CEN and CENELEC, Europe’s standards bodies, through their joint AI committee, JTC 21. It was first published in July 2026 as a voluntary document. What changed this month is the legal bit: once the Commission cites a standard in the Official Journal, following it gives you what’s called a “presumption of conformity”.
In plain English, if you’re a provider of a high-risk AI system and you build your quality management system on EN 18286, regulators start from the assumption that you’ve met the quality management requirements in Article 17 of the AI Act. You don’t have to argue it from scratch. As JTC 21 puts it, until now it was “a well-built voluntary document”; now it’s “a recognised route to show compliance with Article 17”.
The Commission says the standard is built around the lifecycle of an AI system rather than the organisation as a whole, and it’s designed to sit on top of standards many firms already use, such as ISO 9001, ISO/IEC 42001 (the international AI management standard) or sector-specific ones like ISO 13485 for medical devices. So if you already run one of those, you extend what you have rather than starting over.
Why it matters, and who it matters to
Most small businesses using ChatGPT to draft emails or Copilot to tidy spreadsheets won’t need to touch this. The quality management rules apply to providers of high-risk AI systems, the people who build and sell them, not everyday users.
“High-risk” has a specific meaning. According to the European Parliament, it covers AI used in areas such as biometrics, critical infrastructure, education, employment, law enforcement and border management, plus AI that acts as a safety component in products covered by EU safety law. Think CV-screening software, exam-marking tools, or AI inside machinery and medical kit.
Here in the UK, it’s easy to assume EU rules are someone else’s problem. They aren’t, if you sell into Europe. The AI Act applies to providers placing AI systems on the EU market wherever they happen to be based, so a Leeds start-up selling recruitment software to a firm in Dublin or Rotterdam is in scope just the same as a Berlin one.
The timeline has more breathing room than it did
The high-risk rules were originally due to bite in August 2026. That slipped. Under the “digital omnibus” simplification package, which the Council gave its final green light on 29 June 2026, the dates are now fixed:
- 2 December 2027 for standalone high-risk AI systems, such as those used in hiring, education or biometrics.
- 2 August 2028 for high-risk AI built into products such as lifts or toys.
A big reason for the delay was that the standards weren’t ready. EN 18286 is the first to arrive, and it won’t be the last. JTC 21 says it is still working on standards for risk management, data governance and quality, logging, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment, with the Commission’s standardisation request running until 28 February 2027.
There’s a nearer date worth knowing too. The AI Act Service Desk says providers of generative AI systems that were already on the market before 2 August 2026 have until 2 December 2026 to meet the rules on marking AI-generated content so it can be detected.
What to do now
- Work out whether you’re a provider or a user. If you only use off-the-shelf AI tools, the quality management rules aren’t aimed at you. Keep an eye on what your suppliers are doing, though, because it affects what you’re buying.
- If you build AI, check whether any use case is high-risk. Selling into hiring, education, credit, healthcare or safety-critical products is the obvious red flag.
- Don’t start from a blank page. If you already hold ISO 9001 or ISO/IEC 42001, EN 18286 includes mappings to both, so the gap may be smaller than you fear.
- Use the time sensibly. December 2027 feels a long way off, but building and documenting a proper quality system takes months, not weeks.
The balanced view
This is genuinely useful. Clear standards lower legal uncertainty and the cost of proving you’ve done things properly, and they give regulators across the 27 member states a common yardstick, which should mean fewer inconsistent decisions.
But it’s worth keeping expectations in check. The presumption is voluntary, and it covers only the quality management part of the law. The standard’s own conformity table notes that applying it “does not as such make sure that all regulatory requirements of the Regulation are fulfilled”, so you still need to check the legal requirements one by one. Standards like this also cost money to buy and time to implement, which lands harder on a five-person firm than on a multinational. And with most of the other standards still in draft, the full picture won’t be clear for a while yet.
Still, after years of “watch this space”, there’s finally something concrete on the table. If you’re building AI for European customers, EN 18286 is the place to start. If you’re just using AI at work, our look at why Microsoft says you shouldn’t blindly trust your AI agents is a more practical read, and it’s worth making sure your machines are still getting security fixes too: here’s what the end of Windows 11 24H2 support means.
Featured image: Berlaymont building, Brussels, by Kaap bij Sneeuw via Wikimedia Commons (CC0).