EU AI Act Standards and quality management

Decision (EU) 2026/2274 cites EN 18286:2026 in the Official Journal. The Commission adopted the decision on 12 October 2026; publication and legal effect followed on 14 October. The earlier July publication announcement by the standards body did not create that legal effect.

The presumption of conformity covers only the requirements mapped by the standard.

The citation neither changes the Act's application dates nor creates a provider certification deadline. Record the applicable legal duties separately. Applying the standard does not by itself satisfy every AI Act requirement, complete conformity assessment or decide whether a notified body is required.

Annex ZA is the table linking standard clauses to legal requirements and coverage conditions. It maps the first sentence of Article 11(1) to clause 8.9.2 only if the technical file contains every Annex IV element. It does not cover all of Article 11.

For the first sentence of Article 17(1), it identifies the quality-management, leadership, planning, lifecycle and review clauses. Check and implement each legal requirement individually, using the complete table.

Coverage of the first part of Article 17(1)'s second sentence is conditional on documenting at least all aspects in Article 17(1)(a)-(m), using the clauses identified in Annex ZA. Article 17(1)(g)'s risk-management coverage is conditional on an Article 9-compliant risk management system.

Article 17(2), (3) and (4) are not covered. Assess proportionality under paragraph 2 separately, including the rigour and protection required regardless of organisational size. Where relevant, document how existing sectoral quality-management obligations accommodate Article 17 under paragraph 3, and assess the financial-institution governance provision and its exceptions under paragraph 4.

Use this selected clause map to connect Article 17 procedures to records. Copy the complete applicable mapping and conditions from Annex ZA into your own register. The record examples below are practical suggestions, not prescribed forms.

Under clauses 4-7, define the systems, intended purposes and applicable law. Assign decision authority and competent staff, set measurable quality objectives and control documents. Assess risks to the management process, such as losing records, separately from risks caused by the AI system.

During design, translate obligations into approved, verifiable system requirements. Under clause 8, connect specifications to verification and intended-purpose validation. Record test conditions, dataset and software versions, acceptance criteria and conclusions. Complete validation before market release or putting into service; link the results to current technical documentation and instructions.

For operation, apply clause 9 supplier controls, system identification, monitoring, incident escalation and corrective action. Record why a modification is or is not substantial, its risk consequences and any new assessment required. For continuous-learning systems, document predetermined changes, their validation, change logs and instructions.

Plan retirement measures and tell deployers what they must do.

Use clause 10 management reviews to examine effectiveness, monitoring results and changes in law or standards. Record decisions, resources, owners and completed changes. Review the QMS when a serious-incident investigation finds its measures inadequate.

Annexes B and C compare the standard's clause structure with EN ISO 9001:2015 and EN ISO/IEC 42001:2026. They show structural correspondence, not equivalent requirements or concepts. An ISO certificate or matching clause number cannot establish conformity with EN 18286 or the whole AI Act.

As a recommended integration method, reuse controlled documents, role assignments, supplier reviews and management meetings where they meet the specific requirement. Add the regulatory strategy and AI-system evidence that remain missing. Record the edition and scope of any existing ISO system before accepting its records.

For each system and version, record the legal requirement, standard edition, Official Journal reference and status, complete applicable Annex ZA mapping, condition, procedure owner, execution record, remaining gap and approval. Copy the mapping from the standard. Attach the Annex IV completeness check for Article 11 and the Article 9 assessment for Article 17(1)(g).

Assess Article 17(2)-(4) separately.

Use the technical-documentation and provider-evidence templates for records and the conformity assessment guide for assessment boundaries. EN 18286 alone does not establish the full Section 2 coverage needed for the Article 43 biometrics internal-control conditions; check the high-risk route selector before deciding the assessment route.

Assign an owner to review the latest Official Journal list and relevant standards changes. Annex ZA limits continued presumption to the period during which the reference remains published. Record each review, assess changed coverage and update affected procedures, system evidence and assessment decisions.