EN 18286
The first European standard published to support the EU AI Act. It exists, you can buy it, and it does not yet give anyone a presumption of conformity.
EN 18286 is the European standard for a quality management system for EU AI Act regulatory purposes. CEN-CENELEC ratified it on 12 July 2026. Because its reference has not yet appeared in the Official Journal, conformity with it does not yet carry the presumption of conformity that Article 40 provides.
Two things happened this summer that get reported as one, and the difference between them decides whether the standard is worth anything to you legally yet.
What it is
EN 18286 is titled Artificial intelligence. Quality management system for EU AI Act regulatory purposes. It was developed by CEN-CENELEC's technical committee JTC 21, and it is built around the quality management system the Act requires of providers of high-risk AI systems at Article 17.
CEN-CENELEC ratified it on 12 July 2026, describing it as the first European standard developed to support the implementation of the EU AI Act (CEN-CENELEC on the publication of EN 18286). BSI has published it in the UK as BS EN 18286:2026 (BSI on BS EN 18286:2026).
How to get a copy
You buy it from a national standards body. CEN-CENELEC agrees the text, and its national members publish and sell it in their own countries.
In the UK that is BSI, which lists BS EN 18286:2026 as current with a publication date of 31 July 2026 (BS EN 18286:2026 at BSI Knowledge). In other European countries the national body publishes an identical national version, and those national adoptions are due by January 2027 (Intertek on EN 18286). Whichever version you buy, the technical content is the same.
Published is not the same as cited
This is the distinction the reporting tends to lose, and it is the whole of the practical position.
Publishing a European standard is something CEN-CENELEC and the national bodies do. Citing one in the Official Journal of the EU is something the European Commission does, separately and afterwards. Only the second turns a standard into a harmonised standard for legal purposes: Article 40 gives a presumption of conformity to systems that conform to harmonised standards whose references have been published in the Official Journal.
EN 18286's reference has not been published there. CEN-CENELEC's own note says the Commission is expected to publish it later in 2026 (CEN-CENELEC on the publication of EN 18286). Until that happens, an organisation conforming to the standard is well prepared, and cannot point at Article 40 and claim anything from it.
Why you may see a 2027 date attached to it
European standards carry two dates and they are easy to mix up. The date of ratification is when CEN-CENELEC approved the text, which for EN 18286 was 12 July 2026. A later date, usually around six months afterwards, is the deadline by which every national standards body has to publish an identical national standard and withdraw any conflicting ones.
That second date is an administrative deadline for the national bodies, not a sign that the standard is still pending. BSI met it within a fortnight. If you see a 2027 date next to EN 18286, that is what it refers to, and it says nothing about whether the standard exists or when the Official Journal citation might come.
How it sits next to ISO 42001
They do different jobs and neither replaces the other. ISO/IEC 42001 is an international management system standard for governing AI across an organisation, and an accredited body can certify you against it (ISO/IEC 42001:2023). EN 18286 is European, and it is written around a specific legal requirement in a specific regulation.
CEN-CENELEC's own framing is that EN 18286 complements other standards and technical specifications covering areas such as risk management, data governance, transparency, cybersecurity, accuracy and post-market monitoring (CEN-CENELEC on the publication of EN 18286). That is worth taking at face value: it is the quality management layer, not a whole governance system.
If you already run an ISO 42001 management system, you extend it to meet EN 18286. You do not start again. The standard's own introduction encourages building on an existing management system, and Annexes B and C set out how its clauses correspond to ISO 9001 and ISO/IEC 42001 (Intertek on EN 18286). That makes an honest view of where your ISO 42001 position stands today a sensible first step, and the ISO 42001 readiness check gives you one theme by theme.
None of this changes the position on certification. The EU AI Office determined in May 2024 that ISO 42001 is not fully aligned with the Act and is not part of its harmonisation process (Cloud Security Alliance research note on prEN 18286), so an ISO 42001 certificate remains useful evidence of good governance and not a route to compliance. The standard-versus-Act guide works through that in full.
What is coming, and what to do now
EN 18286 is the first and so far the only European standard published in support of the Act. Further standards covering other obligations under it are in development at JTC 21.
For most organisations there is nothing urgent here. If you provide a high-risk AI system, or expect to, the standard is now readable and is the clearest available statement of what the Act's quality management duty is taken to mean in practice, which makes it useful for preparation whatever the Official Journal does next. If you are a deployer rather than a provider, this one is not aimed at you, and the risk assessment guide covers which duties are. The EU AI Act check works out which role you hold for each system.
The thing to watch for is the citation, not another publication announcement. At the start of October 2026 the reference had still not appeared in the Official Journal (Intertek on EN 18286). When it does, the legal position changes and this page changes with it.