Regulation (EU) 2024/1689 (the “AI Act”) is the European legislation governing the development and use of Artificial Intelligence systems within the European Union, imposing stricter obligations the more a system is considered to pose a risk to people. In fact, systems defined as “high-risk” must comply with specific requirements, including the adoption of a quality management system and the ongoing monitoring of the system’s operation even after it has been placed on the market. The practical problem that had arisen until now was that the law set out these objectives in general terms, without specifying a single, shared technical standard that would allow businesses to understand with certainty how to organize themselves to comply: each business therefore had to interpret the legal obligations for itself and demonstrate compliance on a case-by-case basis, entailing significant uncertainty and costs. Article 40 of the AI Act provides for a simplification mechanism known as the “presumption of conformity”, whereby compliance with a harmonized standard published in the Official Journal of the European Union (“OJEU”), automatically confers a presumption of conformity with the corresponding essential requirements of EU harmonization legislation, without the company having to demonstrate this independently on a case-by-case basis. This rule is effective since the 2^nd of August 2026.

The technical standard does not create a separate regime nor does it impose any additional obligations beyond those already set out in the AI Act, which remains the relevant legal framework; rather, its purpose is to provide a standardized and recognized framework for demonstrating compliance with obligations that already exist, thereby making implementation more predictable and internal processes more structured. These technical standards are drawn up by CEN (European Committee for Standardization) and CENELEC (European Committee for Electrotechnical Standardization), two independent technical bodies commissioned by the European Commission. By an Implementing Decision of 23 June 2025, the Commission had tasked CEN and CENELEC with developing a series of technical standards to support the AI Act, including one specifically dedicated to quality management systems for suppliers of high-risk AI systems, covering post-market monitoring processes. By Implementing Decision (EU) 2026/2274 of 12 October 2026, the Commission ordered the publication in the OJEU on 14 October 2026, the Commission ordered the publication of the reference to the harmonized standard EN 18286:2026, entitled “Artificial Intelligence, Quality management system for the purposes of the regulatory requirements of the EU AI Regulation”. The primary target audience for this standard is suppliers of high-risk AI systems, namely companies that develop such systems and place them on the market; for these entities, the standard is specifically aimed at the business functions responsible for quality, regulatory compliance, product management and, in particular, monitoring of the system once it is already on the market.

Whereas Implementing Decision (EU) 2026/2274 and the underlying primary law which provided for it (i.e. Article 40 of the AI Act) are already effective, the rules on the mandatory set-up of a quality management system for High-Risk AI will apply from 2 December 2027 for systems falling under Annex III of the AI Act, and from 2 August 2028 for systems falling under Annex I. Therefore, in principle, the presumption of conformity for businesses that bring their High-Risk AI Systems into line with the harmonized standard should already apply; however, the underlying obligation to set up such a system as part of a compliance effort under the AI Act is not yet applicable. Despite this misalignment, it could nonetheless be useful to start working towards implementation of the harmonized standard, particularly for High-Risk AI systems that are going to be placed on the market or put into service over the next 15 months, as such implementation will take time and may extend beyond the deadline set for the application of the AI Act’s provisions on high-risk AI systems.