EN 18286 is published: what the first JTC 21 AI Act standard covers and what OJEU citation would add
Category Standards
Published AIAssuranceLabs
CEN-CENELEC has published EN 18286, Quality management system for EU AI Act regulatory purposes, recorded in the standards data as prEN 18286Published and the first JTC 21 deliverable to reach publication. The standard supplies the clause structure of the quality management system that Art. 17(1) requires. The reference of EN 18286, published, is not cited in the Official Journal, so no presumption of conformity attaches under Art. 40(1). A provider uses the published standard now as the reference for a gap analysis and names it in the Art. 17(1)(e) list of standards applied.
What the source says
The CEN-CENELEC announcement recorded as the source of the prEN 18286Published entry states that EN 18286 is published and that it "specifies the requirements and provides guidance for the definition, implementation, and maintenance of a quality management system for organizations that provide AI systems". The announcement calls the standard sector-neutral, names Art. 17 as the article it supports, and describes the content as a framework for governance, life cycle control, documentation and consistency in how AI systems are developed and maintained. The standards entry adds that the clauses name the records, procedures and lifecycle controls a QMS audit checks, and that an Annex ZA maps the clauses to the Act.
The four areas land on the thirteen aspects of Art. 17(1) as follows. Governance answers the accountability framework in Art. 17(1)(m) and the strategy for regulatory compliance in Art. 17(1)(a). Life cycle control answers the design, development and test procedures in Art. 17(1)(b), (c) and (d). Documentation answers the written policies, procedures and instructions of Art. 17(1) and the record-keeping in Art. 17(1)(k). Consistency answers the quality control and quality assurance actions in Art. 17(1)(c). The announcement prints no clause list; the clause-by-clause mapping sits in Annex ZA of the standard, and the Art. 17 obligation page lists each aspect with its split into testable, documentation and process elements.
The announcement places EN 18286, published, among a suite of JTC 21 documents for risk management, cybersecurity and logging; the stage of each comes from the standards data.
| Area named by the source | Document | Article | Stage |
|---|---|---|---|
| Quality management system | prEN 18286Published | Art. 17 | Published, not cited in the Official Journal |
| Risk management | prEN 18228Enquiry | Art. 9 | Enquiry |
| Cybersecurity | prEN 18282Enquiry | Art. 15 | Enquiry |
| Logging | prEN 18229-1Enquiry and prEN ISO/IEC 24970Approval | Art. 12 | Enquiry and approval |
Publication by CEN-CENELEC and citation by the Commission are two separate steps. Art. 40(1) of Regulation (EU) 2024/1689 attaches a presumption of conformity to a harmonised standard whose reference the Commission has published in the Official Journal under Regulation (EU) No 1025/2012, and none is cited as of the anchor date
Verified on last full verification run, see the change log
. The presumption reaches the requirements in Chapter III Section 2, which are Art. 8 to 15, and the obligations in Chapter V Sections 2 and 3, to the extent the cited standard covers them. Art. 17 sits in Section 3, so what a citation of EN 18286, published, would add to the quality management system follows from the extent to which its clauses cover Section 2 requirements, and the article text gives no further rule. Art. 41(1) lets the Commission adopt common specifications where a request is not accepted or a requested standard is not delivered, does not comply with the request or does not address fundamental rights concerns; Art. 41(3) attaches the same presumption to those specifications. The JTC 21 documents answer standardisation request M/613; the standards page shows the request and the citation status of every entry.What changes for a provider or deployer
Nothing in the obligation moved. Art. 17(1) requires the same written policies, procedures and instructions for aspects (a) to (m) as before publication, from the Annex III application date Deferred for a system classified under Art. 6(2) and from the Annex I date Deferred for a system under Art. 6(1). What changed is the reference a provider can name. Art. 17(1)(e) asks for the list of technical specifications and standards applied and, where harmonised standards are not applied in full or do not cover a Section 2 requirement, the means used for that requirement; with no reference cited, the list names EN 18286 as a published standard applied, states that no harmonised standard is cited, and gives the means for every Section 2 requirement. A published standard is evidence for the method a provider chose, and Art. 17 makes no standard a requirement.
Three consequences would follow a citation, each from the article that carries it. First, the presumption under Art. 40(1) would attach to the extent stated above. Second, under Art. 43(1) a provider of an Annex III point 1 system that has applied the cited standards in full may choose between internal control under Annex VI and the notified body route under Annex VII; where harmonised standards are applied in part or do not exist and no common specifications are available, Art. 43(1) keeps that provider on Annex VII. Third, the Art. 17(1)(e) statement of means would shrink to the Section 2 requirements the citation does not cover. Until then the list carries the full statement, and the evidence rests on the records.
The record set is what a gap analysis produces now. PR-17-QMS v1.0 maps each Art. 17(1) aspect to the clause of each published management-system standard, samples the records behind the eight testable elements of the article, and classifies each row of the gap register as conforms, partial, gap or not applicable with an evidence id. The classified register is delivered as the findings register, with the QMS gap analysis report, the corrective-action plan and the internal audit preparation checklist as the other protocol outputs. The QMS gap analysis service runs the protocol within the limits at what we cannot do; the outputs are evidence for the provider's own verification under Annex VI point 2 or for a notified body's assessment under Annex VII section 3, and the decision whether the system meets Art. 17 remains with the provider, their notified body where one is required, and their counsel. The clause crosswalk to ISO/IEC 42001:2023Published, published, is in the guide on ISO/IEC 42001 and Art. 17; neither document is cited in the Official Journal.
What to do now
- Add EN 18286, published, to the Art. 17(1)(e) list of technical specifications and standards applied, with its citation status as shown from the standards data and the means used for each Section 2 requirement.
- Map each Art. 17(1) aspect (a) to (m) to a clause of the standard, or mark it as having none, following the clause-map step of PR-17-QMS v1.0.
- Sample the records behind the eight testable elements on the Art. 17 obligation page, from the modification record per version to the role walk-through of the accountability framework.
- Record the proportionality rationale under Art. 17(2) and, where claimed, the SME status without partner or linked enterprises under Art. 63(1), as amended by Regulation (EU) 2026/1744.
- Check the standards page for the citation status before each conformity assessment step; the Art. 43(1) route choice for an Annex III point 1 system and the Art. 17(1)(e) statement both change on citation.
Related pages
The obligation, protocol, guides, service and hubs this post rests on.
- Obligations
- Protocols
- Guides
- Services
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.