Standards tracker

Tracker

The table groups entries by issuing body. The stage pill and the verified-on stamp on each row render from data/standards.json; the stamp links to the source the entry was checked against. The "Articles" column links each document to the obligation it supplies material for.

How stages are read

Each entry carries one of five stages. The stage sets what an assessor can take from the document.

• Draft. The committee is writing the text and no public version exists, so an assessor can rely only on the announced title and scope, as with prEN 18229-2Draft.
• Enquiry. The draft is open for public comment through the national standards bodies, so an assessor can read the candidate requirement structure while expecting the clauses to change, as with prEN 18228Enquiry.
• Approval. The text is in its final vote, so an assessor can treat the requirement structure as close to final and prepare test procedures against its clause topics, as with prEN ISO/IEC 24970Approval.
• Published. The issuing body has released the document, so an assessor can cite clause numbers and method definitions, while the document carries no effect under Regulation (EU) 2024/1689 on its own, as with prEN 18286Published.
• Cited in OJEU. The Commission has published the reference of the standard in the Official Journal under Art. 40, and none of the entries has reached this stage as of the anchor date.

Art. 40(1) gives a high-risk AI system that conforms to harmonised standards whose references the Commission has published in the Official Journal a presumption of conformity with the Chapter III Section 2 requirements those standards cover, and no such reference is cited in the Official Journal as of the anchor date. Until a citation appears, a provider tests against the draft standards and the ISO/IEC references in the table and justifies each threshold against the state of the art, as the threshold note on every obligation page states, for example on Art. 15.

The JTC 21 entries are the deliverables under the Commission's standardisation request M/613 to CEN and CENELEC. The standardisation request M/613 expiry recorded in the data marks the date by which the request asks for the deliverables; the request itself creates no obligation for a provider, and the Commission decides which deliverables it cites.

What each body supplies to testing

CEN-CENELEC JTC 21 drafts the requirements that the future harmonised standards will carry. prEN 18286Published gives the structure of an Art. 17 quality management system, with an Annex ZA mapping to the Act. prEN 18228Enquiry sets out the risk identification, estimation, evaluation and mitigation steps of an Art. 9 risk management system. prEN 18229-1Enquiry and prEN ISO/IEC 24970Approval name the events and fields an Art. 12 log records. prEN 18229-2Draft, prEN 18229-3Draft, prEN 18284Draft, prEN 18283Draft and prEN 18282Enquiry cover accuracy and robustness, transparency and human oversight, dataset quality, bias management and cybersecurity, and at their stages they supply scope and vocabulary only.

ISO/IEC JTC 1/SC 42 supplies published methods and vocabularies. ISO/IEC 23894:2023Published applies ISO 31000 risk management to AI and gives an Art. 9 review its reference process. ISO/IEC TR 24029-1:2021Published classifies robustness assessment methods as statistical, formal or empirical, and ISO/IEC 24029-2:2023Published gives the formal-methods procedure an Art. 15 robustness test follows for stating properties and reporting results. ISO/IEC TR 24027:2021Published gives an Art. 10 bias examination its bias categories and candidate fairness metrics. ISO/IEC 42005:2025Published gives an Art. 27 fundamental rights impact assessment a process and documentation structure. ISO/IEC 42001:2023Published gives a management-system structure with Annex A controls that an Art. 17 review maps to.

NIST publishes NIST AI RMF 1.0Published as a framework rather than a standard. The Govern, Map, Measure and Manage functions and the trustworthiness characteristics structure Art. 9 and Art. 15 evidence; the framework sets no thresholds and has no status under the Act.

The European Commission publishes codes and guidelines that record its reading of the Act. GPAI Code of PracticePublished gives the model documentation form, the copyright policy measures and the safety and security framework that an Art. 53 to Art. 55 evidence review checks against. Code of Practice on Transparency of AI-Generated ContentPublished names metadata, watermarking and provenance as marking layers and ties adequacy to the Art. 50(2) criteria of effectiveness, interoperability, robustness and reliability. Commission guidelines on Article 50 transparency obligationsPublished gives a transparency test its scope and exemptions for each Art. 50 duty. Commission guidelines on GPAI scopePublished gives a GPAI scoping check its criteria for what counts as a general-purpose AI model, when a modifier becomes a provider and where the systemic-risk threshold sits. A code or guideline records the Commission's reading of the Act and does not amend it.

C2PA publishes C2PA Content Credentials specificationPublished, a provenance specification with a cryptographically signed manifest format. An Art. 50(2) marking test verifies a C2PA manifest for presence, validity and survival through edits; the specification is one technique among those the Commission code lists, and the tracker records it because the marking protocol on /methodology/ derives steps from it.

Caveats

Maintenance

Every entry is verified against the source on its row and carries its own stamp, for example the stamp below for the logging draft.

Verified on 18 September 2026 · ISO project record for ISO/IEC FDIS 24970 (ISRSM mirror of the ISO project database)

A stage or citation change is applied to the data with a source URL and logged at /regulation/changelog/, which lists the entries touched and the pages updated. The verification run is re-run when a change becomes known, such as a JTC 21 vote closing, a Commission guideline being adopted or an Official Journal citation appearing; there is no scheduled run, and the anchor date on the regulation page records the last full run. The testing services that draw on the tracker are bounded by the list at /what-we-cannot-do/: the site tests against the documents above and prepares evidence, and it does not assess conformity in place of a notified body.