First EU AI Act harmonised standard published: EN 18286 for quality management
On 21 October 2026 the European Commission published the reference to EN 18286:2026 in the Official Journal. It's the first harmonised standard under the EU AI Act. The standard, written by CEN and CENELEC, sets out a quality management system for providers of high-risk AI systems. A provider that follows it is presumed to meet the quality management requirements in Article 17 of the Act, for the parts the standard covers. It's built around the life of an AI system rather than the whole organisation, and it's designed to sit on top of ISO/IEC 42001 or ISO 9001, not replace them. More harmonised standards are expected before the high-risk obligations apply from 2 December 2027.
What it means for a small business
Most Australian businesses won’t be providers of high-risk AI systems in the EU, so this doesn’t reach them. If you build or sell an AI product into the EU that could count as high-risk, you now have a named standard to work from rather than reading Article 17 cold. If you already run ISO/IEC 42001, this layers on it.
What to do this week
Check whether anything you supply into the EU could be a high-risk AI system under the Act. If it could, note EN 18286 against it in your register and decide who owns the question. If it couldn’t, there’s nothing to do.
Applies to: Providers of high-risk AI systems placed on the EU market
Related instrument: EU AI Act