EN 18286, and why it exists instead of ISO 42001
This is the standard that will carry Article 40 presumption of conformity for the Article 17 quality management requirement. It is the most advanced of the JTC 21 deliverables. It is not ISO/IEC 42001, and the reason it is not tells you something useful about what your management system does and does not cover.
Status, stated precisely
| Full title | Artificial intelligence: Quality management system for EU AI Act regulatory purposes |
| Developed by | CEN-CENELEC JTC 21, working group 2 |
| Mandate | Commission standardisation request M/593, as amended by M/613 |
| Targets | Article 17: the quality management system obligation on providers of high-risk AI systems |
| Stage | Approval / Formal Vote — Enquiry closed, comments reviewed, out for vote by National Standardization Bodies |
| Cited in the Official Journal? | No, so no Article 40 presumption yet |
| Relationship to ISO/IEC 42001 | An annex maps its requirements to ISO/IEC 42001 Annex A controls. A further annex maps to ISO 9001. |
| Where it sits | The most advanced of the JTC 21 deliverables. Full deliverable map → |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Why not just adopt ISO/IEC 42001?
European standardisation prefers to leverage international ISO/IEC standards where they fit. For Article 17 it did not fit, and the reason is structural rather than political.
Article 17 asks for
A quality management system oriented to a product placed on a market, inside a conformity assessment regime: design control and verification, examination and testing procedures, technical specifications, data management, post-market monitoring, incident reporting, communication with authorities and notified bodies, record-keeping, and an accountability framework. All thirteen elements →
ISO/IEC 42001 provides
An organisation-level AI management system in the ISO Annex SL family, clauses 4 to 10 plus 38 Annex A controls across nine objectives, selected through a Statement of Applicability.
Both are quality management systems. They are quality management systems of different things: one governs how your organisation manages AI, the other governs how a specific high-risk product reaches and stays on the market.
What presumption of conformity buys, and does not
- Only the requirements the standard covers. EN 18286 addresses Article 17. It will not presume conformity with Articles 9 to 15, those have their own deliverables in progress. The map →
- Only once cited in the Official Journal. Approval stage is not citation.
- Rebuttable. Presumption is not immunity; it shifts the evidential burden.
A caution about first editions
Under the October 2025 CEN-CENELEC acceleration measure, a positive Enquiry can allow the Formal Vote to be skipped and comments to be addressed in the next version. Expert analysis: a first edition may therefore carry known unresolved comments. If you build a conformity argument on it, understand what was raised and deferred.
What to do now
- Build the Article 17 elements from the Article text, not from a standard that is not yet citable.
- If you hold ISO/IEC 42001, map your controls now so the gap is visible and small later.
- Watch the Official Journal L series, not just the CEN-CENELEC work programme. Publication and citation are different events.
- Do not buy “EN 18286 compliance” today. There is nothing to comply with yet.
Status labels on this page
Verified fact: The standard's title, committee, mandate, target article, current Approval stage, mapping annexes, and absence from the Official Journal.
Expert analysis: The structural explanation of the ISO/IEC 42001 mismatch and the first-edition caution.
Unsettled: The publication date and any Official Journal citation date.
Map what you already have
The useful work today is the control mapping: which of your existing controls carry into the Article 17 elements, and which elements have no analogue in what you hold.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
What stage is EN 18286 at?
The Public Enquiry on prEN 18286 closed in early 2026 and the comments were reviewed. Following the harmonised standard review, the text went out for Formal Vote by the National Standardization Bodies, placing it at the Approval stage. It is the most advanced of the CEN-CENELEC JTC 21 deliverables. It has not been published in the Official Journal, so it does not yet confer Article 40 presumption of conformity.
What is EN 18286?
EN 18286 is the European standard titled Artificial intelligence - Quality management system for EU AI Act regulatory purposes, developed by CEN-CENELEC JTC 21 working group 2 against Article 17 of the AI Act under the Commission's standardisation request. Once finalised and cited in the Official Journal, applying it will confer presumption of conformity for the requirements within its scope.
Why did CEN-CENELEC not adopt ISO/IEC 42001 for Article 17?
JTC 21 assessed ISO/IEC 42001 against the Article 17 quality management system requirement and concluded that its goals and definitions were not aligned with what Article 17 requires. Article 17 is a product-oriented quality management obligation sitting inside a conformity assessment regime, whereas ISO/IEC 42001 is an organisation-level management system in the ISO Annex SL family. JTC 21 therefore developed a bespoke European standard.
If we hold ISO/IEC 42001, does that help with EN 18286?
Yes. EN 18286 includes an annex mapping its requirements to ISO/IEC 42001 Annex A controls so that organisations already certified can reuse existing controls rather than rebuild them, and a further annex mapping to ISO 9001 for organisations already operating a quality management system.