What happened with EN 18286 and the AI Act?
On 14 October 2026 the Official Journal of the European Union published, through a European Commission decision, the reference to the EN 18286 standard. It is the first harmonised standard under the AI Act, meaning a technical standard the law recognises. It was written by CEN and CENELEC, the European standards bodies, which had published it in July. In Italy it has been adopted by UNI.
The AI Act says what a provider of a high-risk AI system must guarantee. The standard explains how to organise yourself to do it.
- It is aimed at providers, meaning whoever develops a high-risk AI system and sells it under their own name. For example, software that screens candidates or scores who gets a loan.
- It covers Article 17 of the AI Act. It asks for written rules to design, test and document the system, manage data and risks, follow it after sale and report incidents.
- If you apply it, you are presumed to comply with that article. It stays voluntary, but if you take another route you have to prove compliance on your own, as the CEN and CENELEC technical committee explains.
- It sits on top of quality systems many companies already run, such as ISO 9001 or ISO/IEC 42001, without replacing them.
- You buy it from your national standards body, like any standard. The Official Journal carries only its title and reference.
What does it mean for your business or public body?
Take a recruitment agency that has built AI software to screen CVs and sells it to clients. It is the provider of a high-risk system. It will need a quality system for that software, and EN 18286 is the recognised way to show it has one. The high-risk rules for these systems apply from 2 December 2027, after the delay the European Union approved in the summer.
Now picture a city council that buys that software for its HR office. The council only uses it, so the standard is not aimed at the council. It still works as a yardstick. In the tender, the council can ask the supplier whether it follows EN 18286, or how else it meets Article 17. If the council builds the system in-house, it becomes a provider too.
Our read: it is the first finished standard out of ten areas the Commission requested, and the others are still in progress. This may change; we will update this page.
What about us?
On our Security page we list the standards we align projects with, such as ISO 13485 for medical devices. On a high-risk AI agent we would do it this way: a log of every action and a person's approval on sensitive steps from day one, so the documentation grows with the system.
What should you do now?
- If you build or sell an AI system that decides about people, get the standard and compare it with the quality system you already have.
- If you buy the system from a supplier, ask in writing how it meets Article 17 and whether it follows EN 18286.
- If you are not sure your system is high-risk, settle that first, because the standard matters in that case.
“The law says what to guarantee; the standard says how to organise. First you need to know whether you are the provider.”
DBrothers — how we read the AI Act
If your office runs an AI system that picks candidates, assesses applications or allocates services, first ask yourself who its provider is. We can check it together on that case, and from there you will know what to prepare or what to ask.
