The AI Act has its first harmonised standard. It spells out the quality system high-risk AI builders must run.

On 14 October the EU's Official Journal published Commission Implementing Decision (EU) 2026/2274, adopted two days earlier. It lists a single standard, EN 18286:2026, titled "Artificial intelligence: Quality management system for EU AI Act regulatory purposes". The European standards bodies CEN and Cenelec wrote it at the Commission's request. The Commission announced it on 19 October as the first harmonised standard supporting the AI Act.

The legal effect sits in Article 40 of the AI Act. A high-risk AI system that conforms to a harmonised standard published in the Official Journal is presumed to meet the requirements that standard covers. EN 18286 covers Article 17, the quality management system every provider of high-risk AI has to run. The presumption applies from the date of publication. Following the standard is voluntary, and the Commission says providers may use other frameworks to show compliance.

What the standard asks for

According to the Commission, EN 18286 organises quality management around the life of an AI system rather than around the organisation. It was written to sit on top of management systems many companies already have: ISO/IEC 42001 for AI, ISO 9001 for quality, or sector systems such as ISO 13485 for medical devices. A company without ISO/IEC 42001 can use it to extend the system it runs or to build a new one. Firms in regulated sectors can fold it into their existing setup instead of running two in parallel.

Who has to care

Providers of high-risk AI, meaning the companies that build such a system or sell it under their own name. The Commission's own examples include CV-sorting software for recruitment, credit scoring that decides whether someone gets a loan, exam scoring in schools and AI safety components in critical infrastructure. A company that uses ChatGPT or Copilot to draft emails is not a provider of high-risk AI, and this standard does not apply to it.

The clock is known. After the AI Omnibus, the high-risk rules for the Annex III use cases above apply from 2 December 2027, and those for AI built into regulated products such as lifts or toys from 2 August 2028. That leaves about 13 months for the first group. A quality system needs named owners, written procedures and records from real use, and none of those appear in the final month.

More standards will follow. The Commission has asked CEN and Cenelec for standards on risk management, data governance, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment. None has a publication date yet.

What to do on Monday

• ✳Check whether anything you build or sell falls into a high-risk category. Estonian software companies selling recruitment, staff management, lending or education tools into the EU are the likeliest providers
• ✳If you already hold ISO 9001 or ISO/IEC 42001, ask the person who runs it to compare it against EN 18286. The standard was designed to sit on top of those, so the gap may be smaller than starting from zero
• ✳If you only buy such a tool, for example a recruitment platform that ranks candidates, add two questions to your next vendor review: will the product meet the high-risk rules by 2 December 2027, and does the vendor follow EN 18286
• ✳If none of your AI use is high-risk, write that conclusion down with the reasons. It takes an hour and saves the same debate every time a new tool arrives

For most Estonian companies this changes nothing today. For the few that build hiring, credit or education software, the AI Act's quality rules now come with a published template, and the countdown to December 2027 has started.