Why standards decide how expensive AI Act compliance is
The EU AI Act tells you what a high-risk AI system must achieve. It does not tell you how to achieve it. That gap is meant to be filled by harmonised standards — technical documents that, once cited by the Commission in the Official Journal, let a provider that follows them be presumed to comply with the corresponding legal requirements.
The presumption is worth a great deal. With it, a market surveillance authority that thinks you are non-compliant has to demonstrate that. Without it, you carry the full burden of proving that your own approach satisfies every requirement, on your own reasoning, in your own documentation.
As of today, no harmonised standard has been cited in the Official Journal for the AI Act. Not one. Every provider of a high-risk AI system in Europe is currently in the same position, and it is worth understanding exactly what that position is.
EN 18286:2026, the first AI Act standard
At the end of July 2026 CEN and CENELEC published EN 18286:2026, “Artificial intelligence — Quality management system for EU AI Act regulatory purposes”. National standards bodies adopt it in turn as their own national versions, and conflicting national standards are withdrawn on the usual European timetable.
It is the first standard written specifically to support the AI Act, and it addresses Article 17, the quality management system that providers of high-risk AI systems must put in place.
What it is not, yet, is a harmonised standard in the legal sense. Publication by CEN-CENELEC and citation in the Official Journal are two different events, and only the second one confers anything. The sequence still to run is Commission assessment against the standardisation request, technical assessment by a consultant, a Commission implementing decision, and then publication of the reference in the Official Journal. CEN-CENELEC’s own announcement says the Commission is expected to publish the reference later in 2026. Expected is not the same as done.
One caveat is worth carrying into that moment. Article 40 frames the presumption of conformity around the requirements in Chapter III, Section 2 — Articles 8 to 15. Article 17, the quality management system, sits in Section 3. Whether and how a citation of EN 18286 delivers presumption for Article 17 is a question to read carefully in the implementing decision when it appears, rather than to assume. Partial citations with restrictions are common in other regulated sectors.
What else is coming
Four further European standards closed their public enquiry stage in mid-2026, covering AI risk management for Article 9, cybersecurity specifications for Article 15, logging under Article 12, and a taxonomy of computer vision tasks. Further drafts covering accuracy and robustness, transparency and human oversight, bias management, dataset quality and the conformity assessment framework remain in development.
CEN-CENELEC is targeting availability of the prioritised deliverables around the end of 2026. To get there its technical boards adopted an exceptional acceleration package in late 2025, allowing direct publication after a positive enquiry vote and standing up a small expedited group to rescue the most delayed drafts.
The underlying mandate is standardisation request M/593, issued to CEN and CENELEC by Commission implementing decision in May 2023, covering ten areas from risk management and data governance through to conformity assessment. Its original deadline of 30 April 2025 was missed entirely, and it has since been amended to align with the Act as adopted and to extend the timeline.
Why the delay mattered, and why it no longer buys you time
Standards readiness was the stated driver behind the Digital Omnibus on AI, Regulation (EU) 2026/1744, which deferred the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
Here is the part that matters commercially. The Commission’s original proposal made the new dates conditional — obligations would bite only once the Commission confirmed that supporting standards and tools were available. The co-legislators removed that mechanism and replaced it with fixed calendar dates. 2 December 2027 is a hard date whether or not harmonised standards have been cited by then. The standards delay bought one deferral. It will not buy another.
ISO/IEC 42001 is not AI Act compliance
ISO/IEC 42001:2023 is an international management system standard for artificial intelligence, published in December 2023. It is certifiable, built on the same harmonised structure as ISO 9001 and ISO 27001, and increasingly requested in procurement. ISO/IEC 42006:2025 sets requirements for the bodies that certify against it, which has made certificates meaningfully more comparable than they were.
It does not confer any presumption of conformity under the AI Act, and no amount of vendor marketing changes that. There are three independent reasons.
The first is procedural. Presumption under Article 40 requires a standard developed in response to a Commission standardisation request and cited in the Official Journal. ISO/IEC 42001 was developed internationally, not under M/593. Even its European adoption, published as EN ISO/IEC 42001:2026 in March 2026, is not a deliverable under the standardisation request and is not a candidate for citation as an AI Act harmonised standard.
The second is that the Commission has said so directly. Its own standardisation FAQ states that although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system required under the AI Act.
The third is architectural. EN 18286 was written as a deliberate break from ISO 9001 and EN ISO/IEC 42001 precisely because the technical committee concluded that the management-system model did not map onto Article 17. Had ISO/IEC 42001 covered the ground, the drafters would have adopted it rather than writing something new.
What ISO/IEC 42001 does give you
It is genuinely useful, just not as a compliance certificate. It is strong on governance, roles and responsibilities, policy, competence, documented information, internal audit and continual improvement — the scaffolding that any regulated quality system needs and that many AI teams lack entirely.
Where it is thin is the regulatory content: conformity assessment procedures, the EU declaration of conformity, CE marking, the Annex IV technical documentation, post-market monitoring under Article 72, serious incident reporting under Article 73 and its deadlines, and the interface with notified bodies. ISO/IEC 42001 is an organisational management system. Article 17 sits inside a product conformity regime. Those are different objects, and the second one is where the enforcement lives.
Several other international standards are worth knowing as supporting evidence rather than compliance routes: ISO/IEC 23894 on AI risk management guidance, which maps onto Article 9; ISO/IEC 42005 on AI system impact assessment, which is directly useful for the Article 27 fundamental rights impact assessment; and ISO/IEC 22989 on concepts and terminology, which underpins the rest.
What to do when nothing is cited
The Act offers three routes to demonstrating conformity. Harmonised standards under Article 40 are unavailable, because none is cited. Common specifications under Article 41 — which the Commission may adopt by implementing act where harmonised standards are insufficient or unduly delayed — are also unavailable, because none has been adopted for the AI Act.
That leaves the third route: your own technical solutions, demonstrated requirement by requirement and documented in the Annex IV technical documentation. It is the only lane currently open, and everyone is in it.
The sensible way to travel it is to implement the published and draft European standards anyway. A provider that has built to EN 18286 is not legally presumed conformant, but is in a far stronger evidential position than one that has not — and converts cleanly to presumption on the day the citation lands, with no re-engineering.
Praktiskt exempel
A Nordic SaaS company selling an Annex III high-risk system holds ISO/IEC 42001 certification and has been telling prospects it is “AI Act ready”. A larger customer’s procurement team asks for its Annex IV technical documentation and its EU declaration of conformity.
It has neither. The certification covers its AI governance framework, not the product conformity file, and there is no harmonised standard it can point to instead. Worse, the claim itself is now a problem: presenting a management system certificate as AI Act compliance is a misleading-claims exposure in its own right.
The right position is that the certification is real and valuable, that it covers roughly the governance half of Article 17, and that the regulatory half — conformity assessment, technical documentation, post-market monitoring, incident reporting — is being built to EN 18286 ahead of December 2027. That answer survives due diligence. The first one does not.
Vanliga misstag som företag gör
The first is treating publication of EN 18286 as the arrival of a harmonised standard. Citation in the Official Journal is the event that matters, and it has not happened.
The second is waiting for that citation before starting. If it lands late in 2026 or during 2027, a provider starting then will not have a working quality system, an Annex IV file and conformity assessment evidence by December 2027.
The third is selling ISO/IEC 42001 certification as AI Act compliance, which is both wrong and independently risky.
The fourth is assuming the December 2027 date will move again because standards are late. The co-legislators specifically removed the standards-contingent trigger from the final text.
The fifth is documenting technical solutions without documenting the reasoning. Without a harmonised standard, the reasoning is the evidence.
Rekommenderade åtgärder
Classify your systems before anything else, because a surprising share of AI Act programmes resolve at that step. Then obtain EN 18286:2026 and treat it as the Article 17 blueprint — building to it costs nothing extra and positions you for the citation whenever it arrives.
Sequence the work with the quality system first as the container, then the Article 9 to 15 technical requirements against the draft European standards and the relevant ISO documents. For every requirement, record four things: the requirement, your solution, your evidence, and why it is adequate. That file is what a market surveillance authority will read, and it is also what converts most cheaply into a standards-based file later.
If you already hold ISO/IEC 42001, ISO 9001 or ISO 27001, map those processes onto EN 18286 before building anything new — the overlap on governance, competence and internal audit is substantial — then close the regulatory deltas deliberately. Finally, watch the Commission’s harmonised standards listing for an AI Act entry, and read the scope of the implementing decision carefully when it appears rather than assuming it covers everything the standard covers.
Vanliga frågor
Does ISO/IEC 42001 certification help at all with the AI Act?
Yes, substantially — just not legally. It gives you the management scaffolding that Article 17 assumes: policy, roles, competence, documented information, internal audit, continual improvement. What it does not give you is presumption of conformity, and it does not cover conformity assessment, the technical documentation file, CE marking, post-market monitoring or incident reporting. Treat it as an accelerator, not a destination.
If we follow EN 18286 now, are we compliant?
You are not presumed compliant, because the standard has not been cited in the Official Journal. But following it is currently the strongest available way to demonstrate that your own technical solution reflects European state of the art, and it means you will not need to rebuild when the citation arrives. Document your reasoning either way.
Could the December 2027 deadline move again?
Nothing suggests it will. The Commission’s original proposal tied the new dates to standards actually being available, and the co-legislators replaced that with fixed calendar dates. The deadline is now independent of standards readiness. Planning on a further extension is not a strategy.
Slutsats
EN 18286:2026 is the first European standard written for the AI Act, and it is a real milestone — but it is not yet a harmonised standard, no AI Act standard has been cited in the Official Journal, and no provider in Europe currently has a presumption of conformity to rely on. ISO/IEC 42001 gives you governance maturity, not legal compliance, and the Commission has said as much. With Article 40 and Article 41 both unavailable, every high-risk provider is documenting its own technical solutions, against a December 2027 deadline that no longer depends on standards arriving. Lawgent helps businesses build AI Act quality management systems and technical documentation that stand on their own reasoning today, and convert cleanly to harmonised standards once the Commission cites them.
