Commission Implementing Decision (EU) 2026/2274 cited EN 18286:2026 in the Official Journal for the quality management system in Article 17. The decision is dated 12 October 2026, was published on 14 October and entered into force that day. Approving the standard at CEN and publishing its reference are two different moments. The presumption in Article 40, limited to what this standard covers, starts with that publication, not with the approval of the standard.
The official English title, in the Decision’s annex and on the Commission page, is Artificial intelligence — Quality management system for EU AI Act regulatory purposes. The Commission presents it as the first harmonised AI Act standard whose reference is published in the Official Journal. The annex publishes one reference: EN 18286:2026.
Why the Official Journal citation matters
Article 40 of Regulation (EU) 2024/1689 is the general presumption rule. High-risk AI systems, or general-purpose AI models, that conform to harmonised standards — or to parts of them — whose references are published in the Official Journal are presumed to conform to the requirements covered by those standards or those parts. The presumption does not go beyond what each standard covers.
Decision 2026/2274 recalls that rule in its first recital. What it publishes, in Article 1 and the annex, is a reference for high-risk AI systems. The Commission explains that a provider applying EN 18286 obtains a presumption of conformity with the Article 17 requirements covered by the standard. This citation is not a standard for general-purpose AI models. It lasts while the reference stays published. If the citation is withdrawn or limited, the presumption changes with it.
The Decision does not require anyone to apply EN 18286. It publishes the reference and, from that publication, conformity with the standard gives a presumption of conformity with the requirements it covers. Article 17(1)(e) of Regulation (EU) 2024/1689 contemplates that harmonised standards are not applied in full, or do not cover every requirement: the quality system must then include the other means used to meet them. The presumption does not replace duties the standard does not cover.
Who it affects, and who it does not
The practical question is whether your company is in the situation Article 17 describes. That article is addressed to providers of high-risk AI systems. It asks them for a documented quality management system: policies, procedures and instructions, covering aspects from the compliance strategy to post-market monitoring. Using ChatGPT, Copilot or Gemini in the office does not make the company that provider.
Three profiles against EN 18286 and Article 17:
| Profile | Article 17 and EN 18286 | What to look at first |
|---|---|---|
| SME that only uses ChatGPT or Copilot | Mere use of a chatbot does not place the company under Article 17, and does not require it to implement EN 18286. | Which tool is used, with what data, and whether the company is a provider or only a deployer. |
| Company that develops high-risk AI | If your company is the provider of a high-risk system, Article 17 can require a quality management system. EN 18286 is one route to the presumption for the requirements it covers. | Whether the system is high-risk, who the provider is, and what quality system already exists. |
| Integrator | The contract label does not decide. If your company places a system on the market under its own name, the role may be that of provider. If it only installs a third party’s tool, Article 17 is usually not its own. | The role in each system, not the commercial label. |
There is a fourth profile. Someone who uses a third party’s AI under their authority, in a professional activity, is not for that reason the Article 17 provider. A different question is literacy: Article 4 is addressed to providers and deployers, and using ChatGPT does not make the company a provider. We cover that in AI literacy and Article 4. If that system were high-risk, the deployer has duties of its own. They are looked at case by case. The Regulation’s calendar, and what the Omnibus postponed, is in the AI Act guide for companies.
Definitions for reading Article 17
These definitions follow the Regulation and Legal Stones’ AI Act glossary. They do not classify a specific system.
Provider
Under the AI Act, the provider is the person who develops an AI system or places it on the market, including the person who places it on the market or puts it into service under their own name or trademark. Using ChatGPT, Copilot or Gemini does not make the company a provider.
Deployer
The deployer is the person who uses an AI system under their authority, in a professional activity, even if a third party developed it. Many companies that use a third party’s tool may be in that role. It is not automatic: it depends on the system and the use.
High-risk AI system
It is a category in the Regulation for certain systems listed in its annexes, for example some uses in recruitment or credit scoring. Using ChatGPT to draft text does not, on its own, place the company in the high-risk category. If a specific system falls into that category, it requires review.
Harmonised standard
For the purposes of Article 40, it is a European standard whose reference the Commission publishes in the Official Journal. EN 18286:2026 has been in that position since Decision 2026/2274. The presumption covers only the requirements that standard covers, and only while the reference stays published.
Presumption of conformity
If the system conforms to the cited standard, Article 40 presumes it conforms to the requirements covered by that standard. It is not a certificate, it does not approve the system as a whole, and it does not close the rest of the Regulation.
What EN 18286 is not
- It does not approve an AI system as a whole. The presumption, where it exists, is of the requirements covered by the standard.
- It does not replace other obligations in the Regulation that may apply in the case, such as transparency, data, human oversight, post-market monitoring or each operator’s role.
- It is not a certification. Citing the standard in the Official Journal does not make anyone a notified body, and it does not make Legal Stones a body that certifies systems.
- Applying it is not an obligation in the Decision. It is a route to the presumption for the requirements it covers. Article 17(1)(e) provides for other means when the harmonised standard is not applied in full. That does not erase Article 17 when the provider of a high-risk system is in that situation.
Classifying a specific system, and the company’s role in that system, requires review. This page does not do that.
How it sits with a quality system you already have
Article 17 does not, for each system, ask for a new manual beside every one you already have. Paragraph 3 allows the aspects in paragraph 1 to be included in the quality management system already required by sectoral Union law, where the provider is subject to that regime. Integrating them does not mean the old system already covers the AI Act. Regulation (EU) 2026/1744 does not replace that paragraph: it replaces paragraph 2.
Paragraph 2, in the wording of Regulation (EU) 2026/1744, requires implementation to be proportionate to the size of the provider’s organisation. It says so in particular where the provider is an SME, including a start-up, or a small mid-cap enterprise (SMC). In any event, the required rigour and level of protection must be maintained. Proportionate does not mean optional.
With ISO/IEC 42001 the relationship is a layer, not a substitute. The Commission describes EN 18286 as a system built around the AI system’s lifecycle, rather than the organisation in the abstract, designed to sit on standards that already exist: ISO/IEC 42001, ISO 9001 or a sectoral system, for example ISO 13485. Having ISO/IEC 42001 is not the Article 17 presumption. Not having it does not stop a provider of a high-risk system from using EN 18286 to extend a quality system that already exists.
What to do, by type of company
If your company only uses ChatGPT, Copilot or Gemini
- Start from real use: the tool, the data and whether there is an internal rule. The guide Can your SME use ChatGPT? sets out that question.
- Do not commission EN 18286 only because the team has an account.
- If it is unclear whether your company is a provider or a deployer, that is reviewed before building a quality system.
If your company develops a system that may be high-risk
- Confirm the role: provider, deployer or another. It is not automatic.
- Compare the quality system you already have with the aspects of Article 17, not with the index of a generic standard.
- If you want the presumption route, check which requirements EN 18286 covers and which stay outside while the reference remains in the Official Journal.
If your company integrates AI for a client
- Separate, system by system, whether your company places it on the market under its own name or only installs it.
- Do not assume Article 17 only because your company describes itself as an integrator.
- If the client is the provider, the quality system is theirs.
How Legal Stones can help
Is your AI system ready for the European requirements?
At Legal Stones we help you identify which Article 17 requirements of the AI Act may affect your company, which parts of your quality management system are worth reviewing, and where the main legal gaps are. We start from the documentation you already have, so you get a clear review and prioritised recommendations, without starting from scratch.
You do not need another generic audit: you need to know what affects you and what to do next.
Our work is legal review and analysis.
If your case goes beyond Article 17, see our AI legal risk assessment.
Frequently asked questions
Is EN 18286:2026 mandatory?
As a route, no. Decision 2026/2274 publishes the reference and opens the Article 40 presumption for the covered requirements. It does not order anyone to apply the standard. Article 17, when the company is the provider of a high-risk system, still requires a quality management system. If the standard is not applied in full, paragraph 1(e) requires that system to include the other means used for the requirements left outside. The presumption exists only for what is covered, and only while the reference stays cited.
Does it affect a company that uses ChatGPT or Copilot?
Not by mere use, and that use does not require the company to implement EN 18286. Article 17 looks at the provider of high-risk AI systems. The prior question is what is used, with what data, and whether the company is a deployer.
What does Article 17 of the AI Act require?
From the provider of a high-risk AI system, a documented quality management system. Paragraph 2, after Regulation (EU) 2026/1744, requires implementation to be proportionate to the provider’s size and, in any event, the required rigour and level of protection to be maintained. Paragraph 3 allows those aspects to be included in a sectoral system that already exists. It does not require EN 18286 as the only means.
What is the difference between EN 18286 and ISO/IEC 42001?
ISO/IEC 42001 is an international standard for an AI management system in the organisation. EN 18286:2026 is the European standard cited for the Article 17 requirements it covers. The Commission presents it as a layer on a system that already exists, not as its substitute. Having one does not create the presumption of the other.
What if a company integrates AI for its clients?
Each system has to be separated. If the company places it on the market under its own name, the role may be that of provider. If it only installs a third party’s tool, Article 17 is usually not its own. The label “integrator” does not decide.
Does applying EN 18286 show compliance with the whole AI Act?
No. Article 40 limits the presumption to the requirements covered by the cited standard. Decision 2026/2274 publishes EN 18286 for high-risk AI systems, and the Commission links it to the Article 17 requirements the standard covers. It is not a standard cited for general-purpose AI models.
Caveats and date
Last updated: 20 October 2026.
Prepared by Lucía Piedras for Legal Stones, from the sources linked below. It is not a legal opinion and it does not classify anyone’s system. The law is still developing. This is the first harmonised-standard reference for the AI Act in the Official Journal. Others will follow.
Sources
- Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, OJ of 14 October 2026. ELI: http://data.europa.eu/eli/dec_impl/2026/2274/oj
- Regulation (EU) 2024/1689, Articles 17 and 40.
- Regulation (EU) 2026/1744, which replaces Article 17(2).
- European Commission: first harmonised standard supporting the AI Act published in the Official Journal, 19 October 2026.
- EN 18286:2026, developed by CEN and CENELEC. The text of the standard is paid; this page does not reproduce it. What is said about ISO/IEC 42001 is the Commission’s published description, not a table taken from the standard.