Check citation as well as publication of an AI Act standard
Publication of a European standard and citation in the Official Journal are separate events. Check the applicable legal status and begin keeping the process records needed to assess a high-risk provider’s quality management system.
Keep sources linked to the record used for review. The diagram does not represent automatic approval.
Publication of an AI Act standard gives providers a technical document to assess. It does not, by itself, establish the legal effect of following it. The review needs to distinguish publication from Official Journal citation and to identify the requirements any cited parts cover.
The news is real. CEN and CENELEC published EN 18286 in July 2026 — “Artificial intelligence — Quality management system for EU AI Act regulatory purposes” — the first European standard developed under the Commission’s standardisation request to reach publication. It is written against Article 17, the article that requires a provider of a high-risk system to run a documented quality management system.
A quality management system concerns procedures and responsibilities as well as documents. Its assessment needs evidence of those procedures operating. Preserve contemporary records while checking the standard’s status, rather than treating either publication or a future deadline as a substitute for the evidence.
Publication and citation are two different events
Article 40(1) of the Act is specific about where the presumption comes from. It attaches to systems in conformity with “harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union” (Article 40). The operative clause is the references of which have been published. A standard that CEN and CENELEC have approved and put on sale has not, by that act, had its reference published anywhere.
The Commission describes the sequence in its own terms. After a standard is published, it reviews it substantively to assess whether it accurately reflects the legal provisions, and only then submits the reference for publication in the Official Journal (understanding the standardisation of the AI Act). The same page notes that a standard, once referenced, carries an annex mapping the requirements of the Act to the clauses of the standard. That annex is what scopes the shelter — presumption reaches the requirements the annex claims, and no further.
- 01 Drafted Written by JTC 21 under the standardisation request.
- 02 Published Approved by CEN and CENELEC, with publication distinct from Official Journal citation.
- 03 Assessed The Commission checks it against the Act.
- 04 Cited Reference in the Official Journal. Presumption starts, scoped by the mapping annex.
A provider can use the published standard as a design reference while separately checking whether its reference has been cited and which requirements are covered. Do not infer a presumption of conformity from publication alone. Review the current Official Journal position when making a formal claim.
Why a quality management system is not a late deliverable
The second error costs more. Article 17(1) lists what the system has to cover, and the list is almost entirely composed of procedures rather than artefacts: procedures for record-keeping of relevant documentation and information, procedures for data management across acquisition, collection, analysis, labelling, storage, filtration, aggregation and retention, a post-market monitoring system, and an accountability framework setting out the responsibilities of management and staff (Article 17).
Dated records help establish how a procedure operated. A later description can explain the present system, but may not reconstruct earlier approvals, labelling instructions or data decisions. Record missing history as a gap rather than present retrospectively prepared material as contemporaneous evidence.
The amended stand-alone high-risk date of 2 December 2027, shown in the Commission timeline, provides a planning boundary. It does not create missing historical evidence. Identify the records needed for the intended use and begin maintaining them under the appropriate controls.
What to do with this before the citation lands
Four moves are available today, and none of them depends on knowing when or whether EN 18286 is referenced.
Buy the standard and read Article 17 alongside it. Not to adopt it, but to find out which of its clauses your existing engineering process already satisfies under a different name. Change control, design review and incident handling usually exist. The gap is normally data management and post-market monitoring, and it is better to know that now.
Turn on dated record-keeping in the places listed above. This is an architecture decision, not a policy decision. If the pipeline does not persist why a dataset version was selected, no policy document will make it appear later.
Ask suppliers a sharper question. When a vendor claims alignment to EN 18286, the useful follow-up is not whether they align but which clauses, and whether their answer depends on a reference in the Official Journal that has not appeared. A supplier who understands the difference is telling you something about how they will behave when the mapping annex turns out to cover less than everyone hoped.
Write down the accountability framework with names in it. Article 17 asks for responsibilities of management and staff. A framework naming roles that nobody occupies is the failure mode, and it is visible immediately to anyone reading it from outside.
What this does not tell you
It does not tell you that EN 18286 will be cited, or when, or with what mapping annex. The Commission’s assessment is a substantive review and it can conclude that a standard does not adequately reflect the requirements. Anyone planning on the assumption of a particular citation date is planning on something that has not happened.
It does not tell you whether your system is high-risk. That turns on Annex III and on the role you occupy, and it is a question that has to be answered for your system rather than for your sector.
Nothing here is legal advice, and no work of this kind produces a statement that an organisation meets the Act. The institute does not certify anyone, does not audit against a standard, and does not issue conformity opinions. Legal interpretation stays with your counsel, and formal conformity assessment stays with a notified body where one is required. What we do is establish which obligations plausibly attach, map what already exists against them, and name the evidence that does not exist yet.
The engineering and governance owners should agree which data, change and accountability records the current work must produce. Check the standard’s citation status separately and revisit the mapping when it changes. This supports a future assessment with evidence of how the system was actually managed.