EN 18286 is now the first harmonised standard under the EU AI Act. Its reference was published in the Official Journal on 14 October 2026 by Commission Implementing Decision (EU) 2026/2274, and the Commission announced it on 19 October. EN 18286 is a quality management system (QMS) standard. Providers of high-risk AI systems that apply it now benefit from a presumption of conformity with the Article 17 requirements it covers. Many companies have spent two years obtaining ISO/IEC 42001 certificates, so the obvious question follows: is ISO 42001 enough, or is EN 18286 needed too? This analysis explains what each standard does, how the presumption works and where it stops, and what it means for Turkish and Korean companies that sell AI-enabled products and services into the EU.

What is EN 18286, and why does it matter now?

EN 18286:2026, "Artificial intelligence — Quality management system for EU AI Act regulatory purposes", was drafted by CEN and CENELEC under the Commission's standardisation request C(2025) 3871 of 23 June 2025. The implementing decision records that it answers point 9 of Annex I to that request: standards on quality management systems for AI providers, including post-market monitoring processes.

The Commission's announcement makes three points that matter for compliance planning:

  • EN 18286 gives providers of high-risk AI systems a route to meeting the QMS requirements of Article 17, and it is built around the life cycle of the AI system rather than the organisation.
  • The Commission calls it "the only AI QMS standard with a presumption of conformity".
  • It is designed to sit on top of existing systems such as ISO/IEC 42001, ISO 9001 or a sectoral QMS like ISO 13485, not to replace them. Providers in regulated sectors may integrate their systems rather than run separate ones.

The timing matters. After the Digital Omnibus on AI, obligations for high-risk systems listed in Annex III apply from 2 December 2027, and those for AI in Annex I products from 2 August 2028. Providers now have a legally recognised template for one of the Act's heaviest organisational duties more than a year before it bites. Background is in the site's EU AI Act legislation note.

What exactly was published, and when?

Some early commentary has blurred the dates:

  • Mid-2026: CEN and CENELEC approved EN 18286:2026, and CEN-CENELEC announced its publication on 31 July 2026. The approval date varies between sources: a CEN-CENELEC newsletter says June, while a vendor summary of the standard gives 12 July. National bodies then began issuing their own editions, such as the British Standards Institution's BS EN 18286:2026.
  • 12 October 2026: the Commission adopted Implementing Decision (EU) 2026/2274 "on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689". Its annex lists a single standard, EN 18286:2026, with no restriction.
  • 14 October 2026: the decision was published in the Official Journal (L series) and, under its Article 2, entered into force that day. Recital 6 explains why: the presumption runs from publication of the reference.

The Commission's announcement followed on 19 October, but in legal terms the presumption has been available since 14 October 2026.

What does EN 18286 cover?

The text of the standard is not public; what follows relies on the implementing decision, the Commission's description and published clause maps.

According to a clause-by-clause breakdown by the compliance software provider Modulos, clause 4 covers identification of applicable regulatory requirements, QMS scope and compliance strategy. Clauses 5 to 7 cover leadership, planning and support. Clause 8 covers AI system "realisation" across the life cycle, including risk, design, verification and validation, data, continuous learning and documentation. Clause 9 ("operations and control") covers placing on the market, the supply chain, modifications, post-market monitoring, serious-incident reporting and non-compliance, and clause 10 ("performance evaluation") covers management review and the planning of changes. The same source reports four annexes:

  • Annex A, on consulting interested parties about risks to health, safety and fundamental rights.
  • Annex B, a clause correspondence with ISO 9001.
  • Annex C, a clause correspondence with ISO/IEC 42001.
  • Annex ZA, mapping clauses to Article 17(1)(a) to (m) and the first sentence of Article 11(1).

Annex ZA reportedly marks Article 17(2) to (4) as not covered. The correspondence annexes identify related clauses only; they do not make the standards equivalent.

The same summary points to two design choices. EN 18286 defines a failure as a "non-compliance", meaning an unfulfilled regulatory requirement, rather than an ISO-style "nonconformity"; in other words, "quality" here means compliance with the Regulation. And the standard has no general continual-improvement clause of the kind ISO/IEC 42001 contains; improvement runs through management review and planned changes. According to the same source, the standard addresses providers of high-risk AI systems of any size and location, not providers of general-purpose AI models.

ISO 42001 vs EU AI Act: what is each standard for?

ISO/IEC 42001:2023 is the international management system standard for AI. CEN has adopted it as EN ISO/IEC 42001:2026; DIN, for example, lists the German version with an August 2026 edition date. It follows the familiar management-system structure plus AI-specific controls, suits any organisation that develops, provides or uses AI, and is certifiable. Since July 2025, ISO/IEC 42006:2025 has set additional requirements for bodies that certify AI management systems.

The difference is one of purpose:

  • ISO/IEC 42001 asks whether the organisation governs AI responsibly against its own objectives and risk appetite. It applies to developers and users alike, and the organisation largely sets the scope.
  • EN 18286 asks whether the provider's QMS ensures AI Act compliance for the high-risk systems it places on the EU market. The Regulation sets the scope, and the subject is the system across its life cycle.

ISO/IEC 42001 is not cited in the Official Journal under the AI Act and gives no presumption of conformity. A 42001 certificate is good evidence of governance maturity and shortens the path considerably, but it is not legal proof that Article 17 is met.

How does the presumption of conformity work under Article 40?

Article 40(1) provides that high-risk AI systems conforming to harmonised standards whose references are published in the Official Journal "shall be presumed to be in conformity with the requirements set out in Section 2" of Chapter III, to the extent the standards cover them. In practice, this generally shifts the burden: an authority that disagrees has to show where the system falls short.

Three limits matter.

The presumption is only as wide as the standard. If Annex ZA maps EN 18286 to Article 17(1) but not to Article 17(2) to (4), the presumption stops there. More importantly, a QMS standard requires a provider to have risk management and data management processes. It does not presume that the system's risk management (Article 9), data governance (Article 10) or accuracy, robustness and cybersecurity (Article 15) actually meet the Act. Those await their own standards. The Commission's standardisation page lists ten areas in which it has asked CEN and CENELEC for standards, and quality management is only one of them.

Partial application means partial presumption. A provider that applies only some clauses gets the presumption only for those. For the rest, compliance must be shown by other means.

A textual point (my own analysis). Read literally, Article 40(1) attaches the presumption to Section 2 of Chapter III (Articles 8 to 15). Article 17 sits in Section 3, among provider obligations. The Digital Omnibus did not change Article 40(1); it added a subparagraph to Article 40(2) requesting deliverables that support joint compliance with Sections 2 and 3 and with Annex I legislation. Even so, the Commission states that applying EN 18286 gives a presumption of conformity with the Article 17 requirements it covers, the implementing decision publishes the standard's reference on the basis of Article 40, and Article 17(4) itself provides that harmonised standards referred to in Article 40 are to be taken into account. In my view, authorities are likely to follow the Commission's reading, but the point has not been tested before a court. A careful provider should treat the presumption as a strong evidential position, not immunity.

Certification vs presumption: what does a certificate buy?

A common misunderstanding is that a certificate, whether ISO/IEC 42001 or a future "EN 18286 certificate", is what the AI Act requires. It is not. Conformity is shown through the procedure in Article 43, followed by the EU declaration of conformity and CE marking:

  • Annex III, points 2 to 8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice): internal control under Annex VI, with no notified body. Its first step is that the provider "verifies that the established quality management system" complies with Article 17. EN 18286 is built for exactly that self-verification.
  • Annex III, point 1 (biometrics): internal control is available only where the provider has applied harmonised standards or common specifications. Otherwise the notified-body procedure in Annex VII, including a QMS assessment, is mandatory. On a reasonable reading, the relevant standards are those for the Section 2 requirements, so until those are cited biometric providers should plan for Annex VII.
  • Annex I products (for example machinery or medical devices with AI safety components): the conformity assessment procedure under the sectoral legislation applies, and the notified body under that legislation also checks the Section 2 requirements of the AI Act. Article 17(3) lets providers already subject to sectoral QMS obligations fold the AI elements into that system, for example an ISO 13485-based system for medical devices.

A certificate from an accredited body has commercial and evidential value, but it creates no presumption under Article 40, and the presumption needs no certificate: it arises from applying the cited standard. Under Article 18(1)(b), QMS documentation must be kept available to authorities for ten years after placing on the market. Lacking a compliant QMS breaches the provider obligations in Article 16, which Article 99(4) sanctions with fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (for SMEs, including start-ups, whichever is lower).

What changed with the Digital Omnibus (Regulation (EU) 2026/1744)?

The Digital Omnibus on AI was published on 24 July 2026 and entered into force on 27 July. For quality management two changes matter:

  • Dates. Under amended Article 113, Sections 1 to 3 of Chapter III apply from 2 December 2027 to systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 to those under Article 6(1) and Annex I. The site's analysis of why the moved high-risk deadline is no reason to slow down applies with more force now that the template exists.
  • Smaller providers. Article 17(2) now names SMEs, start-ups and small mid-cap enterprises (SMCs) in its proportionality rule, without lowering the required rigour and protection. Amended Article 63(1) lets SMEs, including start-ups, with no partner or linked enterprises simplify certain QMS elements on the basis of Commission guidelines. Article 63(2) confirms that Articles 9 to 15 and the other obligations still apply.

What does EN 18286 mean for Turkish exporters?

Türkiye has no statute equivalent to the AI Act, so for Turkish exporters the question is what the EU market requires.

The AI Act reaches Turkish providers directly. Article 2(1)(a) covers providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country". Article 2(1)(c) adds providers and deployers outside the Union whose systems' output is used in the Union. A Turkish software house selling a CV-screening tool to a German employer is a provider in its own right, and so is a Turkish manufacturer exporting a machine with an AI-based safety function. Under Article 22 it must appoint an authorised representative in the Union by written mandate. The representative verifies the declaration of conformity and technical documentation and keeps them for ten years. Under Article 23, the EU importer must first check that the conformity assessment was carried out, the documentation exists, the CE marking is affixed and a representative is appointed. Turkish suppliers will meet EN 18286 first in EU customers' procurement questionnaires.

The Customs Union and Turkish standards. Under Article 8 of Decision No 1/95 of the EC-Turkey Association Council, Türkiye undertook to incorporate EU instruments on removing technical barriers to trade. The Turkish Standards Institution (TSE) is Türkiye's member of CEN and CENELEC. Under CEN-CENELEC rules, every European Standard "must be given the status of national standard in all member countries", and conflicting national standards must be withdrawn. EN 18286 and EN ISO/IEC 42001 should therefore become TS EN standards. I could not confirm in public sources that TSE has yet published TS EN 18286. The Modulos summary gives January 2027 as the latest date for national adoption, which I could not verify against an official CEN-CENELEC record, so companies should check TSE's catalogue. National adoption of a standard is not, however, the same as Turkish law incorporating the AI Act. Whether the Act itself will be brought into Turkish law is an open question; see the site's note on where the EU AI Act meets Türkiye's national AI strategy.

Turkish product-safety law already looks at EU exports. Article 2(2) of the Product Safety and Technical Regulations Law No. 7223 deems products exported, or intended for export, to EU member states to have been placed on the market under that Law. Article 5(2) presumes a product safe, until the contrary is proven, if it meets the health and safety provisions of the applicable technical regulation. For an AI-enabled machine exported to the EU, Turkish market surveillance and EU requirements therefore already overlap at product level, even without a Turkish regulation transposing the AI Act.

KVKK and contract law. An EN 18286 QMS requires documented data management. For Turkish providers this runs alongside Article 12(1) of the Personal Data Protection Law No. 6698 (KVKK), which requires controllers to take all necessary technical and administrative measures for data security, and Article 12(3), which requires them to carry out or commission the necessary audits. A QMS that documents data provenance, access and retention for AI Act purposes is the natural place to evidence KVKK compliance as well; the site's KVKK AI governance guide sets out the overlap. Commercially, EU importers will push AI Act warranties into supply contracts. Under Article 112 of the Turkish Code of Obligations (TBK), a debtor that fails to perform, or performs improperly, must compensate the loss unless it proves it was not at fault. Under Article 115(1), an advance exclusion of liability for gross fault is void. A supplier that warrants "AI Act compliance" without a functioning QMS behind it takes a risk that limitation clauses will not fully contain.

What does it mean for Korean companies under the AI Basic Act?

Korean exporters meet the EU regime on the same terms: Article 2, an authorised representative under Article 22 and importer checks under Article 23. At home they are subject to the Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (the AI Basic Act, Law No. 20676, in force since 22 January 2026), covered in the site's Korea AI Basic Act guide. Four provisions bear on the ISO 42001 and EN 18286 question:

  • Article 34(1) requires operators providing "high-impact" AI to implement a risk management plan, an explanation scheme, user protection measures and human oversight, and to prepare and keep documents evidencing them. Under Article 27(2) of the Enforcement Decree, those documents are kept for five years, against ten under the AI Act.
  • Article 34(3) deems the duty met where equivalent measures are taken under other laws. Annex 1 to the Decree lists them, for example the quality management system under the Digital Medical Products Act, autonomous-vehicle certifications and specified PIPA measures. ISO/IEC 42001 certification is not on the list.
  • Article 30(3) requires operators providing high-impact AI to endeavour to obtain verification or certification in advance, and under Article 30(4) public bodies that intend to use high-impact AI must give priority consideration to products and services based on verified or certified AI. The Act does not name any particular scheme, but this is where ISO/IEC 42001 certification can carry domestic weight.
  • Article 14(2) lets the government publish AI standards and recommend compliance, and Article 14(4) commits it to cooperation with international standards bodies.

The certification market already exists. According to a June 2025 Hankyung report, the Korea Accreditation Board (KAB) formally introduced an ISO 42001 accreditation and certification scheme after a one-year pilot, describing it as a first in Asia. It also said that the Korean Agency for Technology and Standards was expected to complete the adoption of ISO 42001 as a Korean Standard (KS) in the second half of 2025; I could not confirm whether that has happened.

For Korean groups the result is three layers: an ISO/IEC 42001 system as the group-wide base, the Article 34 measures and Article 30 certification for Korea, and an EN 18286 QMS for high-risk systems sold into the EU. The layers overlap heavily, but none substitutes for another.

A practical roadmap: from ISO 42001 to an EU AI Act quality management system

  1. Classify first. Establish which systems are high-risk, under which Annex, and whether you are the provider; Article 25 can make a distributor, importer or deployer a provider. Start with the site's high-risk assessment guide and the analysis which EU AI Act risk tier are you in?.
  2. Fix your date. 2 December 2027 for standalone Annex III systems; 2 August 2028 for AI in Annex I products, inside the sectoral procedure.
  3. Run a gap analysis. If you hold ISO/IEC 42001, use EN 18286's correspondence annex as an index, not as proof of equivalence. Expect gaps in regulatory-requirements identification, post-market monitoring, serious-incident reporting (Article 73) and communication with authorities.
  4. Decide on full or partial application. The presumption follows what you apply. Where you depart from a clause, document the alternative and why it meets Article 17.
  5. Integrate, do not duplicate. Use Article 17(3) to fold AI elements into an existing sectoral QMS; financial institutions fall under Article 17(4).
  6. Organise the evidence. Set ten-year retention (Article 18), appoint an authorised representative (Article 22) and prepare the importer file (Article 23). For Korea, add five-year retention and the website disclosures required by Article 27(1) of the Enforcement Decree.
  7. Review contracts. Price AI Act warranties, cooperation duties and incident-notification clauses against the real state of your QMS.
  8. Align internal policy. The QMS governs systems you provide; an AI use policy governs how staff use AI, including third-party tools. Most organisations need both, cross-referenced.
  9. Watch the next standards. The remaining JTC 21 deliverables will widen the presumption as they are cited.

Frequently asked questions

What is EN 18286?

EN 18286:2026, "Artificial intelligence — Quality management system for EU AI Act regulatory purposes", is a European standard developed by CEN and CENELEC. It turns the quality management obligation in Article 17 of the AI Act into operational requirements for providers of high-risk AI systems. Its reference was published in the Official Journal on 14 October 2026 by Implementing Decision (EU) 2026/2274, making it the first harmonised standard under the Act.

Is ISO 42001 enough for EU AI Act compliance?

Not on its own. ISO/IEC 42001 is a certifiable AI management system standard and a strong foundation, but it is not cited in the Official Journal under the AI Act and gives no presumption of conformity. Providers of high-risk systems still need a QMS meeting Article 17. EN 18286 is designed to be layered onto an existing ISO/IEC 42001 system to close that gap.

Does EN 18286 give a presumption of conformity?

Yes, since 14 October 2026, for the Article 17 requirements it covers and only to the extent a provider actually applies it. It does not presume that the AI system meets the technical requirements on risk management, data governance, accuracy, robustness or cybersecurity, which await their own harmonised standards. An authority can still rebut the presumption with evidence.

Do I need an EN 18286 certificate?

The AI Act does not require one. For most Annex III systems the provider verifies its own QMS under internal control (Annex VI). Notified bodies are involved for biometric systems where the Annex VII procedure applies, which includes a QMS assessment, and for Annex I products under the sectoral procedures. A private certificate can help commercially, but the legal presumption comes from applying the cited standard, not from a certificate.

When do the EU AI Act high-risk obligations apply?

Following the Digital Omnibus on AI (Regulation (EU) 2026/1744), they apply from 2 December 2027 to high-risk systems listed in Annex III and from 2 August 2028 to AI systems that are safety components of products under Annex I legislation. Building a QMS usually takes many months, so the remaining time is shorter than it looks.

Does the EU AI Act apply to Turkish and Korean companies?

Yes, whenever they place AI systems on the EU market or their systems' output is used in the EU (Article 2). Providers established outside the EU must appoint an authorised representative in the Union before making high-risk systems available, and EU importers must check conformity first. Turkish and Korean domestic law does not displace these obligations.

Burhan Doğuş Ayparlar's View

EN 18286 looks like a modest document, but its effect is not modest. For two years "AI governance" has largely meant ISO/IEC 42001, an organisation-centred system adopted at a company's own pace. EN 18286 moves the reference point. European regulators will not ask whether you govern AI well in general. They will ask whether this high-risk system was placed on the market under a QMS that ensures compliance with the Regulation, which is a narrower and harder question.

I draw three conclusions. First, ISO/IEC 42001 work is not wasted. It is the most efficient route to EN 18286. But presenting a 42001 certificate as "AI Act compliance" is now plainly wrong, and in a supply contract governed by Turkish law it can amount to improper performance with liability under TBK Article 112. Second, the presumption is narrower than the headlines suggest. It covers the management system, not the system's substantive performance, and until the remaining JTC 21 standards are cited the hard questions on risk, data and robustness will be argued on the merits. Third, for Türkiye the immediate pressure is commercial rather than legislative. EU importers will ask Turkish manufacturers and software exporters for EN 18286 evidence long before any Turkish regulator does. Companies that treat the QMS as an export-readiness project in 2027, rather than a formality in 2028, will be better placed.

The lesson for Korean companies is the same. The AI Basic Act rewards certification through Article 30 and recognises sectoral equivalents through Article 34(3), but it does not make ISO/IEC 42001 a substitute for anything in the EU. A group-wide 42001 base with a Korean high-impact layer and an EU EN 18286 layer is more work than one certificate, but it is the architecture that matches the law.

This article is for general information only and does not constitute legal advice. It is based on Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 (OJ L, 14 October 2026), the Commission's announcement of 19 October 2026, and the text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, as shown on the Commission's AI Act Service Desk. It also draws on Turkish legislation on mevzuat.gov.tr and Korean legislation on law.go.kr, all consulted on 20 October 2026. The text of EN 18286 is not public, so the descriptions of its clauses and annexes rely on secondary sources (chiefly a clause summary published by the compliance software provider Modulos) and should be checked against the standard itself; sources also differ on the date CEN and CENELEC approved the standard. TSE's national adoption of EN 18286, the January 2027 national adoption date and the Korean Standard designation of ISO/IEC 42001 could not be confirmed at the time of writing. The analysis and assessments are the author's own.