Madrid, 19 October 2026. The European Commission has published the reference to EN 18286:2026, on quality management systems for EU AI Act regulatory purposes. Implementing Decision (EU) 2026/2274, published and effective from 14 October, cites this standard in the Official Journal of the European Union. The standard includes post-market monitoring processes. [1]
It is the first harmonised AI Act standard cited in the Official Journal and targets providers of high-risk AI systems. Its use is voluntary: conformity provides a presumption only for the requirements it covers, within the scope of Article 17 quality management requirements. It does not establish full AI Act compliance or replace other applicable duties. [1,2]
At Internet Security Auditors, we recommend first identifying systems, their classification and the organisation's role. Then compare existing processes with EN 18286 and review Annex ZA for the legal requirements covered. An ISO 9001 or ISO/IEC 42001 system can provide a useful foundation, but specific gaps still need assessment. [2]
The next step is to assign responsibilities and document controls, validation, change management and suppliers. Post-market monitoring should translate into indicators, incident collection, review of results and corrective actions supported by evidence. Documentation should reflect how processes actually operate. [1,2]
Internet Security Auditors provides AI Act assessment and compliance support, including applicability analysis, gap assessment and a prioritised action plan. We connect this work with ISO/IEC 42001 AI management system implementation, training and internal auditing to integrate governance, risk and continual improvement. Management system certification alone does not confer the presumption associated with EN 18286. Request an assessment of your organisation's starting point. [5–7]
References
[1] Official Journal / BOE — Implementing Decision (EU) 2026/2274: publication, scope and entry into force (14 October 2026)
https://www.boe.es/buscar/doc.php?id=DOUE-L-2026-81573&lang=es
[2] CEN-CENELEC JTC 21 — First harmonised AI Act standard; coverage and Annex ZA (14 October 2026)
https://jtc21.eu/en-18286-becomes-the-first-harmonised-standard-under-the-eu-ai-act/
[3] Nemko Digital — Coverage of the publication and its implications (16 October 2026)
https://digital.nemko.com/news/en-18286-eu-ai-act-cites-new-harmonized-qms-standard
[4] CSQA — EN 18286 published in support of the AI Act (16 October 2026)
https://www.csqa.it/en-us/press/intelligenza-artificiale-pubblicata-la-en-18286-2026-a-supporto-dell-ai-act
[5] Internet Security Auditors — AI use compliance assessment and support
https://www.isecauditors.com/en/evaluation-and-compliance-support-in-the-use-of-ai
[6] Internet Security Auditors — ISO/IEC 42001 AI management system implementation
https://isecauditors.com/en/implementation-of-aims-iso-42001
[7] ISO — ISO/IEC 42001 artificial intelligence management system
https://www.iso.org/es/norma/42001
