EN 18286 and ISO/IEC 42001
EN 18286:2026 is the first harmonised standard of the AI Act: the Art. 17 quality management system for high-risk providers. ISO/IEC 42001 is broader and has no legal effect under the Act.
| ISO/IEC 42001 | EN 18286 | |
|---|---|---|
| What it is | International standard for an AI management system. | European harmonised standard for the quality management system that the AI Act requires. |
| Written by | ISO and IEC, joint committee on AI (JTC 1/SC 42). | CEN and CENELEC, joint technical committee 21 (JTC 21). |
| Who it is for | Any organisation that develops, provides or uses AI. | Providers of high-risk AI systems. |
| Legal effect in the EU | None by itself. The AI Act does not refer to it. | Presumption of conformity with Art. 17, since its citation in the Official Journal on 2026-10-14 (Implementing Decision (EU) 2026/2274). Voluntary. |
| Focus | Governance of AI in the organisation: objectives, risks, impacts, controls. | Compliance of high-risk systems with the AI Act: health, safety and fundamental rights. |
| Proof | Third-party certification. 22 entities hold accreditation from a European accreditation body for it. | Through the AI Act conformity assessment. A notified body assesses the quality management system only where the Act asks for a third-party procedure. |
| Link to the other | No reference to EN 18286. | Informative annexes map it to EN ISO/IEC 42001 and EN ISO 9001. |
Who needs which
- Provider of a high-risk system. Art. 17 applies to you from 2027-12-02 (Annex III) or 2028-08-02 (Annex I). EN 18286 is the direct route to show compliance with it. A 42001 system is a base that its annexes map to.
- Deployer, or provider of systems that are not high-risk. Art. 17 does not apply to you. ISO/IEC 42001 answers customer questions about AI governance. EN 18286 adds little.
- Provider of a general-purpose model. Neither standard is the reference for Chapter V. The code of practice for model providers is the main tool.
Why the Commission asked for a new standard
The Commission says 42001 helps to set up an AI management system, but its goals and definitions are not aligned with the Act. So it asked CEN and CENELEC for a standard built on the Act itself.
The presumption is voluntary. A provider can meet Art. 17 another way, and then shows compliance on its own.
If you already hold ISO/IEC 42001
Read the EN 18286 annex that maps it to 42001. It shows what you can reuse and what the Act adds.