The European standard for AI quality management: what does it actually say?

In earlier blogs we discussed how European standards will help organisations demonstrate compliance with their obligations under the EU AI Act.

The first standard has now been published: prEN 18286, Quality management system for EU AI Act regulatory purposes.

A fair amount has been written about this standard, but what it actually contains is far from clear to many people. In this blog, we lift the curtain a little.

It is important to understand that this standard is written for providers that develop and place high-risk AI systems on the market. It gives those providers a clear, recognised route for complying with the obligations in Article 17 of the AI Act. If a provider sets up its quality management system in line with this standard, it benefits from a legal presumption of conformity with the requirements of Article 17.

Providers may still meet Article 17 through other means, but they will need to demonstrate how they do so themselves.

The standard does not affect deployers. Parties that deploy high-risk AI for example in areas such as recruitment or credit decisions, must ensure they implement the obligations under Article 26 (use in accordance with instructions for use, human oversight, monitoring, logging, and informing staff and affected individuals).

Background

The standard was developed by CEN-CENELEC JTC 21, the joint European committee on artificial intelligence established by CEN and CENELEC in 2021. The committee develops European AI standards on behalf of the European Commission.

By decision of 12 October 2026 (2026/2274), the Commission confirmed that the standard meets the applicable requirements and can serve as a framework for complying with Article 17 of the AI Act.

JTC 21 continues to work on a range of other standards for high-risk AI, covering risk management (Article 9 AI Act), data governance and quality (Article 10), logging (Article 12), transparency (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), cybersecurity (Article 15), and conformity assessment (Article 43).

Content of the standard

Article 17 of the AI Act requires providers of high-risk AI systems to implement a quality management system. That system may be scaled to the size of the provider's organisation (for example, a start-up or a small mid-cap company) and must be documented in a systematic and orderly manner through written policies, procedures, and instructions.

The standard explains how such a system can be structured. Clauses 1 to 3 set out primarily who the standard is intended for and how its terms should be interpreted.

Clause 4 addresses the quality management system itself. The provider must identify which regulatory requirements apply, determine which AI systems fall within the scope of the quality management system, and formulate and document a compliance strategy. That strategy also covers the measures used to demonstrate compliance, such as the use of harmonised standards or other recognised frameworks. Clause 4 also offers guidance on recording this information, keeping it up to date, and conducting ongoing monitoring.

Clause 5 deals with "Leadership": top management establishes the quality policy (and quality objectives), ensures the necessary resources are allocated and assigns roles, responsibilities, and authorities.

Clause 6 covers planning: identifying which objectives contribute to the effective functioning of the quality management system (so not the risk management for the AI system itself), identifying risks to that functioning, planning measures to address those risks, and evaluating the effectiveness of those measures.

Clause 7 covers support: determining what resources, staff competencies, communication (both internal and with external parties), and awareness-raising activities are needed.

Clause 8 deals with "AI system realization": processes and procedures must be established, documented, implemented, and maintained throughout the entire lifecycle of the AI system, with a view to meeting regulatory requirements and system requirements. This includes setting up a risk management system, data management processes, and product documentation.

Clause 9 covers what must happen after the AI system has been placed on the market or put into service: market access, support services, supply chain management (suppliers), change management, post-market monitoring, reporting of serious incidents, and handling of non-compliance.

Clause 10 is the last one. The standard requires periodic management reviews, in which the effectiveness of the system is assessed against measurable criteria. Planning for changes to the quality management system itself also falls within this Clause.

The standard also includes annexes with further information on, among other things, overlap with other standards.

Practical application

The AI Act requires the quality management system to cover at least the following aspects (briefly summarized here):

1. A compliance strategy, including conformity assessment procedures and change management.

2. Methods for design, design control, and design verification.

3. Methods for development, quality control, and quality assurance.

4. Inspection, testing, and validation procedures before and throughout the entire development process, as well as thereafter.

5. Applicable technical specifications and standards, including alternative means where harmonised standards are not yet available.

6. Data management processes, covering acquisition, storage, analysis, and all other data operations.

7. A risk management system in accordance with Article 9.

8. A post-market monitoring system in accordance with Article 72.

9. Procedures for reporting serious incidents in accordance with Article 73.

10. Record-keeping systems for relevant documentation and information.

11. Management of resources and continuity of supply.

12. An accountability framework setting out the division of responsibilities between management and staff.

Because the standard follows a management system structure (the so-called "High Level Structure"), these requirements do not appear in this exact order within the standard.

The requirements under (a) relating to compliance strategy and conformity assessment procedures for example, are addressed in section 4.4, while change management is dealt with in section 9.4 (the provider assesses whether a change constitutes a "substantial modification", which would trigger a new conformity assessment).

The methods referred to under (b) for design, design control, and design verification are set out in section 8.3.2: the provider establishes AI system requirements (regulatory requirements and additional requirements necessary for design and development), has them reviewed, and translates them into AI system specifications, making it clear how the AI system was designed and implemented in conformity with those requirements.

Other topics are similarly distributed throughout the standard.

Conclusion

It is not simply a matter of ticking off individual obligations. The standard calls for the implementation of a complete management system. Below is a practical outline of the main steps involved.

Step 1: Define the scope of the quality management system

Identify all applicable regulatory requirements (including the AI Act), determine which AI systems fall within the scope of the quality management system, and document a compliance strategy (Clause 4).

Step 2: Secure top management involvement

Top management establishes the quality policy, ensures sufficient resources are available, and assigns responsibilities. Their involvement is an explicit requirement, not a formality (Clause 5).

Step 3: Ensure competent staff and effective communication

Map the necessary competencies, arrange appropriate training, and establish communication procedures for both internal and external parties, including competent authorities (Clause 7).

Step 4: Implement and maintain the quality management system

Set measurable quality objectives and identify risks to the functioning of the quality management system itself. Plan measures to address those risks (Clause 6).

Establish lifecycle processes covering everything from intended use and design and development requirements through to testing and acceptance (Clause 8), as well as post-market management (Clause 9).

Step 5: Establish the risk management system

Implement a risk management system for each AI system, aimed at protecting health, safety, and fundamental rights throughout the entire lifecycle (section 8.2), and put in place procedures for managing incidents and non-compliance (sections 9.6 and 9.7).

Step 6: Carry out periodic maintenance

Involve top management, conduct management reviews, and document outcomes and recommendations. Plan and implement changes in a controlled manner (Clause 10) and keep all documentation current, including technical documentation, the quality policy, procedures, and the results of reviews and audits (sections 4.5 and 8.9).

Article 17 of the AI Act imposes substantial obligations that are not always straightforward to fulfil. With this standard as a guide, providers have a clearer picture of what is expected of them and how to meet those expectations.

Do you have questions after reading this blog? Please feel free to get in touch.