EN 18286 vs ISO 42001: Which One Gives You a Presumption of Conformity Under the EU AI Act?

Only EN 18286 gives you a presumption of conformity under the EU AI Act. ISO 42001 does not. On 14 October 2026, EN 18286:2026 became the first harmonised standard cited in the Official Journal under the AI Act, covering the quality management system that providers of high-risk AI must operate under Article 17. ISO 42001 remains valuable as an organisation-wide AI governance system, and EN 18286 is designed to sit on top of it, but an ISO 42001 certificate alone proves nothing in law.

This guide explains what each standard covers, what the presumption of conformity actually gives you (and what it doesn't), how much of your ISO 42001 work carries over, and what providers of high-risk AI should do next.

What "presumption of conformity" actually means

Under Article 40 of the AI Act, a high-risk AI system that conforms to a harmonised standard, or the relevant parts of one, whose reference is published in the Official Journal is presumed to meet the AI Act requirements that standard covers. In practice, the burden shifts. You show you followed the standard, and a regulator must then show why that isn't enough.

Three conditions must all be true:

• The standard is a European harmonised standard, developed by CEN, CENELEC or ETSI at the Commission's request
• Its reference is published in the Official Journal of the EU. Publication by CEN-CENELEC alone is not enough.
• The presumption applies only to the specific requirements the standard covers, within any limits set in the citation

EN 18286 meets all three for quality management. ISO 42001 meets none of them. It is an international ISO/IEC standard, it was not developed under the Commission's standardisation request, and it is not cited in the Official Journal.

EN 18286 vs ISO 42001 at a glance

What EN 18286 covers: the 13 elements of Article 17

Article 17(1) lists 13 things a high-risk provider's quality management system must include, labelled (a) to (m). EN 18286 turns them into auditable requirements.

"Typically covered" is a practical assessment of a well-run ISO 42001 system, not an official mapping. Your own gap analysis should be done clause by clause.

What EN 18286 does NOT give you

This is the part most early commentary gets wrong. The presumption is real, but narrow.

How much of your ISO 42001 work carries over

A lot, at the management-system level. EN 18286 uses the same high-level structure as ISO 42001 and ISO 9001, and the Commission describes it as designed to be layered on top of those standards rather than replace them. It also includes an informative annex relating its clauses to ISO 42001.

There is also a difference in mindset. ISO 42001 asks you to manage risks against your organisation's objectives. EN 18286 ties quality to regulatory compliance and the protection of health, safety and fundamental rights. An ISO 42001 system scoped around business goals will need re-scoping, not just new documents.

Equally, EN 18286 is not a replacement for ISO 42001. It has no dedicated AI system impact assessment clause, and it covers only providers of high-risk systems. If you also deploy AI, build lower-risk systems, or want a certificate buyers recognise, ISO 42001 still earns its place. Around 350 organisations held ISO 42001 certification by spring 2026, and enterprise buyers increasingly ask for it.

Which one should you use?

The timeline

• Dec 2023

  ISO/IEC 42001 published.

• 1 Aug 2024

  EU AI Act enters into force.

• Oct 2025

  prEN 18286 goes to public enquiry.

• 12 Jul 2026

  CEN approves EN 18286.

• 2 Aug 2026

  AI Act provisions on harmonised standards and conformity assessment apply.

• 14 Oct 2026

  EN 18286:2026 cited in the Official Journal: the first AI Act harmonised standard.

• 2 Dec 2027

  High-risk obligations apply to Annex III systems.

• 2 Aug 2028

  High-risk obligations apply to AI in Annex I regulated products.

A 6-step plan for high-risk providers

1. Confirm you are a provider of high-risk AI

   Check each system against Annex I and Annex III and the Article 6(3) exceptions. EN 18286's presumption only matters if Article 17 applies to you.

2. Get the standard and read the citation

   Buy EN 18286:2026 from your national standards body and read the Official Journal citation for any limits on the presumption.

3. Gap-assess against Article 17(1)(a)–(m)

   Use EN 18286's clauses as the scaffold. Mark what your ISO 42001 or ISO 9001 system already evidences, and what is missing.

4. Build the regulatory layer

   Write a compliance strategy for each high-risk system, a technical documentation set aligned to Annex IV, serious-incident and authority communication procedures, and post-market monitoring plans.

5. Cover the requirements EN 18286 doesn't

   Until more harmonised standards are cited, document how you meet Articles 9, 10 and 12–15 using drafts, state of the art and your own evidence.

6. Keep ISO 42001 for the whole organisation

   Use it for AI you deploy, lower-risk systems, impact assessments and buyer assurance. Run one integrated management system, not two.

Common mistakes to avoid

• Claiming an ISO 42001 certificate shows AI Act conformity
• Assuming EN 18286 covers all high-risk requirements, rather than just the quality system
• Treating a CEN-published standard as giving a presumption before Official Journal citation
• Dropping ISO 42001 because EN 18286 exists
• Keeping an ISO 42001 scope built around business goals, not health, safety and fundamental rights

A prompt to gap-assess your quality system

Paste in a summary of your current management system to get a first-draft Article 17 gap analysis. Have your compliance lead check it against the standard itself, which you need to buy.

You are an EU AI Act compliance specialist for providers of
high-risk AI systems.

Our situation:
[high-risk AI systems we provide and their Annex III or Annex I
category; existing certifications (ISO 42001, ISO 9001, ISO 27001);
company size; whether any system keeps learning after release]

Our current management system:
[paste policies, procedures and records we already maintain]

Produce:
1. A table of the 13 elements of AI Act Article 17(1), (a) to (m),
   with columns: element, our existing evidence, status
   (covered / partial / missing), and the action needed.
2. Which existing ISO 42001 or ISO 9001 processes can be reused, and
   what must be added for regulatory purposes.
3. The documents we still need: compliance strategy per system,
   Annex IV technical documentation, serious-incident procedure,
   authority communication procedure, post-market monitoring plan.
4. High-risk requirements outside Article 17 (Articles 9, 10, 12-15)
   that our quality system does not yet evidence.
5. The ten highest-priority actions before 2 December 2027.

Do not quote the text of EN 18286. Refer to AI Act articles only.
Use only the facts I provide and mark anything uncertain UNKNOWN.

ISO 42001 shows you govern AI well. EN 18286 shows a regulator your quality system meets the law. If you provide high-risk AI in Europe, you want the second, and you'll build it faster on top of the first. — Kumail Mehdi

Frequently asked questions

Sources

• Regulation (EU) 2024/1689 — the EU AI Act (EUR-Lex)
• Orrick — First harmonised technical standard published under the EU AI Act
• Nemko — EU AI Act cites new harmonised QMS standard
• Modulos — EN 18286 vs ISO 42001
• Cloud Security Alliance — prEN 18286 and ISO 42001
• Reglog — EN 18286 and the Digital Omnibus SME provisions
• European Commission — AI Act standardisation
• Stepto — ISO 42001 certificate count