harmonised standards
In plain wordsOfficial European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch.
European standards that CEN, CENELEC or ETSI write in response to a formal request from the European Commission, to turn the requirements of an EU law into technical specifications. Once the Commission has cited such a standard in the Official Journal, following it gives a legal presumption that the requirements it addresses are met. Under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., harmonised standards are to cover the requirements for high-risk systemshigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks. — risk management, data quality and governance, logging, transparency, human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., accuracy, robustness, cybersecurity and quality management — and may later cover the obligations of general-purpose modelgeneral-purpose AI model, n.: The EU's legal name for the large, adaptable AI models behind chatbots and similar tools: models that can turn their hand to many different jobs and be built into many other products. providers. Where standards are missing or inadequate, the Commission may adopt 'common specifications' by implementing act. The first AI Act standard, EN 18286 on quality management systems, was cited in the Official Journal on 14 October 2026; standards on risk management, logging, accuracy and robustness, and dataset quality were still in preparation.
Until the harmonised standards are cited, we have to justify every design choice against the text of the Act.
Origin
A core tool of the EU's 'New Approach' to product regulation, adopted in 1985. For AI, the Commission sent a standardisation request to CEN and CENELEC in May 2023; their Joint Technical Committee 21 missed the original April 2025 deadline, a delay that fed the case for the 2026 Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year. postponement.
Usage note
Distinct from international standards such as ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality., which give no presumption of conformity unless adopted as European standards and cited. Critics question whether industry-dominated standards bodies should decide how fundamental-rights requirements are met.
Related
- conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.
- ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality.
- ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- notified bodynotified body, n.: An independent testing and certification organization, approved by an EU government, that checks whether certain risky products — including some AI systems — meet the law before they can be sold.
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
Sources
- CEN-CENELEC (2026). EN 18286:2026 Artificial intelligence — Quality management system for EU AI Act regulatory purposes.
- Commission Implementing Decision (EU) 2026/2274, citing EN 18286:2026 in support of Regulation (EU) 2024/1689. OJ L, 14.10.2026. eur-lex.europa.eu/eli/dec_impl/2026/2274/oj
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 3(27) and Art. 40; common specifications Art. 3(28) and Art. 41; Regulation (EU) No 1025/2012, Art. 2(1)(c)
Mentioned in
high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used., Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year., General-Purpose AI Code of PracticeGeneral-Purpose AI Code of Practice, prop. n.: A voluntary rulebook, published by the EU in 2025, that makers of large AI models can sign to show they follow the EU AI Act's rules on transparency, copyright and safety., ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality., European Artificial Intelligence BoardEuropean Artificial Intelligence Board, prop. n.: A committee of representatives from every EU country that helps apply the EU AI Act consistently across Europe and advises the European Commission., ISO/IEC 22989ISO/IEC 22989, prop. n.: An international standard that fixes agreed meanings for basic AI words — such as AI system, machine learning and trustworthiness — so that other standards, contracts and laws can use the same vocabulary., ISO/IEC 23894ISO/IEC 23894, prop. n.: An international guidance standard that explains how organizations can apply ordinary risk-management practice to the particular risks of AI systems., ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC., notified bodynotified body, n.: An independent testing and certification organization, approved by an EU government, that checks whether certain risky products — including some AI systems — meet the law before they can be sold.