Certification

EN 18286 AI Quality Management System Certification

The European standard for AI quality management.

Demonstrate alignment with quality management requirements supporting EU AI Act compliance

As organizations and consumers put more trust in AI, they need confidence that the systems behind important decisions are safe, reliable, and well managed.

EN 18286 certification provides independent third-party evidence that your AI QMS aligns with recognized requirements for quality, safety and conformity throughout the AI system lifecycle. Developed to support the EU AI Act Article 17 requirements, it provides a structured framework for managing AI systems and demonstrating effective governance.

Certification can help you build buyer confidence, demonstrate responsible AI practices and differentiate in competitive markets, while providing a scalable framework to support EU AI Act readiness and evolving obligations.

Key benefits of EN 18286 Certification

Strong foundation for demonstrating compliance with the Article 17 QMS requirements of the EU AI Act.
Build confidence with regulators, buyers and investors through credible, third-party assurance.
Establish a scalable AI governance foundation as your portfolio and regulatory obligations evolve.
Support broader EU AI Act readiness by embedding structured processes across the AI system lifecycle.

FAQs

Frequently Asked Questions about EN 18286 Certification

EN 18286 is the new European standard for Artificial Intelligence - Quality management system for EU AI Act regulatory purposes, developed by CEN-CENELEC to support implementation of the EU AI Act. It provides organizations that develop or provide AI systems with a practical framework to address the Article 17 requirement for a documented QMS.

Once its reference is published in the Official Journal of the European Union as a harmonized standard under the AI Act, EN 18286 is expected to provide presumption of conformity with the Article 17 requirements covered by the standard.
The two standards answer different questions and work best together. The international standard for AI management systems (ISO/IEC 42001) governs how your organization manages AI responsibly at an organizational level. EN 18286 focuses on the quality management system requirements needed to support regulatory conformity of AI systems throughout their life cycle.

ISO/IEC 42001 provides the organizational foundation; EN 18286 adds the AI Act-specific quality management requirements of Article 17. Many of the management elements you build for ISO/IEC 42001 can be reused, so you adopt rather than rebuild from scratch.
ISO/IEC 42001 provides a strong organizational framework for AI management. EN 18286 builds on this by introducing quality management system requirements intended to support conformity with Article 17 of the EU AI Act.

These include conformity assessment planning, post-market monitoring, serious incident reporting, and communication with regulatory authorities.

The standard also places greater emphasis on individual AI systems and their regulatory conformity, rather than organizational AI governance alone.

EN 18286 defines quality more broadly than many organizations are used to – covering not only stakeholder expectations but regulatory obligations, including health, safety and fundamental rights.
Possibly. If your AI system is classified as high-risk under the EU AI Act – for example, a safety component of a medical device or a medical AI system itself, that requires third-party conformity assessment – then you'll need to demonstrate conformity with Article 17.

EN 18286 is designed to integrate into an existing sector quality management system rather than create a second, parallel one, so it can sit alongside your current certification.
The starting point is to determine whether the system falls within an Annex I regulated products or an Annex III use case under the AI Act. From there, you should assess the system's intended purpose against the relevant AI Act categories and identify any applicable exclusions or exemptions.

It's also important to maintain documented classification decisions as part of your AI governance process, since these records will be expected as part of any conformity assessment.
There's meaningful progress you can make before the standard is formally cited. You could perform a gap analysis between your existing ISO/IEC 42001 controls and the EN 18286 requirements – most organizations find they have more building blocks in place than they expect.

You could also create and maintain an inventory of your AI systems, capturing intended purpose, data sources, deployment context and likely AI Act risk classification. Consider implementing or strengthening life cycle processes for validation, monitoring, incident management and regulatory evidence collection, while keeping track of publication and harmonization developments under the AI Act.
Organizations may provide AI systems with different risk classifications within a single QMS. The scope of certification should clearly define the AI systems covered by the QMS and the certification assessment.

Where high-risk AI systems are within scope, the QMS should address the applicable EU AI Act requirements, including the Article 17 requirements. EN 18286 provides a framework to support these requirements within an integrated QMS.

This means that organizations do not necessarily need separate QMS solely because their AI systems have different risk classifications. The applicable regulatory requirements will depend on the classification and intended purpose of each AI system.