Article 40 of 11335%
Article 40: Harmonised standards and standardisation deliverables
EU Official:
Title III: High-Risk AI Systems
Article 40 states that high-risk AI systems and GPAI models compliant with published harmonised standards are presumed to conform with the corresponding AI Act requirements.
Official text
||
Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.
Download AI Act (PDF)→Official guidance on this article
8- Standardisation of the AI Act (policy page)Provides the current official status of the standardisation process that forms the basis for the presumption of conformity in Article 40.PublishedGuidelinesEuropean Commission, DG CONNECT (Shaping Europe's Digital Future)3 Aug 2026
- NEN webinar slides: European AI standards under the AI Act (JTC 21 work programme and timelines)Explains the distinction between publication by CEN-CENELEC and citation in the Official Journal, precisely the point at which the presumption of conformity under Article 40 does or does not arisePublishedGuidelinesNEN, Artificial Intelligence and Big Data standards committee
- Commission Implementing Decision C(2025) 3871 of 23.6.2025 on a standardisation request to CEN and CENELEC as regards high-risk AI systems in support of Regulation (EU) 2024/1689 and repealing Implementing Decision C(2023) 3215Is the formal request by which the Commission has the standards made that can provide presumption of conformity via Article 40 once they are cited in the Official JournalPublishedImplementing actEuropean Commission23 Jun 2025
- Understanding the standardisation of the AI Act (FAQ)Explains when a standard actually provides the presumption of conformity of Article 40, namely only after publication in the Official Journal and not already upon publication by CEN-CENELEC.PublishedQ&AEuropean Commission, DG CONNECT (Shaping Europe's Digital Future)10 Mar 2026
- EN ISO/IEC 42001:2026 Information technology - Artificial intelligence - Management systemIs a widely-used voluntary standard that explicitly falls outside the regime of Article 40, so that certification of it yields no legal presumption of conformityPublishedStandardISO/IEC JTC 1/SC 42, European adoption through CEN-CENELEC, Dutch adoption by NEN1 Mar 2026
- EN 18286:2026 Artificial intelligence - Quality management system for EU AI Act regulatory purposesIs the first candidate harmonised standard that can provide presumption of conformity via Article 40, but only after the Commission has the reference cited in the EU Official JournalPublishedStandardCEN-CENELEC (JTC 21), Dutch adoption by NEN31 Jul 2026
- EN ISO/IEC 23894:2024 Information technology - Artificial intelligence - Guidance on risk managementFalls outside the standardisation request and therefore provides no presumption of conformity; its application constitutes evidence, not legal cover.PublishedStandardISO/IEC JTC 1/SC 42, European adoption through CEN-CENELEC, Dutch adoption by NEN1 Feb 2024
- prEN 18228 Artificial intelligence - Risk management (draft European standard, public enquiry)Is a candidate harmonised standard under the standardisation request, but provides no presumption of conformity while it remains in draft phase.DraftStandardCEN-CENELEC JTC 21, national consultation through NEN18 May 2026
Related enforcement
No enforcement actions for this article yet. Follow developments via the Enforcement Tracker.
Related articles
Frequently asked questions
What is the role of harmonised standards under Article 40 AI Act?+
Article 40 states that high-risk AI systems and GPAI models compliant with published harmonised standards are presumed to conform with the corresponding AI Act requirements.
What if no harmonised standards are available yet?+
If no harmonised standards are available, the Commission may establish common specifications through implementing acts under Article 41.
Do SMEs also need to comply with Article 40 of the AI Act?+
Article 40 of the AI Act does not provide a general exemption for SMEs. However, the AI Act includes supportive measures and potentially lighter obligations for small and medium-sized enterprises, depending on their role in the AI value chain.
How does Article 40 of the AI Act relate to the GDPR?+
Article 40 of the AI Act complements the GDPR. While the GDPR protects personal data, the AI Act focuses on the safety and trustworthiness of AI systems. Organisations must comply with both regulations when their AI system processes personal data.
What are the deadlines for Article 40 of the AI Act?+
The AI Act follows a phased implementation. Prohibited AI practices apply from February 2025, obligations for high-risk AI systems from August 2026, and other provisions take effect gradually. The specific deadline for Article 40 depends on the category of the obligation.
Does Article 40 of the AI Act also apply to AI systems I purchase?+
Yes, Article 40 of the AI Act may also be relevant when you purchase AI systems. As a deployer, you have your own obligations under the AI Act, regardless of whether you developed the system yourself or purchased it from a provider.
What is the difference between provider and deployer under Article 40 of the AI Act?+
Under Article 40 of the AI Act, the provider is the entity that develops or places the AI system on the market, while the deployer is the entity that uses the system under its own authority. Both roles carry different obligations.
What documentation does Article 40 of the AI Act require?+
Article 40 of the AI Act requires that relevant documentation is maintained as part of the compliance process. This may include technical documentation, instructions for use, logs or declarations of conformity, depending on the classification of the AI system.