New AI quality standard: what evidence should you ask your supplier for?

This analysis first appeared as the weekly Praxikon newsletter.

New AI quality management standard published

On 14 October, the reference to EN 18286:2026 was published in the EU Official Journal. The standard concerns quality management for providers of high-risk AI, including post-market monitoring. Compliance creates a presumption of conformity with the requirements the standard covers. This follows from Implementing Decision (EU) 2026/2274. It is therefore not general proof that your entire AI application meets every legal requirement.

What does this mean for you?

Are you a provider of a high-risk system? This offers a reference point for preparing for Article 17: a documented quality management system. Article 17 of the AI Act covers testing, change management and responsibilities, among other matters. If you only use a purchased system, this provider obligation does not automatically fall on you.

Our practical recommendation: when a supplier makes a claim about this standard, ask which system, version and requirements it covers, and request the evidence. A reference to a standard on a sales slide says little about the application you actually put into use. Record which questions remain unanswered.

The application dates remain unchanged

The Digital Omnibus on AI moved the high-risk obligations in Chapter III, Sections 1 to 3, to 2 December 2027 for Article 6(2) and Annex III, and 2 August 2028 for Article 6(1) and Annex I. Publication of the standard does not change those dates. For existing systems, the transitional provisions must also be assessed separately.

Action for this week

Choose one AI application you are developing or planning to procure. Arrange a short working session with the process owner and the person managing the supplier or development work. Address these four points:

1. Role and use. Describe what the application is used for, who provides it and who uses it. Record any uncertainty about its classification as an open question; do not accept the supplier’s label without checking.
2. Evidence. Ask which requirements the supplier considers covered by EN 18286:2026 and what evidence is available. For any certificate, also ask about its scope, validity and the system version concerned.
3. Fit. Compare the available documentation with your own arrangements for testing, changes and incidents. Record where a responsible person, procedure or check is missing.
4. Follow-up. Assign one owner to each missing item and agree an internal delivery date. Keep answers and evidence in one accessible location.

This is our practical recommendation, not an official standard checklist or a complete conformity assessment. The aim for this week is a record of what you know, what is missing and who will investigate it.

Would you like to structure your findings? Use the Praxikon AI register and AI policy templates as a starting point. A completed template does not, by itself, demonstrate compliance with EN 18286:2026.

Until next Tuesday.
Zahed Ashkara
Praxikon