The EU AI Act and EN 18286: Turning AI Requirements into Business Practice
Oct 28, 2026AuditArtificial intelligence is creating new opportunities for organisations, but innovation also brings responsibility. As regulatory expectations grow, businesses must demonstrate not only what their AI systems can do, but how they are developed, managed and monitored.
The challenge is turning the EU AI Act's requirements into everyday business practice. EN 18286 provides a framework to help organisations make that transition.
From Regulation to Implementation
The EU AI Act establishes a risk-based framework for artificial intelligence, with specific obligations for high-risk AI systems. These extend beyond technical performance to include risk management, data governance, documentation, human oversight and ongoing monitoring.
The AI Act applies in stages rather than becoming applicable in full on a single date. Most provisions became applicable on 2 August 2026, while Regulation (EU) 2026/1744 revised the application dates for the requirements and obligations concerning high-risk AI systems. Those rules apply from 2 December 2027 for high-risk AI systems listed in Annex III and from 2 August 2028 for high-risk AI systems that are high-risk because they are safety components of, or products covered by, the Union harmonization legislation listed in Annex I.
Organisations should not treat the extended high-risk deadlines as a general postponement of the AI Act. Prohibited-practice rules and the initial AI literacy provisions have applied since 2 February 2025; governance and general-purpose AI model rules have applied since 2 August 2025; and transparency obligations under Article 50, together with other applicable provisions, have applied since 2 August 2026.
For affected organisations, these dates create an opportunity to prepare. The priority is to establish clear responsibilities, identify gaps and ensure that appropriate processes and evidence are in place before the applicable obligations take effect.
How EN 18286 Supports AI Governance
EN 18286:2026, Artificial intelligence — Quality management system for EU AI Act regulatory purposes, specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving quality management system for organisations that provide AI systems. For regulatory purposes, it is particularly relevant to providers of high-risk AI systems that must operate a documented quality management system under Article 17 of the AI Act.
Developed by CEN and CENELEC through Joint Technical Committee JTC 21, the standard addresses how organisations manage responsibilities, risks, development processes, documentation and ongoing monitoring across the AI lifecycle.
For businesses, its value lies in bringing these activities together. Rather than treating compliance as a series of disconnected tasks, organisations can establish consistent processes, strengthen accountability and identify where existing quality management systems need to be adapted for AI.
The reference to EN 18286:2026 was published in the Official Journal of the European Union through Commission Implementing Decision (EU) 2026/2274. Providers of high-risk AI systems that apply the standard may therefore benefit from a presumption of conformity with the Article 17 quality management system requirements covered by the citation. Use of the standard remains voluntary, and the presumption does not extend automatically to other AI Act requirements.
Prepare Today for Tomorrow's Requirements
Effective preparation starts with determining whether each AI system is in scope, how it is classified and which role the organisation performs, such as provider, deployer, importer, distributor, authorized representative or product manufacturer. The applicable obligations and conformity assessment route vary according to that role, the system's intended purpose and, for high-risk systems, the basis on which the system is classified as high-risk.
This may mean strengthening risk management, formalising testing and validation, improving technical documentation or establishing processes for monitoring systems after deployment.
Addressing these areas early gives organisations more time to integrate requirements into existing operations instead of treating compliance as a last-minute exercise.
How DEKRA Supports Your AI Journey
DEKRA helps organisations translate AI regulatory requirements into practical action. Through training, readiness assessments, technical testing and applicable conformity assessment services, we support businesses in understanding their obligations and determining the appropriate path forward.
For organisations preparing for EN 18286, this includes identifying gaps in existing quality management processes, understanding where specific AI controls may be needed and building the capabilities required to manage AI responsibly.
The appropriate approach depends on the system, its intended purpose and the organisation's role under the AI Act. Understanding these factors early helps establish a clearer path towards regulatory readiness and, where applicable, conformity assessment.
Build Trust into AI from the Start
Trustworthy AI requires more than technical performance. It depends on governance, accountability and evidence that risks are being managed throughout the system lifecycle.
EN 18286 provides a framework for putting the AI Act's quality management system requirements into practice. Used alongside the other standards, controls and evidence relevant to a particular AI system, it can help providers turn regulatory expectations into consistent business processes and strengthen confidence in how their AI systems are governed.
“Turning AI regulation into practice requires more than technical expertise. Organisations need robust quality management, clear responsibilities and effective processes throughout the AI lifecycle. EN 18286 helps providers establish a structured approach to meeting the EU AI Act's quality management system requirements.”
Giammarco Cirillo DEKRA | Global Business Line Manager: Information Security, Cybersecurity & AI
Explore DEKRA's EU AI Act compliance and assurance services to understand how we can support your organisation in preparing for the evolving AI regulatory landscape.