EN 18286:2026: the AI Act's first harmonised standard is here

What the standard does

EN 18286:2026 is the first harmonised standard under the AI Act to make it into the Official Journal ^[1]. It landed on 15 October 2026, in Commission Implementing Decision (EU) 2026/2274, and it covers quality management systems for high-risk AI under Article 17.

Think of it like an MOT checklist. The car still has to be roadworthy, but the checklist tells you what the inspector will look for and in what order. EN 18286 is the checklist for Article 17: how you organise quality, who is responsible, and how you keep improving. Follow it, and you get a presumption of conformity with Article 17's requirements ^[2].

That presumption matters. It means that if a supervisor or a notified body asks whether you comply with Article 17, the answer is yes, assuming you actually follow the standard. Without it, you have to make the case yourself.

What it covers, and what it doesn't

The standard is specific. It tells you how to set up a quality management system: documented processes, management responsibility, resource planning, risk assessment and post-market monitoring ^[1]. It does not tell you how to log events, document your system or govern your data. Those are separate articles, and they are waiting for their own standards.

Article 12 says high-risk AI systems must allow for automatic logging over their lifetime ^[4]. Article 11 asks for technical documentation ^[5]. Article 10 covers data governance ^[6]. EN 18286 touches none of them. So if you are waiting for a standard to tell you how to protect your logs, you are still waiting.

That gap is the interesting part. The law says what to log. The standard says how to organise quality. Neither one says how you show, six months later, that a log hasn't been edited.

What this means for you

If you are building or running high-risk AI under Annex III, Article 17 applies from 2 December 2027 ^[3]. EN 18286 gives you a route to compliance for that article, so it is worth reading now.

But quality management is one piece. You still need to solve logging, documentation and data governance, and those pieces do not yet have harmonised standards. So here are three questions to ask:

• Can we show what our system logged on a given day, unchanged?
• Do we have a documented process for freezing and versioning training data?
• If a supervisor asked for our technical documentation tomorrow, could we hand it over?

The first question is the one this standard does not answer.

How a digital witness fills the gap

Article 12 requires logs. EN 18286 requires a quality management system. Neither one tells you how to prove a log is the same one written at the time.

Here is where a digital witness comes in. Each log entry, or each batch of entries, gets a fingerprint when it is written. That fingerprint is sealed on WitniumChain, which keeps a permanent, checkable record. The log itself stays on your systems. Nobody sees the content unless you share it.

Later, when an auditor, a supervisor or a court asks whether the log has changed, you calculate the fingerprint again. If it matches the sealed one, the log is unchanged. If it doesn't, something has moved.

Say your model declines a loan application. Article 12 asks you to log the input reference, the model version, the output and the reviewer. Seal that record as it is written. Six months later, when the applicant asks for an explanation, you have a log you can show, and anyone you share it with can check that it is the one written on the day.

A digital witness does not prove the decision was fair, lawful or correct. It shows the log is unchanged. That is the part Article 12 requires and EN 18286 does not cover.

The standard says your quality management system must include document control and records management ^[1]. A digital witness is how you make those records hold up when someone questions them.

How it would work

1. Your logging system writes an entry and sends a fingerprint to WitniumChain through the REST API, the SDK or the MCP server.
2. WitniumChain seals the fingerprint and returns a witness ID, without ever seeing the log content.
3. When the log is questioned, you or an auditor calculates the fingerprint again and checks it against the sealed one.

The first 2,000 witnesses a month are free. Read the documentation at witniumchain.com/docs.

What to watch

EN 18286 is the first standard, not the last. The European Commission is expected to adopt harmonised standards for Articles 10, 11 and 12 over the coming months. When those arrive, the picture will be more complete.

For now, 2 December 2027 is the date that matters for Annex III systems ^[3]. That is when the high-risk requirements, including Article 17, come into force. If your AI falls under Annex III, you have just over a year to get your quality management system in order and to decide how you will make your logs stand up to scrutiny.

The standard gives you the checklist for quality. The logging question is yours to answer.