The first harmonised standard for the AI Act is here

A shortcut to showing conformity

The AI Act sets requirements. It does not tell you exactly how to meet them. That's where harmonised standards come in.

Think of it like this: the law says your car must have working brakes. A harmonised standard is a published recipe for one kind of brake system that, if you follow it, means the authorities assume your brakes work. You can still design a different brake system, but then you have to show in another way that it meets the law's requirements.

EN 18286, published by CEN and CENELEC in January 2025 and now referenced in the Official Journal, is the first such recipe for the AI Act ^[1]. It addresses quality management systems for high-risk AI providers.

What the standard covers

EN 18286 gives providers one way to satisfy some of the Act's quality requirements ^[2]. It covers:

• Quality management systems (Article 17)
• Risk management systems (Article 9, in part)
• Technical documentation (Article 11, in part)
• Post-market monitoring (Article 72, in part)
• Parts of the documentation listed in Annex IV

It does not cover every requirement. Article 12, for example, requires high-risk systems to allow for automatic logging of events. The standard does not address that, so a provider following EN 18286 still has to meet the logging duty separately ^[3].

Voluntary, but useful

Harmonised standards are not compulsory ^[4]. A provider can choose another route to showing conformity: internal checks, third-party testing or documented processes that achieve the same result.

The advantage of a harmonised standard is the presumption of conformity. If a provider follows it, authorities presume the provider meets the requirements the standard covers, unless they have reason to think otherwise.

For providers preparing for the high-risk deadlines, the standard gives a tested framework. For notified bodies assessing conformity, it gives something concrete to check against.

When it applies

The timelines in the AI Act have not changed. High-risk systems under Annex III must meet the requirements from 2 December 2027. High-risk systems under Annex I, such as those used as safety components of certain products, must meet them from 2 August 2028 ^[5].

EN 18286 is available now, so providers can start using it well before those dates.

What this means for you

If you build or sell high-risk AI, here are three questions worth asking:

1. Does your system fall under Annex III or Annex I, and which date applies to you?
2. Which requirements does EN 18286 help you meet, and which ones does it leave out?
3. Do you have a plan for the requirements the standard does not cover, such as logging?

If you are preparing a conformity assessment, the standard gives you a roadmap for the quality side. It does not give you the whole map.

How a digital witness fits here

EN 18286 addresses quality management, risk management and documentation. It does not say how to meet Article 12's duty to allow for automatic logging of events.

That's where a digital witness comes in. The thing to seal is each log record as it is written: the event, the time, the system state and any human review. Sealing takes a fingerprint, not the data, so the log itself never leaves your systems.

If a supervisor or a notified body wants to know what your system logged on a given day, anyone you share the record with can check that it is the one written at that time. A change of even one character makes the fingerprint mismatch.

A digital witness does not replace the quality management system. It makes the logs hold up when someone questions them later.

You can seal log records through the REST API, the SDK or the MCP server at WitniumChain. The content stays with you. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Your system writes a log entry and calculates its fingerprint.
2. The fingerprint is sent to WitniumChain and sealed on a chain where any later change would show.
3. When an auditor or a notified body asks for the log, you calculate the fingerprint again. If it matches, the log is unchanged since the day it was written.

What to watch

More harmonised standards are on their way. CEN and CENELEC are working on standards for transparency, robustness and human oversight, among other topics ^[6]. Each one, when published and referenced in the Official Journal, will give providers another voluntary route to showing conformity.

In the meantime, the first deadline is 2 December 2027 for Annex III systems. If your AI fits that category, now is the time to map which requirements apply and how you will meet them.

Sources