EU publishes first AI Act standard, EN 18286: schools and employers should ask suppliers if they meet it

The European Commission published the first harmonised standard supporting the EU AI Act on 19 October 2026. The standard, EN 18286:2026, is titled "Artificial intelligence - Quality management system for EU AI Act regulatory purposes". It was developed by the European standards bodies CEN and CENELEC, and its reference was published in the Official Journal through Commission Implementing Decision (EU) 2026/2274.

The standard sets out how a provider of high-risk AI systems should run a quality management system under Article 17 of the Act, built around the lifecycle of the AI system rather than the organisation. Providers that implement it gain a presumption of conformity with the Article 17 requirements it covers. The Commission says it is the only AI quality management standard with that status. It is designed to sit on top of existing standards such as ISO/IEC 42001, ISO 9001 or sector systems like ISO 13485, not replace them. The Commission notes the requirements for high-risk AI systems apply from December 2027 and August 2028, and that further harmonised standards are expected to follow.

For most people this sounds distant, but it changes what a buyer can ask. Until now a school, college, university or employer choosing an AI tool had little to check beyond a supplier's own assurances. A published standard gives procurement teams, governors and trustees a concrete reference point: a named document a supplier either works to or does not. The Commission page does not mention education specifically, but any AI tool that falls into the high-risk category will have a provider expected to show how it manages quality.

Dan Fitzpatrick's reading is that the standard is useful for the questions it lets leaders ask, not because it solves anything by itself. A quality management system describes how a supplier works. It does not tell a headteacher whether a tool helps children think better or leaves them thinking less. That judgement stays with the people who know the learners. The risk is that standards arrive in a language only compliance teams read, while teachers and managers are already using these tools every day.

School leaders, trustees and business leaders can act now without waiting for 2027. Add three questions to every AI purchase: does the supplier expect its product to be high-risk under the AI Act, which standard does it work to, and who is accountable for it inside the supplier. Ask for answers in writing. Keep a simple register of the AI tools in use, who owns each one, and what staff are told about them. And train staff on how to question AI output, because no standard replaces that habit.

Dan Fitzpatrick is placed to comment because his work is helping schools, educators and organisations adopt AI with clear policy and sound judgement, which is where regulation meets daily practice.

Dan Fitzpatrick is available for interview and comment on this story. He is available today for live or pre-recorded radio, TV, podcast and print interviews, with a broadcast-quality remote setup for live or pre-recorded down-the-line interviews. Contact: dan@theaieducator.io