EN 18286:2026 / Sistema di gestione della qualità ai fini della normativa UE sull'IA

EN 18286:2026 / Sistema di gestione della qualità ai fini della normativa UE sull'IA

ID 27287 | 14 Ottobre 2026 / Preview allegata (EN)

EN 18286:2026
Intelligenza artificiale - Sistema di gestione della qualità ai fini dei requisiti normativi del regolamento dell’UE sull’IA

Il presente documento specifica i requisiti e fornisce indicazioni per la definizione, l'implementazione e la manutenzione di un sistema di gestione della qualità per le organizzazioni che forniscono sistemi di intelligenza artificiale.

Il presente documento ha lo scopo di supportare l'organizzazione nel rispetto dei requisiti normativi applicabili.

È destinato principalmente alle organizzazioni che immettono sul mercato o mettono in servizio sistemi di intelligenza artificiale ad alto rischio e non è specifico di alcun settore particolare.

Data entrata in vigore 03.08.2026

_________

EN 18286:2026
Artificial intelligence - Quality management system for EU AI Act regulatory purposes

0 Introduction

0.1 General

The EU’s Artificial Intelligence Act (EU AI Act) regulates AI systems through the product safety system established under the New Legislative Framework. An AI system that is classified as high-risk and must comply with the relevant EU AI Act obligations can be a product or a component of a product.

NOTE 1 Classification rules for high-risk AI systems can be found in the EU AI Act, Article 6. 

AI systems must be in compliance with applicable regulatory requirements at the moment that the AI system is placed on the market or put into service. An AI system is placed on the market when it is supplied for first distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. An AI system is put into service when it is supplied for the first use directly to the deployer or for own use in the Union for its intended purpose.

EXAMPLE 1 An in-house developed AI system is put into service when it is used internally.

EXAMPLE 2 An AI system is placed on the market when it is offered for sale on a website.

The quality management system defined in this document can be used by a provider for one or more AI systems that are intended to be placed on the market or put into service. Quality, in this context can be understood as compliance with all of the regulatory requirements of the EU AI Act.

Depending on the intended purpose of the AI system, sector-specific regulations including obligations for a quality management system, can apply. The provider can extend a quality management system following a sector-specific regulation in such a way that it fulfils the requirements of the EU AI Act regulation instead of using a separate quality management system.

EXAMPLE 3 Medical devices are commonly compliant to EN ISO 13485 quality management system requirements. Incorporating the requirements of this document within the existing processes is desirable when achieving compliance with this document.

This document is intended for use by providers that provide AI systems irrespective of size, nature or location. The requirements and guidance in this document are, however, specifically tailored to support providers that operate inside of the European Union, and those located outside of the Union who are active in the European Union market or who intend to enter that market.

The requirements in this document are the practical implementation from specific requirements from the EU AI Act (see Annex ZA) by relying on state of the art practices from other widely used standards where possible (see informative references throughout this document).

The quality management system in this document is described in a way that the implementation can take into account the size of the provider, while providing the degree of rigour and level of protection required by applicable regulatory requirements.

Clause 1 defines the scope of applicability of this document, while
Clause 2 identifies normative references essential for its application, although there are none in this document.
Clause 3 establishes the terms and definitions used throughout this document, including terminology related to management systems, the EU AI Act, AI systems, and risk management, to ensure consistent interpretation. References to how most of these concepts are based on other standards are also provided in Clause 3.
Clause 4 specifies the requirements for establishing, implementing and maintaining the quality management system, including the identification of regulatory requirements, determination of scope, strategy for regulatory compliance, and control of documented information. After reading the Introduction and Clause 1, this is a good place to start for readers new to management system standards.
Clause 5 addresses management responsibility, defining leadership commitment, quality policy, and the assignment of roles, responsibilities, and authorities.
Clause 6 focuses on planning, including actions to address risks to the quality management system and the setting and achievement of quality objectives.
Clause 7 describes the support processes required for the effective operation of the management system, covering resources, competence, communication and awareness.
Clause 8 addresses AI system realization, detailing requirements across the AI system lifecycle, not least the “design and development” and “verification and validation” phases as well as requirements regarding data management, retirement, identification of the AI system and product documentation. Clause 8 also contains a subclause on continuous learning AI systems and their predetermined changes.
Clause 9 covers operations and control, during deployment, including monitoring, supply chain management, change control, post-market monitoring, incident reporting, and handling of non-compliance.
Finally, Clause 10 specifies requirements for performance evaluation of the management system, including reviews and planning of changes to ensure ongoing effectiveness and compliance.
Annex A describes procedures for consultation with interested parties about risks to health, safety and fundamental rights, Annex B contains the correspondence between the clauses of this document and EN ISO 9001:2015 [3], and Annex C contains the correspondence with EN ISO/IEC 42001:2026 [4].

NOTE 2 Italicised terms are defined in Clause 3.

0.2 Verbal forms

In this document, the following verbal forms are used:
- “shall” indicates a requirement;
- “should” indicates a recommendation;
- “may” indicates a permission;
- “can” indicates a possibility or a capability.

0.3 Fundamental rights

The EU AI Act aims to ensure the protection of health, safety and fundamental rights in relation to AI systems and this document sets out technical requirements to achieve this regulatory objective through a quality management system.

Fundamental rights are universal legal guarantees without which individuals and groups cannot secure their fundamental freedoms and human dignity and which apply equally to every human being regardless of nationality, place of residence, sex, national or ethnic origin, colour, religion, language or any other status as per the legal system of a country without any conditions.

The EU Charter of Fundamental Rights [5] sets out and codifies the European approach to these fundamental rights in law which is applicable throughout the EU.

NOTE Further information about their scope and strength can be found in the Charter. Additional EU and country-specific regulatory requirements can apply.

1 Scope

This document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems.

This document is intended to support the organization in meeting applicable regulatory requirements. It is primarily intended for organizations placing on the market or putting into service high-risk AI systems and is not specific to any particular sector.

2 Normative references

There are no normative references in this document.

3 Terms and definitions

For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:
- ISO Online browsing platform: available at https://www.iso.org/obp/
-  IEC Electropedia: available at https://www.electropedia.org/

3.1 Terms relating to management systems

3.1.1 
audit
systematic (3.1.30) and independent process (3.1.22) for obtaining evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled

Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party), and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization (3.1.18) itself, or by an external party on its behalf.
Note 3 to entry: “Audit criteria” is defined in EN ISO 19011. [SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.1.18, modified — Removed “audit evidence and” from Note 3.]

3.1.2
authority
authorities
ability of an individual, group or organization (3.1.18) to do something without intervention by another function on the details of that action

3.1.3
competence
ability to apply knowledge and skills to achieve intended results
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.9]

3.1.4
compliance
fulfilment of all applicable regulatory requirements (3.1.26)

[...]

Collegati

Allegati (Riservati) Abbonati Normazione

Allegati

	Descrizione	Lingua	Dimensioni	Downloads
	Preview EN 18286:2026 Abbonati Normazione	EN	880 kB	0