A small company building a hiring tool for the European market can read the AI Act for free. The standards that show it how to meet the Act’s technical duties are another matter, because the European standards bodies rely partly on selling them. On October 6, the European Commission proposed a new Regulation on European standardisation that would make the standards referenced in support of EU law free to read, set clocks on how long the Commission takes to request and assess standards, and let the Commission write its own technical rules when standards bodies run late.
The timing matters for AI. On October 14, World Standards Day, the Official Journal carried the first harmonised standard supporting the AI Act. CEN and CENELEC describe EN 18286:2026 as the document that translates the Article 17 quality management requirements into “practical, auditable requirements” for providers of high-risk AI systems, with a presumption of conformity for those who follow it. One standard has arrived. The proposal is the Commission’s plan for how the rest arrive faster and reach more readers.
What the proposal changes
The Commission’s own evaluation, quoted in the proposal text, found that harmonised standards still take six years on average to develop and “often miss legislative deadlines.” The proposal names AI, cybersecurity, and green technology as areas where that delay weakens the EU’s ability to lead. It would repeal Regulation (EU) No 1025/2012 and replace it with a framework that adds designated standards development organisations beyond CEN, CENELEC, and ETSI, and asks the Commission to adopt standardisation requests within 12 months of consulting those bodies and to assess delivered standards within six months.
Access is the second change. The proposal records that the Court of Justice has held harmonised standards to be part of EU law that must be freely accessible, and it states plainly that CEN and CENELEC rely partly on selling those standards. Recital 12 would require referenced standards to be available free of charge in a readable, searchable, printable, electronic format. The same recital lets standards bodies apply digital rights management against mass extraction by AI tools, so the first free AI compliance standards may arrive with copy protection.
The third change is the fallback. Article 32 would let the Commission adopt common specifications through implementing acts when standards bodies decline a request, miss the deadline, or deliver something the Commission finds non-compliant. Those specifications would carry the same presumption of conformity, stay voluntary for businesses, and be withdrawn once a compliant harmonised standard is referenced. Recital 41 adds a safeguard route: Member States, the European Parliament, or the Commission, often acting on market surveillance findings, can notify that a standard falls short, and its reference can be restricted or withdrawn.
What a faster standard can and cannot certify
These changes make AI systems easier to check. Faster standards and free access make it easier for a provider to build and document controls, and a fallback specification keeps the work moving when standards bodies stall. That is Responsible AI working as intended: systems validated against defined requirements, often by other systems, with records that survive inspection.
A presumption of conformity answers a process question. It gives a market surveillance authority a rebuttable presumption that the quality management system meets the Article 17 requirements the standard covers. The standard can require that roles and responsibilities exist. It doesn’t, by being followed, put a named person in front of a specific output with the power to accept, modify, or reject it. That threshold belongs to AI Governance, and Checkpoint-Based Governance defines it as a qualified human holding binding authority at a defined checkpoint and answering for what passes through.
The gap already appears in standards work. When ISO/TC 258 opened draft ISO/DIS 21520 for comment this year, Basil C. Puglisi filed a technical comment on Clause 3.2 proposing that the definition of AI governance include binding human decision authority and attributable accountability. The U.S. Technical Advisory Group rejected the technical comment and accepted two editorial ones. That record shows how definitions settle inside the process this proposal is trying to speed up.
Who gets into the room
Article 20 of the proposal would require national standards bodies to give SMEs, consumer organisations, social stakeholders, researchers, and public authorities access to standardisation work without membership, free or reduced-rate participation, and free access to drafts. That provision deserves more attention than the speed targets. Drafts are where definitions get written. A faster process with the same small group of contributors produces the same definitions sooner.
For organisations that build or deploy high-risk AI in Europe, three steps follow from this proposal now. Read EN 18286 against the quality management system already in place and record which clauses map to existing controls. Next to each control, name the person who decides when that control flags an output, and write down whether that person can stop it. Then track the proposal through Parliament and Council, because Article 32 would give the Commission a general route to write common specifications where standards run late, and any such draft for AI Act requirements will need a fast, informed comment.
Liability questions in Europe are moving toward product law, a shift covered in our review of the withdrawn AI Liability Directive. Free and faster standards can show a court what a careful provider’s process looked like. Providers should keep a record of who decided on each output, because no standard supplies one.
Sources
- CEN and CENELEC. (2026, October 15). First ever European standard on AI published in the OJEU [News release]. https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-10-15-en-18286-2026-published-in-ojeu
- European Commission. (2026a, October 6). Proposal for a regulation of the European Parliament and of the Council on European standardisation, repealing Regulation (EU) No 1025/2012 (COM(2026) 780 final). https://single-market-economy.ec.europa.eu/document/download/f61c3dca-d763-4d6d-b907-e17756e5c5b6_en?filename=COM_2026_780_1_EN_ACT_part1_v6.pdf
- European Commission, Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs. (2026b, October 6). Proposal for a Regulation on European standardisation [Publication page]. https://single-market-economy.ec.europa.eu/publications/proposal-regulation-european-standardisation_en
FAQ
What did the European Commission propose on October 6, 2026?
The Commission proposed a Regulation on European standardisation, COM(2026) 780, that would repeal Regulation (EU) No 1025/2012. It would make standards referenced in EU law free to read, add designated standards development organisations beyond CEN, CENELEC, and ETSI, set target timelines for standardisation requests and assessments, and let the Commission adopt common specifications when standards are late or non-compliant.
What is EN 18286:2026?
EN 18286:2026 is the first harmonised standard supporting the EU AI Act, cited in the Official Journal on October 14, 2026. CEN and CENELEC describe it as translating the Article 17 quality management system requirements into practical, auditable requirements for providers of high-risk AI systems, with a presumption of conformity for those who follow it.
Why would free access to standards matter for AI providers?
Harmonised standards show providers how to meet legal requirements, and CEN and CENELEC have relied partly on selling them. The proposal would require referenced standards to be free of charge in a readable, searchable, printable, electronic format, which lowers the cost for small providers that need to read the standard before they can apply it.
What are common specifications under the proposal?
Under Article 32, common specifications are technical rules the Commission could adopt through implementing acts when standards bodies decline a request, miss a deadline, or deliver a non-compliant standard. They would give the same presumption of conformity, remain voluntary, and be withdrawn once a compliant harmonised standard is referenced.
Does following a harmonised standard mean an AI system is governed?
Following a harmonised standard supports a presumption that the process meets the covered legal requirements. Under Checkpoint-Based Governance, AI Governance also requires a named human with binding authority to accept, modify, or reject outputs at defined checkpoints, and a conformity presumption does not by itself create that authority.
What should organisations deploying high-risk AI in Europe do now?
Map EN 18286 against the existing quality management system, name the person who decides when each control flags an output and whether that person can stop it, and track the standardisation proposal through Parliament and Council so the organisation is ready to comment if the Commission drafts common specifications for AI Act requirements.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply