The AI Act stopped being a text yesterday.
- The EU AI Act
- Harmonised standards and conformity
- AI procurement
- Enforcement and supervision
- AI literacy and the Article 4 duty
On 19 October the Commission published the reference to the first harmonised standard under the AI Act in the Official Journal. It is EN 18286:2026 — a quality management system standard written for the Act's regulatory purposes, developed by CEN and CENELEC, and brought in through Implementing Decision (EU) 2026/2274.
The legal consequence is narrow and specific: a provider of a high-risk AI system who implements EN 18286 gets a presumption of conformity with the quality management requirements in Article 17. It is the only AI quality management standard with that presumption. It is built around the AI system's lifecycle rather than the organisation, and it is designed to sit on top of ISO/IEC 42001, ISO 9001 or a sectoral system such as ISO 13485, not replace them.
Our view
Most associations are not providers. You are deployers, and Article 17 is not your article — so nothing about your own compliance changed yesterday. What changed is that a question you could not previously answer now has a standard behind it. Until yesterday, "is this supplier trustworthy?" was a matter of impression. From today it has a reference: EN 18286, or ISO/IEC 42001 sitting underneath it. That is worth more to you than the standard itself, because it costs one line in a procurement template and it moves the burden of proof onto the seller.
What moved
EN 18286:2026 entered the Official Journal
First harmonised standard supporting the AI Act, published 19 October through Implementing Decision (EU) 2026/2274. Presumption of conformity with Article 17 quality management requirements for high-risk providers.
For associations: Add one question to supplier due diligence: "Do you work to EN 18286, or ISO/IEC 42001 beneath it?" A supplier who cannot answer has told you something useful.
Enforcement has been live since 2 August
Powers are split: the AI Office handles general-purpose models, systemic risk, and AI inside very large platforms and search engines. National competent authorities handle everything else. The EDPS covers the EU institutions. Those powers began applying on 2 August 2026.
For associations: Know which national authority is yours before you need them. An association deploying AI for member services sits under its own member state's authority, not under the AI Office.
The lobbying against the Act is organised
Politico reported in October that major technology firms are pressing to revamp the Act, and that a Hungarian paper circulated to member states calls it a "solid foundation" while naming three remaining gaps.
For associations: Do not build a plan that assumes relief. The Act is being amended, but amended is not repealed, and the obligations that already apply — including AI literacy — are not in the parts being argued over.
Still moving · the last seven days
The AI Office is already asking for incident reports
Bird & Bird's reading of a 12 October Commission news item: the AI Office has requested and received serious incident reports, which puts the Act's research exemption under real pressure. If your sector newsletter says "nothing is enforced yet", that is out of date.
The ECB made the case in Dublin
Philip Lane's 13 October remarks at the International AI Summit framed AI as a general-purpose technology and Europe's problem as adoption, not invention. Useful ammunition if your board still treats AI as an IT line item.
The deployer-facing guidance is French and European, not British
The CNIL updated its traceability tool for open-weights models in late August, and the EDPB has been working through anonymisation and web scraping for generative AI. It remains the most practical material available to an organisation that deploys rather than builds.
The association angle
The obligation you already have
Article 4 of the AI Act — AI literacy — has applied since 2 February 2025 and was never deferred. It covers deployers, not just providers. It is an obligation of effort, not of outcome, which means the defensible position is not a certificate; it is a record. A register of who was trained, on what, when, by role. If your staff use AI to draft member communications, summarise consultations or answer enquiries, you are a deployer and that record is your evidence.
If you want that register built and kept for you rather than started in a spreadsheet, that is a First Build — one job, ten working days.
One thing to read
The Commission's publication noticeShort, primary, and the only version of this that will not be paraphrased badly by somebody else.
— Titus