EN 18286:2026
(Main)Artificial intelligence - Quality management system for EU AI Act regulatory purposes
- Abstract
This document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems.
This document is intended to support the organization in meeting applicable regulatory requirements. It is primarily intended for organizations placing on the market or putting into service high-risk AI systems and is not specific to any particular sector.
- Status
- Published
- Publication Date
- 21-Jul-2026
- Technical Committee
- CEN/CLC/JTC 21 - Artificial Intelligence
- Drafting Committee
- CEN/CLC/JTC 21/WG 2 - Operational aspects
- Current Stage
- 6060 - Definitive text made available (DAV) - Publishing
- Start Date
- 22-Jul-2026
- Due Date
- 27-Jan-2027
- Completion Date
- 22-Jul-2026
EN 18286:2026 is a CEN European Standard for a quality management system for artificial intelligence under EU AI Act regulatory purposes. It specifies requirements and guidance for organizations that provide AI systems, especially providers placing high-risk AI systems on the market or putting them into service. In practice, it helps an organization build the policies, controls, records and reviews needed to support regulatory compliance across the AI system life cycle.
What does EN 18286:2026 specify?
EN 18286:2026 specifies how an organization providing AI systems should define, implement and maintain a quality management system that supports compliance with applicable regulatory requirements. The document is sector-neutral, but it is written mainly for providers of high-risk AI systems in the European Union market.
Clause 1 sets the scope. Clause 2 states that there are no normative references. Clause 3 defines the terms used throughout the document. Clauses 4 to 10 cover the quality management system, leadership, planning, support, AI system realization, operations and control, and performance evaluation.
| Annex | What it covers |
|---|---|
| Annex A | Understanding the needs and expectations of interested parties regarding health, safety and fundamental rights |
| Annex B | Correspondence between this document and EN ISO 9001:2015 |
| Annex C | Correspondence between this document and EN ISO/IEC 42001:2026 |
| Annex ZA | Relationship between this European Standard and the requirements of Regulation (EU) 2024/1689 aimed to be covered |
What are the key requirements of EN 18286:2026?
EN 18286:2026 is built around a management system that ties organizational controls to AI Act obligations. The most important requirements are the ones that connect legal compliance, life-cycle controls, records and post-market action.
Quality management system, scope and compliance strategy
Clause 4 requires the provider to establish and maintain the quality management system so that health, safety and fundamental rights are protected in line with applicable regulatory requirements. The provider must identify and systematically review those requirements, define the scope of the quality management system, and keep a documented strategy for regulatory compliance.
That strategy is not just a policy statement. It has to cover essential requirements, post-market monitoring, serious incidents, data management, the choice and use of conformity assessment procedures, and modifications to AI systems. In practice, this means the provider must decide how each regulated obligation will be met and keep that approach documented.
Clause 4.4.2 identifies the essential requirements linked to risk management, data and data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity. Clause 4.4.3 allows the provider to meet those requirements using harmonized standards, common specifications, other standards or other technical specifications, but the chosen measures and any gaps must be documented.
Leadership, roles, resources and awareness
Clauses 5 to 7 place responsibility on top management. The provider must set the quality policy, establish quality objectives, assign roles and authorities, provide resources, and ensure competence, communication and awareness.
This matters because the document expects named responsibility for regulatory compliance, AI system risk management, and review of regulatory requirements and state of the art. Personnel need to understand their duties, the quality policy, and what happens if the system is not followed. The provider must also make sure that communication is accessible and that relevant personnel can understand the regulatory requirements, the intended purpose, and the implications for health, safety and fundamental rights.
Life-cycle control of AI systems
Clause 8 requires documented processes across the AI system life cycle, from inception through design and development, verification and validation, data management, retirement, identification and product documentation. The provider must define AI system requirements that are complete, unambiguous, and capable of verification and validation.
Verification and validation are treated as separate controls. Verification checks whether the AI system meets its specifications, while validation checks whether it can meet the intended purpose. The document expects test plans and procedures, documented acceptance criteria, and reproducible conditions such as hardware, software versions, seeds, datasets and handling of stochastic behavior. In practice, this means test evidence must be good enough for internal review, notified bodies and competent authorities.
The same clause also addresses continuous learning AI systems. The provider must define and document predetermined changes, verify and validate those changes, log them, and explain the learning behavior in the technical documentation and instructions for use.
Operations, monitoring and incident handling
Clause 9 covers what happens after the AI system is placed on the market or put into service. The provider must ensure unique identification for traceability, control suppliers and externally provided items, manage modifications, and monitor the AI system after deployment.
A substantial modification is treated as a new AI system and needs a new conformity assessment. That is important for change control, because not every update can be handled as routine maintenance. The provider must also keep a post-market monitoring system, investigate serious incidents, report them to the competent authorities within the required time scales, and act on non-compliance through corrective action, withdrawal, disablement or recall where appropriate.
Review and improvement
Clause 10 requires periodic management review using clear and measurable criteria. The review must consider feedback, complaints, audits, monitoring results, corrective actions, changes in regulatory requirements, and the performance of the AI system in operation.
The document also requires planned and controlled changes to the quality management system itself. If a new AI system enters scope or an existing one is substantially modified, the provider must review whether the processes still fit the new situation and revise them if needed.
What terms does EN 18286:2026 define?
- AI system - A machine-based system that operates with varying levels of autonomy, can adapt after deployment, and infers outputs from inputs for explicit or implicit objectives.
- provider - The natural or legal person, public authority, agency or other body that develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark.
- regulatory requirement - A requirement defined by applicable regulation that must be met to comply with that regulation, including at least the EU AI Act and related health, safety and fundamental rights law.
- quality objective - A measurable goal set to ensure that regulatory requirements are consistently met throughout the life cycle.
- substantial modification - A post-market change that was not foreseen or planned in the initial conformity assessment and that affects compliance or changes the intended purpose.
- serious incident - An incident or malfunctioning of an AI system that leads to death, serious harm, major disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment.
- traceability - The ability to trace the AI system and its history, including how it was specified, developed, verified, validated, operated, monitored and retired.
- risk management - The systematic and continuous application of policies, procedures and practices to analyse, evaluate, control and monitor risk throughout the entire life cycle of an AI system.
Who uses EN 18286:2026?
EN 18286:2026 is intended for providers of AI systems, especially organizations placing high-risk AI systems on the market or putting them into service in the European Union. It is not tied to one sector, so it can be used in industrial, digital, public-sector, transport, healthcare and other settings where AI systems are supplied.
In practice, it is used by top management, quality managers, regulatory and compliance teams, AI development leads, verification and validation teams, data governance teams, supply-chain managers, post-market surveillance teams and incident-response teams. Notified bodies, competent authorities and auditors can also use the document to check whether the provider’s management system and evidence match the expected regulatory controls.
Which standards are used with EN 18286:2026?
EN 18286:2026 has no normative references, but it points to several related standards and companion documents that help with implementation.
- EN ISO 9001:2015 - Annex B shows how its clauses correspond to this document, which helps organizations reuse existing quality management system structures.
- EN ISO/IEC 42001:2026 - Annex C shows the clause correspondence with the AI management system standard, useful for organizations that already use an AI management framework.
- EN 18228 - Used for AI risk management, including the risk management system referenced in Clauses 8 and 9.
- EN 18284 - Gives further guidance on quality and governance of datasets in AI, supporting the data management requirements.
- EN 18229-1 and EN ISO/IEC 24970 - Support AI system logging and record creation for monitoring, compliance and investigation.
- EN 18229-2 - Supports accuracy and robustness considerations.
- EN 301549 - Provides accessibility requirements relevant to the document’s competence and inclusive-use considerations.
- EN ISO/IEC 22989 and ISO/IEC/IEEE 29148 - Support AI concepts, terminology and requirements engineering.
- ISO/IEC/IEEE 29119-1 - Supports test procedure concepts used in verification and validation.
- EN ISO 45001 - Supports the consultation concept used in Annex A.
What does the EN 18286:2026 document contain?
EN 18286:2026 contains management-system requirements, AI life-cycle controls, documented-information rules, verification and validation requirements, post-market monitoring, incident reporting, and non-compliance handling. It also includes a life-cycle model figure in Clause 8 and a detailed set of defined terms in Clause 3.
Annex A describes how to consult affected persons and other interested parties about health, safety and fundamental-rights risks. Annex B and Annex C map the document to EN ISO 9001:2015 and EN ISO/IEC 42001:2026. Annex ZA maps selected clauses to Regulation (EU) 2024/1689 and explains where the standard is intended to support conformity.
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
EN 18286:2026 is a standard published by the European Committee for Standardization (CEN). Its full title is "Artificial intelligence - Quality management system for EU AI Act regulatory purposes". This standard covers: This document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems. This document is intended to support the organization in meeting applicable regulatory requirements. It is primarily intended for organizations placing on the market or putting into service high-risk AI systems and is not specific to any particular sector.
This document specifies the requirements and provides guidance for the definition, implementation and maintenance of a quality management system for organizations that provide AI systems. This document is intended to support the organization in meeting applicable regulatory requirements. It is primarily intended for organizations placing on the market or putting into service high-risk AI systems and is not specific to any particular sector.
EN 18286:2026 is classified under the following ICS (International Classification for Standards) categories: 03.100.70 - Management systems; 35.240.01 - Application of information technology in general. The ICS classification helps identify the subject area and facilitates finding related standards.
EN 18286:2026 is associated with the following European legislation: EU Directives/Regulations: 2024/1689; Standardization Mandates: M/593, M/593, M/613, M/XXX AI, M/XXX AI. When a standard is cited in the Official Journal of the European Union, products manufactured in conformity with it benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation.
EN 18286:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-oktober-2026
Umetna inteligenca - Sistem vodenja kakovosti za namene regulativnih zahtev
Akta EU o UI
Artificial intelligence - Quality management system for EU AI Act regulatory purposes
Künstliche Intelligenz - Qualitätsmanagementsystem für EU-AI-Act-Regulierungszwecke
Intelligence artificielle - Système de management de la qualité pour le règlement
européen sur l'IA
Ta slovenski standard je istoveten z: EN 18286:2026
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.10 Vodenje in zagotavljanje Quality management and
kakovosti quality assurance
35.240.01 Uporabniške rešitve Application of information
informacijske tehnike in technology in general
tehnologije na splošno
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN 18286
NORME EUROPÉENNE
EUROPÄISCHE NORM
July 2026
ICS 35.240.01
English version
Artificial intelligence - Quality management system for EU
AI Act regulatory purposes
Intelligence artificielle - Système de management de la Künstliche Intelligenz - Qualitätsmanagementsystem
qualité pour le règlement européen sur l'IA für EU-AI-Act-Regulierungszwecke
This European Standard was approved by CEN on 12 July 2026.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN 18286:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 4
0 Introduction . 5
1 Scope . 7
2 Normative references . 7
3 Terms and definitions . 7
3.1 Terms relating to management systems . 7
3.2 Terms relating to the EU AI Act . 13
3.3 Terms relating to AI systems . 15
3.4 Terms relating to risk management . 16
4 Quality management system . 18
4.1 General . 18
4.2 Identifying regulatory requirements . 18
4.3 Determining the scope of the quality management system . 18
4.4 Strategy for regulatory compliance . 19
4.5 Documented information . 20
5 Leadership . 22
5.1 General . 22
5.2 Quality policy . 22
5.3 Roles, responsibilities, and authorities . 23
6 Planning . 24
6.1 Actions to address risks related to the functioning of the quality management system . 24
6.2 Quality objectives and planning to achieve them . 24
7 Support . 25
7.1 Resources . 25
7.2 Competence . 25
7.3 Communication . 26
7.4 Awareness . 27
8 AI system realization . 28
8.1 Processes and procedures along the AI system lifecycle . 28
8.2 Actions to address risks of AI systems . 30
8.3 Inception, design and development . 30
8.4 Verification and validation . 32
8.5 Data management . 33
8.6 Retirement . 34
8.7 Identification of the AI system . 34
8.8 Continuous learning AI systems . 34
8.9 Product documentation . 35
9 Operations and control . 35
9.1 Placing on the market and putting into service . 35
9.2 Support services . 35
9.3 Supply chain . 36
9.4 Modifications to AI systems . 37
9.5 Post-market monitoring . 37
9.6 Reporting serious incidents . 39
9.7 Non-compliance . 40
10 Performance evaluation . 41
10.1 Management review . 41
10.2 Planning of changes . 43
Annex A (informative) Understanding the needs and expectations of interested parties
regarding health, safety and fundamental rights . 45
Annex B (informative) Correspondence between this document and EN ISO 9001:2015 . 46
Annex C (informative) Correspondence between this document and EN ISO/IEC 42001:2026 . 47
Annex ZA (informative) Relationship between this European Standard and the requirements
of Regulation (EU) 2024/1689 aimed to be covered . 48
Bibliography . 50
European foreword
This document (EN 18286:2026) has been prepared by the Joint Technical Committee CEN/CLC/JTC 21
“Artificial Intelligence”, the secretariat of which is held by DS.
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by January 2027 and conflicting national standards shall be withdrawn
at the latest by January 2027.
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document has been prepared under a standardization request addressed to CEN-CENELEC by
the European Commission. The Standing Committee of the EFTA States subsequently approves these
requests for its Member States.
For the relationship with EU Legislation, see informative Annex ZA, which is an integral part of this
document.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN-CENELEC website.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus,
Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North
Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the United
Kingdom.
0 Introduction
0.1 General
The EU’s Artificial Intelligence Act (EU AI Act) [1] regulates AI systems through the product safety system
established under the New Legislative Framework. An AI system that is classified as high-risk and must
comply with the relevant EU AI Act obligations can be a product or a component of a product.
NOTE 1 Classification rules for high-risk AI systems can be found in the EU AI Act, Article 6.
AI systems must be in compliance with applicable regulatory requirements at the moment that the AI system
is placed on the market or put into service. An AI system is placed on the market when it is supplied for first
distribution or use on the Union market in the course of a commercial activity, whether in return for
payment or free of charge. An AI system is put into service when it is supplied for the first use directly to
the deployer or for own use in the Union for its intended purpose.
EXAMPLE 1 An in-house developed AI system is put into service when it is used internally.
EXAMPLE 2 An AI system is placed on the market when it is offered for sale on a website.
The quality management system defined in this document can be used by a provider for one or more AI
systems that are intended to be placed on the market or put into service. Quality, in this context can be
understood as compliance with all of the regulatory requirements of the EU AI Act.
Depending on the intended purpose of the AI system, sector-specific regulations including obligations for a
quality management system, can apply. The provider can extend a quality management system following a
sector-specific regulation in such a way that it fulfils the requirements of the EU AI Act regulation instead
of using a separate quality management system.
EXAMPLE 3 Medical devices are commonly compliant to EN ISO 13485 [2] quality management system
requirements. Incorporating the requirements of this document within the existing processes is desirable when
achieving compliance with this document.
This document is intended for use by providers that provide AI systems irrespective of size, nature or
location. The requirements and guidance in this document are, however, specifically tailored to support
providers that operate inside of the European Union, and those located outside of the Union who are active
in the European Union market or who intend to enter that market.
The requirements in this document are the practical implementation from specific requirements from the
EU AI Act (see Annex ZA) by relying on state of the art practices from other widely used standards where
possible (see informative references throughout this document).
The quality management system in this document is described in a way that the implementation can take
into account the size of the provider, while providing the degree of rigour and level of protection required
by applicable regulatory requirements.
Clause 1 defines the scope of applicability of this document, while Clause 2 identifies normative references
essential for its application, although there are none in this document.
Clause 3 establishes the terms and definitions used throughout this document, including terminology
related to management systems, the EU AI Act, AI systems, and risk management, to ensure consistent
interpretation. References to how most of these concepts are based on other standards are also provided
in Clause 3.
Clause 4 specifies the requirements for establishing, implementing and maintaining the quality
management system, including the identification of regulatory requirements, determination of scope,
strategy for regulatory compliance, and control of documented information. After reading the Introduction
and Clause 1, this is a good place to start for readers new to management system standards.
Clause 5 addresses management responsibility, defining leadership commitment, quality policy, and the
assignment of roles, responsibilities, and authorities.
Clause 6 focuses on planning, including actions to address risks to the quality management system and the
setting and achievement of quality objectives.
Clause 7 describes the support processes required for the effective operation of the management system,
covering resources, competence, communication and awareness.
Clause 8 addresses AI system realization, detailing requirements across the AI system lifecycle, not least the
“design and development” and “verification and validation” phases as well as requirements regarding data
management, retirement, identification of the AI system and product documentation. Clause 8 also contains
a subclause on continuous learning AI systems and their predetermined changes.
Clause 9 covers operations and control, during deployment, including monitoring, supply chain
management, change control, post-market monitoring, incident reporting, and handling of non-compliance.
Finally, Clause 10 specifies requirements for performance evaluation of the management system, including
reviews and planning of changes to ensure ongoing effectiveness and compliance.
Annex A describes procedures for consultation with interested parties about risks to health, safety and
fundamental rights, Annex B contains the correspondence between the clauses of this document and
EN ISO 9001:2015 [3], and Annex C contains the correspondence with EN ISO/IEC 42001:2026 [4].
NOTE 2 Italicised terms are defined in Clause 3.
0.2 Verbal forms
In this document, the following verbal forms are used:
— “shall” indicates a requirement;
— “should” indicates a recommendation;
— “may” indicates a permission;
— “can” indicates a possibility or a capability.
0.3 Fundamental rights
The EU AI Act aims to ensure the protection of health, safety and fundamental rights in relation to AI systems
and this document sets out technical requirements to achieve this regulatory objective through a quality
management system.
Fundamental rights are universal legal guarantees without which individuals and groups cannot secure
their fundamental freedoms and human dignity and which apply equally to every human being regardless
of nationality, place of residence, sex, national or ethnic origin, colour, religion, language or any other status
as per the legal system of a country without any conditions.
The EU Charter of Fundamental Rights [5] sets out and codifies the European approach to these
fundamental rights in law which is applicable throughout the EU.
NOTE Further information about their scope and strength can be found in the Charter. Additional EU and
country-specific regulatory requirements can apply.
1 Scope
This document specifies the requirements and provides guidance for the definition, implementation and
maintenance of a quality management system for organizations that provide AI systems.
This document is intended to support the organization in meeting applicable regulatory requirements. It
is primarily intended for organizations placing on the market or putting into service high-risk AI systems
and is not specific to any particular sector.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp/
— IEC Electropedia: available at https://www.electropedia.org/
3.1 Terms relating to management systems
3.1.1
audit
systematic (3.1.30) and independent process (3.1.22) for obtaining evidence and evaluating it objectively
to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party), and
it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization (3.1.18) itself, or by an external party on its behalf.
Note 3 to entry: “Audit criteria” is defined in EN ISO 19011.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.1.18, modified — Removed “audit evidence and” from Note 3.]
3.1.2
authority
authorities
ability of an individual, group or organization (3.1.18) to do something without intervention by another
function on the details of that action
3.1.3
competence
ability to apply knowledge and skills to achieve intended results
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.9]
3.1.4
compliance
fulfilment of all applicable regulatory requirements (3.1.26)
3.1.5
control
measure that is modifying risk (3.4.5)
Note 1 to entry: Controls include any process (3.1.22), policy, device, practice, or other actions which modify
risk (3.4.5).
Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect.
[SOURCE:ISO Guide 73:2009, 3.8.1.1, modified — Note 2 to entry has been changed.]
3.1.6
corrective action
action to eliminate the cause(s) of a non-compliance (3.1.15) and to prevent recurrence
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.17, modified — Changed “nonconformity” to “non-compliance”.]
3.1.7
documented information
information controlled and maintained by an organization (3.1.18) and the medium on which it is
contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to:
a) the management system, including related processes (3.1.22);
b) information created in order for the organization (3.1.18) to operate (documented information);
c) evidence of compliance (3.1.4) and results achieved.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.10, modified — Removed “required to be” from the definition, in Note 2 b) referenced documented
information instead of documentation, in Note 2 c) added “compliance and” and removed reference to
records.]
3.1.8
effectiveness
extent to which planned activities are realized and planned results are achieved
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.13]
3.1.9
essential requirement
definition of the results to be attained, or the hazards (3.4.4) to be dealt with, without specifying the
technical solutions for doing so
Note 1 to entry: Essential requirements in relation to the EU AI Act [1] are specified in Chapter III, Section 2 of that
Regulation.
Note 2 to entry: Essential requirements are a subset of regulatory requirements (3.1.26).
[SOURCE: The Blue Guide on implementation of EU product rules 2022/C247/01, modified — Changed
“but do not specify” to “without specifying”.]
3.1.10
harmonized standard
European Standard adopted on the basis of a request made by the Commission for the application of Union
harmonization legislation
Note 1 to entry: A European standardization organization can develop a new standard, adopt an existing international
standard or adapt an existing international standard.
[SOURCE: Regulation (EU) 1025/2012, Article 2(1)(c), modified — Removed “a”, added Note 1 to entry.]
3.1.11
interested party
stakeholder
individual, group or organization (3.1.18) that can affect, be affected by or perceive itself to be affected by
a decision or activity
Note 1 to entry: Affected persons (3.4.1) are a subset of interested parties.
Note 2 to entry: Interested parties include relevant regulatory bodies, national public bodies, bodies that enforce the
protection of fundamental rights (3.4.2) and market surveillance authorities.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.2,
modified — In the definition, replaced “person” with “individual” and added “group”; added Notes 1 and
2.]
3.1.12
life cycle
evolution of a system, product, service, project or other human-made entity, from inception through
retirement
[SOURCE: ISO/IEC/IEEE 15288:2023, 3.21, modified — Changed “conception” to “inception”.]
3.1.13
measurement
process (3.1.22) to determine a value
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.19]
3.1.14
monitoring
repeatedly determining the status of a system, a process (3.1.22) or an activity using inputs including
measurements (3.1.13)
Note 1 to entry: To determine the status, there can be a need to check, supervise or critically observe.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.20, modified — Added “repeatedly” and “using inputs including measurements” to definition.]
3.1.15
non-compliance
non-fulfilment of applicable regulatory requirements (3.1.26)
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.16, modified — Replaced “a requirement” with “applicable regulatory requirements”.]
3.1.16
object
object of conformity assessment
entity to which specified requirements (3.1.27) apply
EXAMPLE Product, process, service, system, installation, project, data, design, material, claim, person, body or
organization (3.1.15), or any combination thereof.
[SOURCE: EN ISO/IEC 17000:2020, modified — Switched preferred and admitted terms, removed Note 1.]
3.1.17
objective evidence
data supporting the existence or verity of something
Note 1 to entry: Objective evidence can be obtained through observation, measurement (3.1.13), test, or by other
means.
Note 2 to entry: Objective evidence for the purpose of audit (3.1.1) generally consists of records, statements of fact
or other information which are relevant to the audit criteria and verifiable.
[SOURCE: EN ISO 9000:2015, 3.8.3]
3.1.18
organization
entity consisting of a person or group of people that has its own functions with responsibilities (3.1.33),
authorities (3.1.2) and relationships to achieve its objectives
Note 1 to entry: The concept of organization includes, but is not limited to, sole-trader, company, corporation, firm,
enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not,
public or private.
Note 2 to entry: If the organization is part of a larger entity, the term “organization” refers only to the part of the
larger entity that is within the scope of the quality (3.1.23) management system.
[SOURCE: EN ISO 9000:2015, 3.2.1, modified — Added “Entity consisting of a”.]
3.1.19
performance
measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.1.22), products, services,
systems or organizations (3.1.18).
[SOURCE: EN ISO 9000:2015, 3.7.8, modified — Removed Note 3.]
3.1.20
policy
intentions and direction of an organization (3.1.18) as formally expressed by its top management (3.1.28)
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.5]
3.1.21
procedure
specified way to carry out an activity or a process (3.1.22)
Note 1 to entry: Procedures can be documented.
[SOURCE: EN ISO 9000:2015, 3.4.5, modified — Removed “or not” from Note 1.]
3.1.22
process
set of interrelated or interacting activities that uses or transforms inputs to deliver an intended result
Note 1 to entry: Whether the result of a process is called an output, a product or a service depends on the context of
the reference.
Note 2 to entry: Process can achieve an immediate result but can also consist of information-sharing or other
activities.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.8,
modified — Added Note 2; replaced “may” with “can” based on the use of verbal forms in standards.]
3.1.23
quality
set of characteristics of an object (3.1.16) that fulfils regulatory requirements (3.1.26)
Note 1 to entry: Quality includes the protection required by applicable regulatory requirements (3.1.26) aimed at
ensuring and maintaining the protection of health, safety and fundamental rights (3.4.2).
Note 2 to entry: In the context of this document, quality pertains to regulatory compliance to at least the EU AI Act,
including ensuring and maintaining the protection of health, safety and fundamental rights (3.4.2). It differs from the
concept of quality in EN ISO 9001 which includes expectations of customers and other interested parties (3.1.11).
[SOURCE: EN ISO 9000:2015, 3.6.2, modified — In the definition, removed “degree of” and “inherent”, and
added “regulatory” to “requirements”; removed original Notes 1 and 2; and added new Notes 1 and 2.]
3.1.24
quality objective
measurable goal established to ensure that regulatory requirements (3.1.26) are consistently met
throughout the life cycle (3.1.12)
Note 1 to entry: In the context of quality (3.1.19) management systems, quality objectives are set by the provider
(3.2.5), consistent with the quality policy (3.1.20), to achieve specific results.
Note 2 to entry: An objective in EN ISO/IEC 42001:2026, 3.6 and EN ISO 9000:2015, 3.7.1 is a general result to be
achieved. In this document, the term “quality objective” is linked specifically to the regulatory requirements (3.1.26).
3.1.25
quality policy
policy (3.1.20) related to quality (3.1.23)
[SOURCE: EN ISO 9000:2015, 3.5.9, modified — Removed notes.]
3.1.26
regulatory requirement
requirement (3.1.27) defined by applicable regulation and that is necessary to be met for the purposes of
complying with the regulation
Note 1 to entry: Applicable regulation includes at least the EU AI Act [1]
Note 2 to entry: Applicable regulation also includes law and regulation aimed at ensuring and maintaining the
protection of health, safety and fundamental rights (3.4.2).
3.1.27
requirement
need or expectation that is stated or obligatory
Note 1 to entry: A specified requirement is one that is stated, e.g. in documented information (3.1.7).
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024),
3.14, modified — Removed “generally implied” from the definition, replaced Note 1.]
3.1.28
top management
person or group of people who directs and controls an organization (3.2.5) at the highest level
Note 1 to entry: Top management has the power to delegate authority (3.1.2) and provide resources within the
organization (3.1.18).
Note 2 to entry: If the scope of the quality management system (3.1.29) covers only part of an organization of the
provider, then top management refers to those who direct and control that part of the organization of the provider.
Note 3 to entry: In different organizational contexts, top management can be referred to with different terms.
Note 4 to entry: Where the organization is a person, top management is that person.
Note 5 to entry: In this document, top management refers to personnel of the provider.
[SOURCE: ISO/IEC Directives Part 1, Consolidated ISO Supplement, Annex SL Appendix 2 (rev 4 2024), 3.3,
modified — Added “of the provider” to Note 2, added Notes 3, 4 and 5.]
3.1.29
scope of the quality management system
set of AI system(s) (3.2.1) that are covered under a quality (3.1.23) management system and the boundaries
that define where the quality management system applies
EXAMPLE Boundaries can include physical (geographic), organizational (3.1.18), functional, process, system,
service and interface boundaries.
3.1.30
systematic
pursuing defined objective(s) in a planned, step-by-step manner
[SOURCE: ISO/TR 18307:2001, 3.140]
3.1.31
validation
confirmation, through the provision of objective evidence (3.1.17), that the requirements (3.1.27) for a
specific intended purpose (3.2.3) or application have been fulfilled
Note 1 to entry: The objective evidence needed for a validation is the result of a test or other form of determination
such as performing alternative calculations or reviewing documents.
Note 2 to entry: The word “validated” is used to designate the corresponding status.
Note 3 to entry: The use conditions for validation can be real or simulated.
Note 4 to entry: The concept of validation as a procedure (3.1.21) is not directly related to validation datasets used
in machine learning.
[SOURCE: EN ISO 9000:2015, 3.8.13, modified — Changed “intended use” to “intended purpose” and added
Note 4.]
3.1.32
verification
confirmation, through the provision of objective evidence (3.1.17), that specified requirements (3.1.27) have
been fulfilled
Note 1 to entry: The objective evidence needed for a verification can be the result of an inspection or of other forms
of determination such as performing alternative calculations or reviewing documents.
Note 2 to entry: The activities carried out for verification are sometimes called a qualification process.
Note 3 to entry: The word “verified” is used to designate the corresponding status.
Note 4 to entry: Verification can rely on testing activities and results to provide objective evidence.
[SOURCE: EN 18228:—, 3.30]
3.1.33
responsible
responsibility
responsibilities
state of being accountable or answerable for an obligation
[SOURCE: EN ISO 17427-1:2018, 3.21, modified — Removed reference to other types of responsibilities.]
3.2 Terms relating to the EU AI Act
3.2.1
AI system
machine-based system that is designed to operate with varying levels of autonomy and that can exhibit
adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives,
how to generate outputs such as predictions, content, recommendations, or decisions that can influence
physical or virtual environments
Note 1 to entry: The verb “can” represents a possibility, not all AI systems that fit the above definition have this ability
to adapt after deployment.
[SOURCE: EU AI Act (Article 3(1)), modified — Removed “a”, replaced “may” with “can” based on the use
of verbal forms in standards, added Note 1.]
3.2.2
deployer
natural or legal person, public authority, agency or other body using an AI system (3.2.1) under its authority
except where the AI system is used in the course of a personal non-professional activity
[SOURCE: EU AI Act 2024/1689 (Article 3(4)), modified — Removed “a”.]
3.2.3
intended purpose
use for which an AI system (3.2.1) is intended by the provider (3.2.5), including the specific context and
conditions of use, as specified in the information supplied by the provider in the instructions for use,
promotional or sales materials and statements, as well as in the technical documentation
[SOURCE: EU AI Act 2024/1689, (Article 3(12)), modified — Removed “a”.]
3.2.4
performance
ability of an AI system (3.2.1) to achieve its intended purpose (3.2.3)
[SOURCE: EU AI Act 2024/1689, (Article 3(18)), modified — Removed “the”.]
3.2.5
provider
natural or legal person, public authority, agency or other body that develops an AI system (3.2.1) or a
general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it
on the market or puts the AI system into service under its own name or trademark, whether for payment
or free of charge
Note 1 to entry: A distributor, importer, deployer (3.2.2) or other third party can be considered a provider of an AI
system in certain circumstances.
Note 2 to entry: For the purposes of this document, a provider shall be interpreted as a provider of high-risk AI
systems and not general-purpose AI models.
[SOURCE: EU AI Act 2024/1689, (Article 3(3)), modified — Removed “a”, added Note 2.]
3.2.6
reasonably foreseeable misuse
use of an AI system (3.2.1) in a way that is not in accordance with its intended purpose (3.2.3), but which
can result from reasonably foreseeable human behaviour or interaction with other systems, including
other AI systems
[SOURCE: EU AI Act 2024/1689, (Article 3(13)), modified — Removed “a”, replaced “may” with “can” based
on the verbal form of standards.]
3.2.7
substantial modification
change to an AI system (3.2.1) after its placing on the market or putting into service which is not foreseen
or planned in the initial conformity assessment (3.2.11) carried out by the provider (3.2.5) and as a result of
which the compliance of the AI system with the applicable regulatory requirements (3.1.26) is affected or
results in a modification to the intended purpose (3.2.3) for which the AI system has been assessed
Note 1 to entry: Rephrased from the EU AI Act Article 3(23) to reference applicable regulatory requirements instead
of a specific reference to the EU AI Act Chapter III, Section 2.
[SOURCE: EU AI Act 2024/1689, (Article 3(23)), modified as described in Note 1 to entry]
3.2.8
serious incident
incident or malfunctioning of an AI system (3.2.1) that directly or indirectly leads to any of the following:
a) the death of a person, or serious harm (3.4.3) to a person’s health;
b) a serious and irreversible disruption of the management or operation of critical infrastructure;
c) the infringement of obligations under Union law intended to protect fundamental rights (3.4.2);
d) serious harm (3.4.3) to property or the environment
[SOURCE: EU AI Act 2024/1689, (Article 3(49))]
3.2.9
AI system presenting a risk
product presenting a risk
product having the potential to affect adversely health and safety of persons in general, health and safety
in the workplace, protection of consumers, the environment, public security and other public interests,
protected by the applicable Union harmonization legislation, to a degree which goes beyond that
considered reasonable and acceptable in relation to its intended purpose (3.2.3) or under the normal or
reasonably foreseeable conditions of use of the product concerned, including the duration of use and,
where applicable, its putting into service, installation and maintenance requirements (3.1.27)
Note 1 to entry: For the purposes of this document, AI systems (3.2.1) presenting a risk (3.4.5) shall only be in so far
as they present risks to the health or safety, or to fundamental rights (3.4.2), of persons.
[SOURCE: Regulation (EU) 2019/1020, (Article 3(19))]
3.2.10
instructions for use
information provided by the provider (3.2.5) to inform the deployer of, in particular, an AI system’s (3.2.1)
intended purpose (3.2.3) and proper use
[SOURCE: EU AI Act 2024/1689, (Article 3(15))]
3.2.11
conformity assessment
process of demonstrating whether the requirements (3.1.27) set out in Chapter III, Section 2 relating to a
high-risk AI system have been fulfilled
Note 1 to entry: In this document, the term conformity assessment is used to refer to compliance with regulation,
which is different to conformity assessment in relation to conformity with a standard.
[SOURCE: EU AI Act (Article 3(20)), modified — Added Note 1 to entry.]
3.3 Terms relating to AI systems
3.3.1
training
model training
process (3.1.22) to determine or to improve the parameters of a machine learning model (3.3.3), based on
a machine learning algorithm (3.3.2), by using training data
[SOURCE: EN ISO/IEC 22989:2023, 3.3.15]
3.3.2
traceability
ability to trace the AI system (3.2.1) and its history
Note 1 to entry: Traceability includes information on how AI systems have been specified, developed, verified (3.1.28),
validated (3.1.29), operated, monitored (3.1.14) and retired.
3.3.3
AI system requirements
functional and non-functional requirements (3.1.27) derived from the intended purpose (3.2.3) and
regulatory requirements (3.1.26)
3.3.4
test procedure
sequence of test cases in execution order, with any associated actions required to set up preconditions and
perform wrap up activities post execution
[SOURCE: ISO/IEC/IEEE 29119-1:2022, 3.1.20]
3.3.5
user
person who interacts with the AI system (3.2.1) when deployed
[SOURCE: ISO 10377:2013, 2.29, modified — Replaced "product or service" with "AI system when
deployed".]
3.4 Terms relating to risk management
3.4.1
affected person
individual, or group of individuals, who is or are directly or indirectly impacted by an AI system (3.2.1)
when used in accordance with its intended purpose (3.2.3) or in the frame of reasonably foreseeable misuse
(3.2.6)
3.4.2
fundamental right
basic right(s) and freedom(s) held by every human being irrespective of birth, religion, belief, age, race,
ethnicity, sex, gender or any other status
Note 1 to entry: For the purposes of this document, fundamental rights and their applicability are those protected by
EU law, including the protection of the rights outlined in EU law, including the Charter of Fundamental Rights of the
EU (EU Charter) and the European Convention on Human Rights.
[SOURCE: EN 18228:—, 3.5.1]
3.4.3
harm
injury or damage to health of a person or groups of persons, or interference (3.4.10) with the fundamental
rights (3.4.2)
Note 1 to entry: For the purposes of this document, damage to property or the environment, and the disruption or
destruction of critical infrastructure, are considered harms when they can result in injury or damage to the health of
a natural person or groups of persons or interference with fundamental rights.
Note 2 to entry: Interference with fundamental rights can be tangible or intangible, physical, psychological, societal or
economic, irrespective of the rightholder’s awareness, in accordance with EU law, including the EU Charter on
Fundamental Rights [4].
Note 3 to entry: Safety in product safety risk (3.4.5) management standards is understood as the absence of
unacceptable risk. In the context of this document, safety refers to the protection from harm from the use of the AI
system (3.2.1).
[SOURCE: EN 18228:—, 3.6.3]
3.4.4
hazard
potential source of harm (3.4.3)
[SOURCE: ISO/IEC Guide 51:2014, 3.2]
3.4.5
risk
combination of the probability of an occurrence of harm (3.4.3) and the severity (3.4.8) of that harm
Note 1 to entry: The probability of occurrence includes the exposure to a hazardous situation and the pos
...