First AI Act harmonized standard. QMS requirements for high-risk AI providers mapped to SWT3 witness procedures.
Audience: Quality managers at AI system providers, AI conformity assessment bodies, Notified Body assessors, ISO 42001 auditors, EU AI Act compliance teams, and organizations preparing for the December 2027 high-risk deadline.
Status: Approved by CEN-CENELEC on July 12, 2026. National standards bodies must adopt by January 31, 2027. NOT YET cited in the Official Journal of the EU -- formal presumption of conformity does not yet attach. However, EN 18286 defines the QMS requirements that conformity assessment bodies will reference for Annex III high-risk AI systems (obligations effective December 2, 2027). Organizations should begin alignment now.
EN 18286:2026 is the first harmonized European standard developed under the EU AI Act. It specifies quality management system (QMS) requirements for providers of high-risk AI systems under Article 17. The standard was approved by CEN-CENELEC JTC 21 on July 12, 2026.
The standard covers:
EN 18286 is aligned with but distinct from ISO/IEC 42001. ISO 42001 is an international, voluntary AI management system standard. EN 18286 is EU-specific and, once cited in the Official Journal, will create a legal presumption of conformity with Article 17 requirements. This distinction matters: voluntary certification is not the same as regulatory compliance.
EN 18286 is the first of several JTC 21 standards under development. Companion standards will address risk management (mapping to Article 9), data governance (Article 10), transparency (Article 13), and accuracy and robustness (Article 15). Together, these will form the harmonized standard family for high-risk AI systems.
Each QMS domain in EN 18286 maps to one or more SWT3 witness procedures. The table below shows the primary mapping, the evidence produced by each procedure, and how it satisfies the standard's requirement.
| QMS Domain | EN 18286 Requirement | SWT3 Procedure | Evidence Produced |
|---|---|---|---|
| Risk management | Systematic risk identification and mitigation | AI-SAFE.1 |
Safe state capability, trigger mechanisms, fallback verification |
| Continuous monitoring | Ongoing performance and drift monitoring | AI-DRIFT.1 + AI-PERF.1 |
Drift metrics, statistical deviation, performance benchmarks |
| Data governance | Training data quality and provenance | AI-MDL.5 |
Weight file hash verification, model provenance chain |
| Technical documentation | Comprehensive system documentation | AI-TRANS.1 |
Disclosure type, documentation status, transparency record |
| Record-keeping | Logs of decisions and system behavior | AI-AUDIT.1 |
Entry count, tamper detection result, log integrity proof |
| Corrective actions | Incident response and remediation | AI-INCIDENT.1 + AI-VIO.1 |
Severity classification, violation reporting, remediation status |
| Post-market monitoring | Ongoing field performance tracking | AI-LCM.1 |
Lifecycle stage, model version, deployment context |
| Supply chain management | Component tracking and verification | AI-SBOM.1 + AI-SUPPLY.1 |
Component count, supply chain hash, dependency verification |
| Adversarial robustness | Testing against adversarial inputs | AI-ROBUST.1 |
Perturbations tested, survival count, robustness score |
| Bias and fairness | Non-discrimination testing | AI-FAIR.1 |
Bias disparity ratio, protected group count, fairness metric |
Each procedure produces a cryptographic SWT3 Witness Anchor on every execution. These anchors accumulate into an immutable evidence chain that demonstrates continuous QMS operation -- not a point-in-time snapshot, but ongoing conformity.
EN 18286 requires comprehensive records of system decisions and operational events, along with a corrective action process for handling incidents. AI-AUDIT.1 proves log integrity by witnessing entry counts and tamper detection results at regular intervals. AI-INCIDENT.1 classifies incidents by severity and tracks them through remediation to resolution.
Together, these procedures satisfy two core QMS domains: the record-keeping requirement ensures nothing is lost or altered, while the corrective action requirement ensures that problems are identified, classified, and resolved with a documented trail.
Verify that AI-AUDIT.1 anchors appear at least daily -- gaps in the audit trail are non-conformities. For AI-INCIDENT.1, confirm that anchors show severity classification and a remediation timeline. Cross-reference incident anchors with corrective action records to verify closure.
The QMS requires ongoing monitoring of AI system performance -- not one-time validation at deployment, but continuous verification throughout the operational lifecycle. AI-DRIFT.1 detects statistical deviation from established baselines, catching model degradation before it affects outputs. AI-PERF.1 validates system performance against declared benchmarks at regular intervals.
This pairing is critical because EN 18286 treats monitoring gaps as QMS failures. A system that was validated at deployment but has no evidence of ongoing monitoring does not conform.
Monitoring gaps are non-conformities. Verify that anchors span the full operational period without interruption. Check AI-DRIFT.1 threshold values -- drift detected but not acted upon is a separate finding. Confirm AI-PERF.1 benchmarks match the declared performance in technical documentation.
EN 18286 requires providers to track all components that contribute to the AI system's behavior. AI-SBOM.1 documents the software bill of materials -- every library, model, dataset, and dependency. AI-SUPPLY.1 verifies supply chain integrity by hashing the complete dependency tree and detecting unauthorized changes.
This is particularly important for systems that incorporate third-party foundation models, open-source components, or externally sourced training data. Each integration point is a potential conformity risk.
The SBOM should include all third-party models, libraries, and data sources -- not just direct dependencies. Supply chain hash changes between anchors indicate component updates that need revalidation. Verify that component updates triggered the appropriate corrective action process (AI-INCIDENT.1).
SWT3 Conformity Evidence Packages (CEPs), defined in SWT3-SPEC Section 24, provide the portable evidence bundle for conformity assessment. A CEP contains all anchors for a given audit period, summary statistics, the gate decision, a Merkle inclusion proof, and a package integrity hash.
For EN 18286 assessments, the CEP serves as the primary evidence artifact. It consolidates all QMS-related anchors into a single, verifiable package that assessors can evaluate without access to the live system.
Export evidence for the audit period from the AI Witness dashboard. Spot-check individual fingerprints using the public verifier. The Conformity Evidence Package format is defined in SWT3-SPEC v1.0, Section 24.
| Dimension | ISO/IEC 42001:2023 | EN 18286:2026 |
|---|---|---|
| Scope | International AI management system | EU AI Act Article 17 QMS for high-risk AI providers |
| Jurisdiction | Global, voluntary | EU, regulatory (presumption of conformity when cited in OJ) |
| Legal effect | Certification demonstrates good practice | Compliance creates presumption of conformity with Art. 17 |
| Certification body | Accredited certification bodies (ISO 17021) | Notified Bodies designated under the AI Act |
| Coverage | Broad AI governance and management | Specific to AI Act obligations (risk, data, docs, monitoring) |
| Relationship | Foundation -- EN 18286 builds on ISO 42001 concepts | Extension -- adds EU-specific requirements to ISO foundation |
Organizations can hold both certifications. ISO 42001 provides international credibility and demonstrates mature AI governance. EN 18286 satisfies the specific regulatory requirement under the AI Act. The two are complementary, not competing.
SWT3 evidence serves both standards from a single evidence chain. The same witness anchors that demonstrate EN 18286 QMS operation also satisfy ISO 42001's monitoring and measurement requirements. There is no need to maintain parallel evidence systems.
| Examiner Question | Where to Find the Answer |
|---|---|
| How do you demonstrate ongoing risk management? | AI-SAFE.1 anchors show safe state verification at each inference cycle. Filter by procedure in the anchor verifier. |
| Where are your audit logs and how do you prove they have not been tampered with? | AI-AUDIT.1 anchors include entry count and tamper detection result. Each anchor is independently verifiable via SHA-256 fingerprint. |
| How do you track model drift and performance degradation? | AI-DRIFT.1 and AI-PERF.1 anchors. Export evidence filtered to these procedures for the audit period from the AI Witness dashboard. |
| What is your incident management process and how do you track corrective actions? | AI-INCIDENT.1 anchors classify incidents by severity. AI-VIO.1 anchors track violations. Cross-reference with corrective action closure records. |
| How do you manage third-party components and supply chain risk? | AI-SBOM.1 documents all components. AI-SUPPLY.1 verifies supply chain integrity via hash comparison. Hash changes trigger revalidation. |
| Can you provide a portable evidence package for this assessment period? | SWT3-SPEC Section 24 defines the Conformity Evidence Package (CEP) format. Export all anchors for the audit period from the AI Witness dashboard and verify individual fingerprints using the public verifier. |
pip install swt3-aifrom swt3_ai import SWT3Witnesswitness = SWT3Witness(api_key=\"your-key\", tenant_id=\"your-tenant\")witness.wrap(model=\"gpt-4\", prompt=\"...\", response=\"...\")
npm install @tenova/swt3-aiimport { SWT3Witness } from '@tenova/swt3-ai';const witness = new SWT3Witness({ apiKey: 'your-key', tenantId: 'your-tenant' });await witness.wrap({ model: 'gpt-4', prompt: '...', response: '...' });
Every wrap() call produces a SWT3 Witness Anchor. Anchors accumulate into your evidence chain automatically. No additional configuration is needed for EN 18286 evidence -- the standard witness pipeline covers all mapped QMS domains.
For the full SDK documentation, procedure reference, and MCP server setup, see the SDK Docs.