The EU AI Act gets its first harmonised standard, what does it mean for buying recruitment tools?

On 19 October 2026 the European Commission published the reference to the first harmonised standard supporting the AI Act in the Official Journal of the European Union. The standard is EN 18286:2026, Artificial intelligence, Quality management system for EU AI Act regulatory purposes, developed by the European standardisation bodies CEN and CENELEC. The publication was made through Commission Implementing Decision (EU) 2026/2274.

According to the Commission's news item on digital-strategy.ec.europa.eu, providers of high-risk AI systems that implement the standard benefit from a presumption of conformity with the quality management system requirements in Article 17 of the AI Act, to the extent the standard covers them. The Commission describes the publication as a milestone ahead of the application of the requirements for high-risk AI systems and says that further harmonised standards are expected to follow.

EN 18286 is about quality management, meaning the processes a provider needs in place to develop, test and maintain an AI system in a controlled way. The Commission points out that the standard is built around the lifecycle of the AI system rather than around the organisation as a whole. It is also designed to be layered on top of existing standards such as ISO/IEC 42001, ISO 9001 or a sector-specific quality standard such as ISO 13485, not to replace them. Providers in regulated sectors can therefore integrate their management systems instead of running several in parallel. Organisations without ISO/IEC 42001 that intend to place high-risk AI systems on the EU market can use EN 18286 either to extend an existing quality management system or to build one that meets Article 17.

It is worth noticing who the news item addresses. The Commission mentions providers only. Users of the systems, employers and HR are not mentioned. A presumption of conformity with Article 17 therefore says something about the provider's processes, not about how a particular employer uses the system in its own recruitment.

The Commission's overview page on the AI Act, updated the same day, lists AI tools for employment, management of workers and access to self-employment as high-risk and gives CV-sorting software for recruitment as an example. For such systems the same page lists a set of obligations that apply before they can be placed on the market. It names adequate risk assessment and mitigation, high quality of the datasets feeding the system, logging of activity so that results can be traced, detailed documentation on the system, appropriate human oversight and a high level of robustness, cybersecurity and accuracy.

Whether a particular assessment tool is an AI system in the sense of the Act is not settled by either the news item or the overview page. That is a question to put to the vendor directly. The answer depends on how the tool is built and what role it plays in selection.

The standard is written for providers, but it gives buyers a sharper question to ask. Until now a vendor could answer the AI Act question with general assurances about keeping up with the rules. Now there is a published standard with a presumption of conformity, which makes it possible to ask something concrete.

Relevant questions in a procurement process are whether the vendor itself regards its system as high-risk under the Act, whether the vendor already works to ISO/IEC 42001 or ISO 9001 and plans to layer EN 18286 on top, whether the vendor can show documentation for the points the Commission names, namely data, logging, human oversight and accuracy, and finally when the vendor expects to be able to demonstrate conformity.

One distinction belongs here. A quality management system says something about how the vendor works. It says nothing about whether the test measures what it claims to measure. Validity and quality management are two different questions, and one does not substitute for the other.

According to the Commission's overview page, the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. Under the AI Omnibus, which entered into force on 27 July 2026, the rules for high-risk systems in the sensitive areas of Annex III, which include employment, have been extended to 2 December 2027. High-risk systems embedded in regulated products under Annex I have a transition period until 2 August 2028. The Commission writes that harmonised standards will offer legal certainty under the AI Act.

That leaves a little over a year before the requirements apply to recruitment tools. For providers, the first standard means there is now a recognised route to meeting one part of the requirements. For employers, it means the compliance question can be asked in concrete terms rather than general ones.

Source: https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal