Article 40 is the most invoked and least operative provision in the Regulation. It opens a presumption of conformity for anyone applying a harmonised standard, a reversal of the burden of proof, and a considerable one in practice. Except that, to date, nobody can rely on it.
As at 24 August 2026, the date of our last check, no harmonised standard reference had been published in the Official Journal of the European Union under Regulation (EU) 2024/1689. Four official sources agree: the Commission’s harmonised standards portal, where no artificial intelligence entry exists; EUR-Lex, where the only 2026 implementing decisions on harmonised standards concern other legislation; the AI Act Service Desk; and the Commission’s standardisation page, which describes the mechanism in the future tense.
An unsuccessful search never proves non-existence, only that nothing was found. But four concordant official sources, on a given date, are worth writing down, and rechecking.
What must a standard satisfy to carry the presumption?
Three conditions, and they rarely coincide. The standard must be harmonised, its references must be published in the Official Journal, and the presumption holds only to the extent that the standard covers the requirement: a quality management standard presumes nothing about data governance.
“High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter or, as applicable, with the obligations set out in of Chapter V, Sections 2 and 3, of this Regulation, to the extent that those standards cover those requirements or obligations.”
Source: Article 40(1)
The scope is bounded too: Chapter III Section 2 for high-risk systems, Chapter V Sections 2 and 3 for general-purpose AI models. The presumption does not cover the whole Regulation.
And that bound raises a question worth flagging. Article 17, the quality management system, sits in Section 3 of Chapter III, outside the scope Article 40(1) names. The omnibus extended the standardisation request to Sections 2 and 3, but it did not extend the sentence that grants the presumption. What a standard attached to Article 17 would presume, on the face of Article 40(1), is not settled.
European standard, harmonised standard, published reference: what is the difference?
Three tiers, and only the third has legal effect. A standard in preparation is worth nothing; a European standard published by CEN-CENELEC carries no presumption; only publication of its reference in the Official Journal opens the Article 40 presumption. Three statuses circulate under the same word, and almost all of the market’s error comes from there.
| Tier | Status | Legal effect |
|---|---|---|
| 1 | Standard in preparation (prEN, enquiry, vote) | None |
| 2 | European standard published by CEN-CENELEC | No presumption |
| 3 | Reference published in the OJEU by implementing act | The Article 40 presumption |
As at 24 August 2026: several texts at tier 1, two at tier 2 (EN 18286:2026 and EN ISO/IEC 42001:2026) and none at tier 3.
A draft standard is not enforceable and is not cited as a requirement. A published European standard can be bought, applied and treated as good practice, but it opens no reversal of the burden of proof. Only publication of the reference in the Official Journal, under Regulation (EU) No 1025/2012, triggers Article 40.
Is EN 18286:2026 the AI Act harmonised standard?
No — it is a published European standard whose reference is not in the Official Journal. It is indeed the first standard out of the AI Act programme, attached to Article 17, and CEN-CENELEC calls it harmonised in its own communications. That is the standardiser’s vocabulary, not Article 40’s: without an OJEU reference, it opens no presumption.
Published by CEN-CENELEC in July 2026 under the title “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”, developed by committee CEN/CLC/JTC 21 and attached to Article 17.
It is indeed the first standard out of the AI Act programme. It is not a harmonised standard: its reference is not cited in the Official Journal. According to published analyses (the primary CEN source not being publicly accessible) its Annex ZA is presented as “intended to support a presumption of conformity with Article 17(1)”: intended to, not producing that effect.
CEN-CENELEC nonetheless describes it in its communications as “the first harmonized European standard for the AI Act regulatory purposes”. That is the standardiser’s vocabulary, not Article 40’s. The accurate wording remains: a published European standard, not yet harmonised.
A note on precision: sources give publication dates spread between 1 July and 8 August 2026. We write “July 2026” rather than an exact date the official CEN catalogue, which is closed to crawlers, did not allow us to confirm.
Where does the standardisation programme stand?
Committee CEN/CLC/JTC 21 organises its work in groups and publishes its own list of projects. The operational strand covers conformity assessment, risk management and quality management, the strand that produced EN 18286:2026.
The engineering strand covers data set quality and governance, bias management, evaluation methods for computer vision, and separate work on natural language processing and on logging. A series on the AI trustworthiness framework and a cybersecurity specification project sit alongside them.
We publish neither the number of expected deliverables, nor the detail of their progress statuses, nor the number of parts in the trustworthiness series: the committee’s official work programme is not publicly legible, and third-party sources contradict each other on those points.
What has the Commission asked the standards bodies for?
The programme rests on Implementing Decision C(2025) 3871 final of 23 June 2025, a standardisation request to CEN and CENELEC, titled “on a standardisation request […] as regards high-risk AI systems in support of Regulation (EU) 2024/1689”. It repeals Implementing Decision C(2023) 3215 final, and its Article 5 provides that it expires on 28 February 2027.
Its Annex I could not be obtained. That annex carries the list of requested deliverables, their official titles and their individual deadlines. No page can therefore cite it or announce a number of deliverables: the list of domains in circulation is the wording of a Commission FAQ, not of the annex.
A draft amending decision was notified on 30 July 2026. Its recital is explicit as to the reason:
“CEN and Cenelec have informed the Commission that the standards could not be completed by the deadline set in Implementing Decision C(2025)3871 and it is therefore necessary to extend the deadline for the delivery of the requested standards, as well as the deadline of the final report and the expiry date”
Two cautions apply, and they are widely ignored. It is a draft, not an adopted act: its header reads “Brussels, XXX” with no date of adoption. And 28 February 2027 is not a new date: it was already the expiry date of the decision in force, which the draft would turn into a delivery date, pushing expiry to 31 August 2028.
Writing that the Commission has pushed the delivery of the standards to 28 February 2027 therefore compounds two errors.
Is there a fallback route while no standard exists?
Article 41 allows the Commission to adopt common specifications by implementing act, with the same presumptive effect. Four situations open it: no European standardisation organisation accepted the request; the standards were not delivered within the deadline; the relevant standards “insufficiently address fundamental rights concerns”; or they do not comply with the request. The last two are neither a failure nor a delay: a standard delivered on time but judged insufficient opens the route.
But it also requires, cumulatively, that no reference has been published in the Official Journal and that no such reference “is expected to be published within a reasonable period”. That second condition is the more restrictive, and the Regulation does not say who assesses it or on what evidence.
A provider not applying common specifications may always justify having adopted technical solutions “to a level at least equivalent thereto”. And as soon as a harmonised standard reference is published, the Commission repeals the corresponding specifications.
No common specification has been identified to date under the AI Act.
What does the absence of standards actually change?
The Article 40 presumption is available to nobody, and the burden of proof stays whole. The targeted presumptions of Article 42 are a separate matter: two of them need no publication at all. Three consequences follow, and the first is the hardest.
For Annex III biometric systems, it closes the internal control route. The Regulation in principle leaves a choice between self-assessment and assessment by a notified body, but conditional on having applied harmonised standards or common specifications. Since none exist, the condition is met by nobody: third-party assessment is imposed in fact.
That is not a hardening of the text; it is an effect of the state of standardisation. And it lands at a moment when French notified bodies remain unknown.
For the other Annex III use cases, it shifts the burden onto documentation. Without a presumption, the technical documentation, the quality management system and risk management will have to carry the demonstration, when those requirements become applicable, on 2 December 2027 for Annex III and 2 August 2028 for Annex I.
For general-purpose AI model providers, it keeps the code of practice window open. Article 53(4) lets them rely on an approved code “until a harmonised standard is published”. While none is, that route stays open. It is not the only one: the same paragraph requires providers adhering to no approved code and meeting no harmonised standard to “demonstrate alternative adequate means of compliance for assessment by the Commission”.
The practical consequence is therefore the opposite of what is usually heard: the absence of standards is not a reason to wait.
What this page rests on
Articles 40 to 42 and 53(4) of Regulation (EU) 2024/1689 in the consolidated version of 27 July 2026, the authentic text remaining the one published in the Official Journal, and quotations reproduced from the official English text. Implementing Decision C(2025) 3871 final of 23 June 2025 and the draft amending decision notified on 30 July 2026, both consulted in the Commission register. The state of harmonised standardisation is checked against four official sources as at 24 August 2026; it is a dated statement, rechecked at each update.
Sources. Regulation (EU) 2024/1689, consolidated text of 27 July 2026 and Regulation (EU) 2026/1744, both consulted on 27 August 2026.
Frequently asked questions
How many harmonised standards exist under the AI Act?
None. As at 24 August 2026, the date of our last check, no harmonised standard reference had been published in the Official Journal of the European Union under Regulation (EU) 2024/1689. Four official sources agree. It is a dated fact that will expire: we recheck it at each update.
Is EN 18286:2026 not the AI Act harmonised standard?
No, despite its title and despite CEN-CENELEC communications using the word harmonized. It is a European standard published in July 2026 and attached to Article 17, whose reference is not cited in the Official Journal. It therefore opens no presumption. The accurate formula is: a published European standard, not yet harmonised.
Are harmonised standards mandatory?
No, and this is a frequent confusion. They create no obligation: they open a presumption of conformity, which is a reversal of the burden of proof. A provider may always demonstrate compliance by other means, at the cost of justifying it.
Should I wait for the standards before working on compliance?
No, for two opposing reasons. On one hand the Chapter III requirements are not yet applicable: they become so on 2 December 2027 for Annex III systems and 2 August 2028 for Annex I. On the other, the absence of standards already hardens the position of Annex III biometric systems, for which it closes the internal control route. Waiting reduces no risk.
This content is a technical and regulatory information resource. It does not constitute legal advice.