What is the CEN-CENELEC JTC 21 standards request?

What are M/593 and M/613?

M/593 is the reference for the original Commission standardisation request for the AI Act, issued as Commission Implementing Decision C(2023) 3215 on 22 May 2023, which asked CEN and CENELEC to deliver harmonised standards supporting the AI Act, with an original delivery deadline in April 2025 in the reporting checked for this guide. M/613 is Amendment 1 to that request, issued as Commission Implementing Decision C(2025) 3871 on 23 June 2025, which repealed and replaced the original Decision, continuing the same scope and deliverables under an extended timeline, with progress reports every three months and an expiry in February 2027 in the reporting checked for this guide. The two Decisions should be read together, with the later Decision showing what was changed, what was continued and what timetable now applies. A provider should check the Decisions themselves on EUR-Lex or on the Commission standardisation page, rather than relying on a summary of the request numbers, because the request contains the deliverable detail, the fundamental rights considerations and the relationship to international work. The request numbers, M/593 and M/613, are useful shorthand, but the Decisions are the source.

What are the ten areas?

The ten areas in the Commission standardisation page and in the request are risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. Each area maps to one or more AI Act requirements: risk management to Article 9, data governance to Article 10, record keeping and logging to Article 12, transparency to Article 13, human oversight to Article 14, accuracy, robustness and cybersecurity to Article 15, quality management to Article 17, and conformity assessment to Article 43 and the related provisions. The mapping is not one to one, and a single deliverable can cover more than one area, while a single area can be covered by more than one deliverable. A provider should therefore map its requirements to the deliverables, not only to the ten areas, and should check the JTC 21 work programme for the deliverable that covers its requirement. The ten areas are a programme description, not a list of standards, and a provider that states that it follows the ten areas has not shown that it follows any standard.

For the broader regulatory framework, see codes, standards and sandboxes overview.

How is JTC 21 organised?

Joint Technical Committee 21, or JTC 21, is the joint committee of CEN and CENELEC for artificial intelligence, established to deliver the harmonised standards under the request. It is organised with a strategic advisory group for programme coordination and strategic direction, and with working groups that, in the reporting checked for this guide, cover operational aspects, engineering aspects, foundational and societal aspects, and cybersecurity for AI systems. The working group structure and the deliverable allocation can change as the programme develops, and the current structure should be checked on the JTC 21 pages. Standards are developed through the working groups, with experts nominated through national member bodies, with public enquiry and formal voting, and with the acceleration and exceptionality measures that CEN and CENELEC adopted in 2025 and 2026 to prioritise deliverables, as described in secondary reporting. A provider that wishes to follow a deliverable should identify its working group, its stage, and its public enquiry and voting timetable, and should record the stage on the date it checks. A deliverable in preparation is not a standard that can be relied on for a presumption, however advanced the draft may be.

What deliverables are in the programme, in outline?

The deliverables in the programme, as described in secondary reporting checked for this guide, include standards on quality management systems, risk management, dataset quality and governance, bias management, trustworthiness frameworks for logging, transparency, human oversight, accuracy and robustness, cybersecurity for AI systems, conformity assessment, computer vision accuracy, natural language processing evaluation, and AI system logging. The numbers and titles for those deliverables, including EN 18286 for quality management, prEN 18228 for risk management, and the prEN 18229 series for trustworthiness, are given in secondary reporting and in the JTC 21 tracker material, and they must be checked in the JTC 21 work programme and in the Official Journal before they are relied on. This guide does not assert a complete deliverable list, a publication count or a citation status, because the programme changes, deliverables are renamed, merged or withdrawn, and citations are published over time. A provider should check the work programme for the deliverable that covers its requirement, check the stage, and check the Official Journal for the citation, with the dates recorded. A deliverable list copied from a secondary source without those checks will quickly become out of date.

How can SMEs participate in standardisation?

Article 62(1)(d) requires Member States to facilitate the participation of SMEs and other relevant stakeholders in the standardisation development process. Participation is through the national standardisation body, which nominates experts to the CEN and CENELEC committees and working groups, and which runs national mirror committees that comment on drafts. An SME that wishes to participate should contact its national standardisation body, ask about the mirror committee for JTC 21, and ask about the arrangements for SME participation, including any support, training or funding that the national body or the Member State provides. Participation requires time and expertise, and an SME should plan for the time to read drafts, to attend meetings and to comment, in the same way as it plans for other regulatory work. The benefit of participation is early understanding of the standards, the ability to comment on drafts that will affect its products, and the ability to plan for the standards before they are cited. Participation does not give a presumption, and a participant that has commented on a draft should not present its participation as compliance with the final standard. The participation record should state the body, the committee, the dates and the comments made.

Continue with harmonised standards process.

What does this guide not state?

This guide does not state a complete deliverable list, a publication count, a citation status for any named standard, or the current stage of any deliverable. Those matters must be checked in the standardisation Decisions, the JTC 21 work programme and the Official Journal on the date of use. The programme is fast moving, with acceleration measures, public enquiries and formal votes, and a guide that stated a list or a count would become out of date quickly. This guide explains the request, the ten areas and the committee structure, and gives the checking routes for the deliverables. A provider that needs a deliverable for a specific requirement should follow those routes and record what was found.

Frequently asked questions

Continue through this AI Act cluster

• codes, standards and sandboxes overview
• harmonised standards process
• presumption of conformity and its limits
• tracking standards and guidance versions
• conformity assessment and CE marking
• proportionate duties and support for SMEs