Under Article 40, a high-risk AI system that conforms with a harmonised standard or part of a standard whose reference has been cited in the Official Journal is presumed to conform with the corresponding requirements in Section 2, to the extent covered by the standard. The presumption depends on citation, on the part of the standard applied, and on any restriction published with the citation, and it does not remove the need for conformity assessment, documentation, or direct demonstration of compliance where no cited standard covers a requirement.
What is a harmonised standard?
A harmonised standard is a European standard drawn up by a European standardisation organisation following a standardisation request from the Commission, for the purpose of supporting Union harmonisation legislation. For the AI Act, the Commission issued a standardisation request covering the Section 2 requirements and related matters, and the standardisation organisations are developing standards in response. A standard becomes harmonised for AI Act purposes when its reference is cited in the Official Journal, following the procedure in the Act and in Regulation (EU) No 1025/2012. Until citation, a standard, however useful, does not give the Article 40 presumption. Providers should therefore distinguish between a published standard, a draft standard, and a cited harmonised standard, and should record which category a standard falls into at the time it is relied on.
How does the presumption work?
The presumption works requirement by requirement and part by part. Conformity with a cited standard, or part of a standard, presumes conformity only with the requirements that the standard covers, to the extent of that coverage. A provider that applies only part of a standard gets a presumption only for that part, and must demonstrate compliance with the remaining requirements directly from the legal text. Where a cited standard is published with a restriction, the presumption does not extend to the restricted part. The provider should map each requirement to the standard clause relied on, record the version and citation, and identify any requirement that is not covered by a cited standard. That mapping is the evidence that the presumption has been used correctly, and it should be included in the technical documentation.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
What should a provider check before relying on a standard?
Before relying on a standard, a provider should check its citation status in the Official Journal, its version, its scope, any restriction published with the citation, and whether it has been withdrawn or superseded. The check should be dated and recorded, because citation status can change, and a standard that was cited at one date may later be restricted or withdrawn. The provider should also check whether the standard covers the system's intended purpose and deployment context, or whether it addresses a different context that does not map to the system. A standard relied on without a citation check, or applied outside its scope, does not give a reliable presumption, and the conformity file should show the check rather than asserting the standard's status without evidence.
What if no cited standard covers a requirement?
Where no cited harmonised standard covers a requirement, the provider must demonstrate compliance directly from the legal text, using its own design, testing and documentation evidence. That direct demonstration should be as rigorous as the standard-based route, with predefined thresholds, documented methods, and independent review. The provider should also consider whether a common specification under Article 41 is available, and should record the position on both routes. The absence of a cited standard does not postpone the requirement, and it does not justify a thinner file. It means the provider carries the full burden of showing, from first principles and from its own evidence, that the requirement is met for its system.
How should standards work be planned?
Standards work should be planned as a watching brief with a named owner, a review cadence, and a trigger for reassessment when a new standard is cited, restricted, or withdrawn. The owner should track the standardisation request, the work programme, and the citation list, and should inform product teams when a change affects a system in development or on the market. A system that was assessed by direct demonstration may later be able to use a cited standard, and a system assessed using a cited standard may need reassessment if that standard is restricted. The plan should record each standards decision, the citation checked, and the date of the check, so that the conformity file shows the standards position at the time of assessment, not only at the time of writing.
Continue with Common specifications under Article 41.
What does this guide not decide?
This guide does not state how many harmonised standards have been cited, which standards cover a particular requirement, or whether a provider's use of a standard gives a presumption for a specific system. It does not assess a standard or a mapping. Those matters require checking the current Official Journal citation list and the standard text on the date of the check, and applying them to the specific system. A provider should confirm the citation status with a competent authority or legal adviser where the position is material to the conformity route, keep the mapping current, and record every citation check with its date.
Frequently asked questions
Does following any published standard give a presumption?
No. The presumption under Article 40 depends on the standard's reference having been cited in the Official Journal, on the part applied, and on any restriction. A published but uncited standard can be useful evidence, but it does not by itself give the Article 40 presumption.
Can a provider rely on a standard only in part?
Yes, but the presumption then covers only the part applied and the requirements that part covers. The provider must demonstrate compliance with the remaining requirements directly, and must record the mapping requirement by requirement, including any restricted part.
What if standards are still in development?
The provider must still meet the Section 2 requirements by direct demonstration from the legal text, with documented design, testing and review evidence, and should consider common specifications under Article 41. The absence of a cited standard does not postpone the requirement or justify a thinner file.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗