How does the harmonised standards process work for the AI Act?

Who develops harmonised standards?

Harmonised standards for the AI Act are developed by the European standardisation organisations, principally the European Committee for Standardization, or CEN, and the European Committee for Electrotechnical Standardization, or CENELEC, working together in a Joint Technical Committee called JTC 21. The European Telecommunications Standards Institute, or ETSI, is also a European standardisation organisation under Regulation (EU) No 1025/2012, and its role in the AI Act standardisation work should be checked in the standardisation request and in the Commission standardisation page. JTC 21 is organised in working groups covering operational, engineering, foundational and societal, and cybersecurity aspects, with a strategic advisory group for programme coordination. Standards are developed through a consensus process with national member bodies, public enquiry, comment resolution and formal voting, under the rules of the standardisation organisations. That process takes time, and the standardisation request sets a timetable and reporting arrangements. A provider that wishes to participate in standardisation should do so through its national standardisation body, and should check the JTC 21 work programme and the working group pages for the deliverable that concerns its system. Participation is a way to understand the standards as they develop, not a way to obtain a presumption before publication.

What does the standardisation request ask for?

The Commission standardisation request for the AI Act asks CEN and CENELEC to develop harmonised standards in ten key areas, as described on the Commission standardisation page: risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. The original request was M/593, issued as Commission Implementing Decision C(2023) 3215, and it was repealed and replaced by an amended request, M/613, issued as Commission Implementing Decision C(2025) 3871 of 23 June 2025, with an extended timeline and quarterly progress reporting. The amended request expires on 28 February 2027 in the reporting checked for this guide, and that date, like the deliverable list, must be checked in the Decision itself. The request sets out the deliverables, the scope, the requirements to be covered, and the relationship to international standards work. A provider should read the request for the deliverable that concerns its system, rather than relying on a summary of the ten areas, because the request contains the detail on coverage, on fundamental rights, and on the relationship to the AI Act requirements. The request is a Commission Decision, and its text is the source to check.

For the broader regulatory framework, see codes, standards and sandboxes overview.

How does a standard become harmonised?

A standard becomes harmonised only when the Commission publishes its reference in the Official Journal of the European Union, after assessing whether the standard meets the standardisation request and the legal requirements of the AI Act. A standard published by CEN and CENELEC, without an Official Journal citation, is a European standard, but it is not a harmonised standard for AI Act purposes, and it does not give the Article 40 presumption of conformity. A draft standard in public enquiry, in formal vote, or in preparation, is not a harmonised standard, and it should not be presented as one. The Commission assessment, the citation decision and the Official Journal entry should be checked for each standard relied on, with the Decision number, the Official Journal date and the standard reference recorded. Where a standard is cited with restrictions, the restrictions must be recorded, because the presumption applies only within them. Where a standard reference is withdrawn or superseded, the presumption position changes, and the file should be updated. A provider that relies on a standard should therefore keep a standards register, with the citation status checked on the date the file is prepared and on the date the system is placed on the market.

Is applying a harmonised standard mandatory?

No. The application of harmonised standards is voluntary. The Commission standardisation page states that providers can choose any other framework to demonstrate compliance, and that harmonised standards referenced in the Official Journal provide legal certainty through the presumption of conformity. A provider that does not apply a harmonised standard must demonstrate compliance with the requirements by other means, with the technical documentation showing the solutions adopted, including a list of other standards and technical specifications applied where no harmonised standard was applied, as required by Annex IV. That demonstration must be as rigorous as the standard route, and it will be tested by the notified body or the market surveillance authority on its own terms. A provider should not choose the non standard route because it appears easier, and should not choose the standard route because it appears to guarantee compliance. The choice should be based on the coverage of the standard, the evidence available, and the ability to demonstrate compliance for the requirements the standard does not cover. The choice and the reasoning should be recorded in the technical documentation, with the coverage map.

What should a provider check before relying on a standard?

Before relying on a standard, a provider should check the standard title, number and version, the body that published it, the standardisation request it answers, the Official Journal citation and date, any restrictions, the AI Act requirements it covers, the parts of the standard applied in full or in part, and the evidence that the system conforms to those parts. It should check whether the standard has been withdrawn, superseded or amended, and whether a new version changes the coverage. It should check whether the standard is a European standard, a harmonised standard, or an international standard adopted in Europe, because the legal effect differs. It should record the checks, with dates and sources, in the standards register and in the technical documentation. It should also check whether the standard is available, whether it is a paid document, and whether the team has the version relied on, because a file that cites a standard the team has not read will fail on inspection. A standard should be read in full for the parts relied on, not summarised from a blog or a vendor claim. The checking routine should be repeated when the system changes, when a new version of the standard is published, and when the Official Journal citation changes.

Continue with CEN-CENELEC JTC 21 and the standards request.

What does this guide not state?

This guide does not state how many harmonised standards have been published, does not list the JTC 21 deliverables in full, and does not assert the status of any named standard, including EN 18286 on quality management systems, beyond the checking instruction. Reporting checked for this guide described EN 18286 as the first harmonised standard deliverable, with a reported Official Journal citation in 2026, and other reporting described no citation as at its last review. That conflict is itself the reason to check the Official Journal, rather than to assert a count or a status in this guide. A provider that needs to rely on EN 18286, or on any other standard, must check the Official Journal citation, the Decision, the standard version and the coverage, on the date of reliance, and must record what was found. This guide explains the process and the checking route, not the current citation list.

Frequently asked questions

Continue through this AI Act cluster

• codes, standards and sandboxes overview
• CEN-CENELEC JTC 21 and the standards request
• presumption of conformity and its limits
• tracking standards and guidance versions
• conformity assessment and CE marking
• high risk requirements overview