Harmonised Standards and Presumption of Conformity Under the EU AI Act: A Plain-English Guide to Articles 40 and 41
If you are building or placing a high-risk AI system on the EU market, you have probably heard that "harmonised standards" are the key to compliance. That is broadly true - but the standards are significantly delayed, and waiting for them to appear in the Official Journal before you start work is a strategy that will leave you exposed. This guide explains exactly what the law says, what the delay means in practice, and how to build a defensible compliance position right now.
What "Presumption of Conformity" Actually Means - and What It Does Not
The short version: if your high-risk AI system conforms to a harmonised standard whose reference has been published in the Official Journal of the EU (OJEU), the law presumes you comply with the Section 2 requirements (Articles 8-15) - but only to the extent the standard actually covers those requirements.
That phrase "to the extent" matters enormously. A single standard will not cover every Article 8-15 obligation. Presumption of conformity is modular: you get it for the requirements the standard addresses, and you still need to demonstrate conformity by other means for anything the standard leaves out.
Article 40(1) in plain English: Under Article 40(1) of Regulation (EU) 2024/1689, high-risk AI systems (and GPAI models) that conform to harmonised standards published in the OJEU under Regulation (EU) No 1025/2012 "shall be presumed to be in conformity" with the Section 2 requirements those standards cover. This is the legal shortcut that makes harmonised standards so commercially valuable.
What "presumption" actually buys you:
- It shifts the burden of proof. Instead of you having to demonstrate conformity requirement by requirement, a market surveillance authority that wants to challenge you must rebut the presumption.
- It is the most legally certain route to CE marking for most high-risk AI systems. The Annex VI internal-control conformity assessment procedure - the route most providers will use - relies heavily on harmonised standards to substantiate the technical file.
- It is rebuttable. If your implementation of the standard is superficial, or if the standard does not actually cover a specific risk your system presents, the presumption can be challenged.
- It is voluntary. You are not legally required to use a harmonised standard. You can demonstrate conformity by other technical means. But standards are the path of least resistance, and "other means" will face much harder scrutiny.
Presumption of conformity is not a compliance certificate. It is a legal presumption that shifts the burden of proof. Your system still needs to meet the underlying requirements of Articles 8–15 — the standard is evidence that it does, not a substitute for actually doing so.
How Article 40 Works: The Standardisation Request Mechanism
Under Article 40(2), the Commission issues a standardisation request to CEN-CENELEC covering all Section 2 requirements, including deliverables on reporting and documentation to improve AI systems' resource and energy performance. Before issuing the request, the Commission consults the AI Board and the advisory forum.
That standardisation request - formally known as M/593 - was issued in May 2023 under Commission Decision C(2023)3215 (subsequently amended in January 2025). JTC 21 has taken on much greater importance since 2023 when it received this standardisation request from the European Commission in support of the EU AI Act.
The mechanics then follow the New Legislative Framework (NLF) playbook used across EU product regulation:
- Commission issues the standardisation request (M/593) to CEN-CENELEC.
- CEN-CENELEC JTC 21 - a dedicated body for developing European standards for AI, uniting over 300 experts from more than 20 countries - develops the harmonised standards.
- Once a standard is finalised and approved, the Commission reviews it and, if satisfied, publishes its reference in the OJEU.
- From the date of OJEU publication, conformity with that standard triggers the Article 40(1) presumption.
Only standards whose references are published in the Official Journal of the EU provide presumption of conformity with the AI Act - a draft or adopted standard that has not yet been cited in the OJEU carries no legal presumption.
Only standards cited in the OJEU provide presumption of conformity with the AI Act. This is a critical distinction: a standard can be technically finalised and even commercially available, but until the Commission publishes its reference in the OJEU, it does not trigger Article 40(1).
Article 41: The Common Specifications Safety Valve
What happens if the harmonised standards are never delivered, are delivered too late, or do not adequately cover the requirements? That is where Article 41 comes in.
Article 41 of the AI Act empowers the European Commission to adopt "common specifications" for the AI Act's requirements in certain circumstances, giving rise to an identical presumption of conformity as that available to systems that conform with harmonised standards. This provision is essentially a safety valve or "exceptional fall-back solution."
The Commission may (not must) adopt common specifications by implementing act if:
- The standardisation request was not accepted by any European standardisation organisation; or
- The harmonised standards addressing the request are not delivered within the deadline set under Regulation (EU) No 1025/2012; or
- No reference to harmonised standards covering the requirements has been published in the OJEU, and no such reference is expected to be published within a reasonable period.
The Commission must give the European standardisation organisations a chance to produce a harmonised standard, and can only step in if that process fails due to delay, refusal, or substantive deficiency - especially relating to fundamental rights - leaving a regulatory gap.
The sunset clause: Once proper harmonised standards are published in the OJEU, the Commission must repeal the common specifications (or the parts they overlap with). Common specifications are explicitly a temporary bridge, not a permanent alternative.
Practical significance right now: Given the standards delay (see below), Article 41 common specifications are no longer a theoretical backstop - they are a live possibility that compliance teams should monitor. If the Commission concludes that harmonised standards will not be ready "within a reasonable period," it could move to adopt common specifications, which would themselves trigger the presumption of conformity.
The CEN-CENELEC Delay: What Has Actually Happened
This is the news hook, and it is significant.
The original expectation was that CEN-CENELEC would have drafted and approved the necessary standards so that the Commission could publish their references in late 2025 or early 2026 - in time for the AI Act's high-risk requirements becoming applicable in August 2026. Meeting this deadline was always going to be ambitious, given the breadth and complexity of the topics and the need for global coordination. By late 2024 it became clear that the schedule would slip.
The standards were scheduled to be ready by August 2025 but will now be adopted in 2026, according to CEN-CENELEC.
CEN and CENELEC (JTC 21) missed their autumn 2025 deadline for harmonised standards under the AI Act. Delivery is now expected by end of 2026 at the earliest.
Why has consensus proven so hard to reach?
- Given the scope of the various required standards, their complexity, the limited resources of the standardisation development organisations, and an already tight timeline, the standards are unlikely to be adopted until 2026.
- There are elements in the context of the EU AI Act that are not captured in any of the activities from existing international standards. The regulator is asking for standardisation in areas where there is no existing state of the art.
- CEN-CENELEC's decision to accelerate the drafting of harmonised standards under the EU AI Act has sparked debate in Brussels and beyond. Senior figures within JTC 21 acknowledged internal dissent and requested a reconsideration of the exceptionality measure as a shield against political pressure.
The prEN 18286 story is instructive. On 30 October 2025, prEN 18286 - Artificial Intelligence: Quality Management System for EU AI Act Regulatory Purposes - became the first harmonised standard for AI to enter public enquiry. The draft harmonised standard for QMS failed the January 2026 enquiry vote due to insufficient national support and weighted criteria. With 1,288 comments analysed, proposals are under discussion, followed by potential revisions and voting. Publication is anticipated late 2026 or later.
prEN 18286, the draft harmonised standard for AI quality management systems under Article 17, failed its January 2026 enquiry vote and is now anticipated for publication in late 2026 at the earliest.
The timeline implication is stark: even if standards are finalised by end of 2026, the Commission still needs to review them and publish references in the OJEU before the Article 40 presumption kicks in. That process takes additional time.
Harmonised Standards vs Common Specifications vs International Standards
It helps to be clear about what each layer of the standards ecosystem does - and does not - give you.
| Standard / Instrument | Who sets it | Triggers Article 40/41 presumption? | Legally binding? | Useful now? |
|---|---|---|---|---|
| Harmonised standard (e.g. EN 18286) | CEN-CENELEC JTC 21, after Commission request M/593 | Yes — once cited in OJEU | No — voluntary to use | Not yet — none cited in OJEU |
| Common specification (Article 41) | European Commission by implementing act | Yes — once adopted | Effectively yes, unless you justify equivalent alternative | Possible future route — watch for Commission action |
| ISO/IEC 42001 (AI management system) | ISO/IEC JTC 1/SC 42 | No — not an EU harmonised standard | No | Yes — strong foundation; map to Act requirements |
| ISO/IEC 23894 (AI risk management) | ISO/IEC JTC 1/SC 42 | No | No | Yes — aligns with Article 9 risk management |
| ISO/IEC TR 24028 (AI trustworthiness) | ISO/IEC JTC 1/SC 42 | No | No | Yes — supports Articles 9, 15 robustness work |
| Draft prEN standards (e.g. prEN 18284, 18228) | CEN-CENELEC JTC 21 | No — still in draft | No | Yes — build to the draft; re-baseline when final |
The CEN-CENELEC JTC 21 Inclusiveness Newsletter of December 2025 confirms that ISO/IEC 42001 does not cover all quality management requirements of the AI Act, and a separate deliverable - prEN 18286 - is being developed to fulfil the complete set of regulatory requirements.
A high-risk AI provider audited under prEN 18286 will be assessed against a checklist that the EU regulator has effectively pre-validated. A provider audited under ISO/IEC 42001 alone will face open questions about whether each of the thirteen Article 17 elements is sufficiently covered, and the answers depend on the auditor's interpretation.
The practical conclusion: use ISO/IEC 42001 as your organisational AI management system foundation today, layer the draft prEN standards on top as they mature, and be ready to re-baseline to the final harmonised standards once they are cited in the OJEU.
How This Connects to Conformity Assessment and CE Marking
Harmonised standards are not an end in themselves - they feed directly into the conformity assessment process that leads to CE marking. Here is where they sit in the workflow:
For most high-risk AI systems, providers will use the Annex VI internal-control route: you assess your own system against the requirements, compile the technical documentation, draw up the EU declaration of conformity, and affix the CE mark. Harmonised standards are the primary technical evidence base for that self-assessment.
For higher-risk categories - certain biometric systems, critical infrastructure AI, and AI in safety components of regulated products - Annex VII applies, requiring a notified body. Even there, conformity with harmonised standards simplifies the notified body's assessment and reduces audit time and cost.
Under the Annex VI internal-control conformity assessment route, a provider who can point to conformity with a cited harmonised standard has the strongest possible evidentiary basis for their EU declaration of conformity - without needing a notified body.
For a full walkthrough of the conformity assessment routes and CE marking process, see our Conformity Assessment and CE Marking Plain-English Guide.
The Timeline Caveat: Digital Omnibus
The canonical high-risk application date remains 2 August 2026 for Annex III stand-alone systems. However, the Digital Omnibus on AI - a package of targeted amendments - has been progressing through the EU legislative process. A provisional political agreement was reached on 7 May 2026, which would defer stand-alone Annex III obligations to 2 December 2027 and Annex I obligations to 2 August 2028.
The key point: until the Omnibus is formally published in the Official Journal and enters into force, 2 August 2026 remains the legal default. Do not plan your compliance programme around a deadline that is not yet law. For the full picture, see our Digital Omnibus Deadline Guide.
Do not wait for the Digital Omnibus. Even if the December 2027 deferral is confirmed, market surveillance authorities will be active, procurement requirements will reference the Act, and notified body capacity is already constrained. Starting late compounds every risk.
Why You Cannot Wait for the Standards
The delay creates a genuine dilemma: the standards that would give you the clearest compliance roadmap are not yet available, but the deadline (whether August 2026 or December 2027) is approaching. The answer is not to wait.
Until prEN 18286 is finalised, providers rely on the Act's text, voluntary alignment with ISO/IEC 42001 (AI management systems), or sector-specific standards - though full presumption of conformity requires the cited harmonised standard.
The Act's requirements in Articles 8-15 are self-standing legal obligations. They do not become operative only when harmonised standards are published. A provider who has done nothing because they were "waiting for the standards" will be non-compliant on the application date regardless of what happens in Brussels.
Without harmonised standards, common specifications, or complete guidance, requiring compliance by August 2026 would have created a legal vacuum - providers would have obligations without knowing what compliance looks like. That tension is real, but the legal obligations exist independently of the standards.
Your Practical "Prepare Now" Plan
Before anything else, establish whether your system is actually high-risk under Annex III or Annex I. Many systems are not. See our High-Risk Classification Guide for the step-by-step logic.
Do not wait for standards. Work through each Section 2 requirement — risk management (Article 9), data governance (Article 10), technical documentation (Article 11), transparency (Article 13), human oversight (Article 14), accuracy/robustness/cybersecurity (Article 15) — and document your controls against the Act's text.
ISO/IEC 42001 is the world's first certifiable AI management system standard. It does not give you presumption of conformity, but it provides a structured, auditable governance framework that maps well to Articles 9, 10, 14, and 17. Certification signals maturity to regulators, customers, and notified bodies.
The draft standards — including prEN 18286 (QMS/Article 17), prEN 18228 (risk management/Article 9), and prEN 18284 (data governance/Article 10) — are publicly available in enquiry form. Build your controls to the draft now. When the final versions are cited in the OJEU, re-baselining will be a gap-fill exercise, not a rebuild.
Decide now whether you are on the Annex VI (internal control) or Annex VII (notified body) path. If Annex VII applies, engage a notified body early — capacity is constrained. See our Conformity Assessment and CE Marking Guide.
The quality management system under Article 17 is the backbone of your conformity assessment evidence. It must be implemented and evidenced — not just documented. Use the prEN 18286 draft as a structural guide while the final standard is pending.
Set up alerts for OJEU publications referencing AI Act harmonised standards. Also watch for any Commission move toward Article 41 common specifications — if adopted, they would trigger the presumption of conformity immediately and may arrive before the harmonised standards.
The Standards Readiness Decision Tool
Use this interactive tool to assess your current readiness posture and identify the most urgent gaps given the standards delay.
Key Takeaways
- Presumption of conformity under Article 40(1) is the most legally certain route to CE marking - but it only activates once a harmonised standard's reference is published in the OJEU, and only covers the requirements that standard addresses.
- Article 41 common specifications are a genuine fallback if standards are unduly delayed. They carry the same presumption of conformity and sunset automatically once proper harmonised standards are published.
- The CEN-CENELEC delay is real and significant. CEN-CENELEC JTC 21 missed its autumn 2025 deadline for harmonised AI Act standards, with delivery now expected by end of 2026 at the earliest - leaving a very tight window before the high-risk application date. The flagship QMS standard (prEN 18286) failed its January 2026 enquiry vote and is undergoing revision.
- You cannot wait. Articles 8-15 are self-standing legal obligations. Build to the Act's text now, use ISO/IEC 42001 as your management system foundation, map to the draft prEN standards, and be ready to claim presumption of conformity the moment OJEU references are published.
- Watch the Digital Omnibus - but plan to 2 August 2026 until it is formally law.
This guide is for informational purposes only and does not constitute legal advice. The EU AI Act is a complex regulation, its supporting standards are still being finalised, and the Digital Omnibus amendments are pending formal publication. Always verify your obligations against the official text of Regulation (EU) 2024/1689 and the latest guidance from the EU AI Office.
Related reading
EU AI Act Article 9: A Plain-English Guide to the Risk Management System for High-Risk AI
Article 9 of the EU AI Act requires a continuous, lifecycle-wide risk management system for every high-risk AI system. Here's exactly what that means and how to build one.
Article 22 EU AI Act: The Plain-English Guide to Authorised Representatives for Non-EU Providers
If you build high-risk AI outside the EU and want to sell into the EU market, Article 22 requires you to appoint an EU authorised representative by written mandate - before you go live. Here's exactly what that means.
Article 11 and Annex IV EU AI Act: Your Plain-English Guide to Technical Documentation for High-Risk AI
Every provider of a high-risk AI system must build a technical file before market launch. This plain-English guide walks through Article 11, all nine Annex IV sections, the Digital Omnibus deadline changes, and practical steps to start now.