The EU AI Act has had rules for a while. Now it's starting to get the rulebook that tells providers how to meet them.

The European Commission has published the reference for EN 18286:2026, the quality management standard for providers of high-risk AI, in the Official Journal. It's the first harmonised standard under the AI Act.

Two more have just gone out for public comment. One covers bias. The other covers environmental impact.

What a harmonised standard actually does

Under Article 40 of the AI Act, providers whose high-risk systems comply with a harmonised standard cited in the Official Journal are presumed to conform with the requirements that standard covers.

In plain terms, follow the standard and you have a recognised way to show you've met the requirements it covers. For EN 18286, the focus is the quality management requirements in Article 17. It isn't a blanket guarantee of compliance with the whole Act.

Providers can still use other frameworks. But the Commission's view is that a cited standard gives legal certainty.

Why this reaches schools and colleges

Certain education uses are among the AI Act's high-risk areas, including systems used to determine access to education or evaluate learning outcomes. Standalone high-risk systems under Annex III now face the relevant obligations from 2 December 2027, after the AI Omnibus pushed the date back from August 2026.

Most UK schools won't be directly in scope. But plenty of the EdTech suppliers they buy from sell into Europe too. Those suppliers now have a published standard to build towards, and a date.

That gives UK buyers something useful: a shared language for asking questions. When a supplier says their AI product is "responsibly built", you can ask how their quality management lines up with EN 18286.

How it differs from ISO 42001

If you've heard of ISO/IEC 42001, you might wonder why another standard is needed.

ISO 42001 is a certifiable management system standard. EN 18286 exists to implement Article 17 and carry presumption of conformity under the AI Act. Its focus is quality management for the Act's regulatory purposes.

A supplier with ISO 42001 has done good work. That certificate alone won't show they're ready for the AI Act.

The two drafts worth watching

prEN 18283 defines concepts, measures and requirements for assessing and treating bias in AI systems. That covers bias in the data used to build or test the system, and bias that comes from design choices in the algorithm itself.

For schools, bias is one of the places AI harm can show up first. A tool that marks, predicts or flags pupils needs to work fairly for every group of pupils, including those with SEND or from disadvantaged backgrounds.

prEN 18287 sets out a framework and calculation methods for evaluating the environmental impact of AI systems and services, with reporting guidance and practices to reduce impact across the lifecycle. Notably, it's relevant to organisations using AI as well as those building it.

That's the first time I've seen a European standard give schools a way to ask about the carbon cost of the AI they use, rather than just the devices.

Both are drafts. They don't yet provide the same presumption of conformity as a published standard cited in the Official Journal.

What I'd do with this

  • Add a question to your AI procurement checklist: which AI Act standards is the supplier working towards, and by when?
  • Ask suppliers of any tool that assesses, predicts or monitors pupils how they test for bias.
  • Start asking about environmental impact, even if the answer today is "we don't measure it yet".
  • If you have expertise in bias or sustainability, comment on the drafts. In the UK, that route runs through BSI. Check BSI's current consultation dates, as national deadlines can differ.

Where leadership comes in

Standards like these won't land on a head teacher's desk. They'll land in supplier contracts, tender documents and data protection impact assessments.

The leaders who understand the language early will ask sharper questions. The ones who don't will take "it's compliant" on trust.

When did a supplier last show you how they test their AI for bias?

Credit to Anne Aaby Hansen’s post for flagging the publication and the two public enquiries.

Sources & further reading