Legal application dates are fixed in the regulation, while standards publication and citation move on their own schedules. In October 2026 the two tracks touched for the first time: Commission Implementing Decision (EU) 2026/2274 cited EN 18286:2026, the quality management standard for Article 17, in the Official Journal on 14 October 2026. The other deliverables are behind it. The risk management, logging and cybersecurity drafts went through public enquiry over the summer and are in comment resolution or approval, and the standardisation request they answer expires on 28 February 2027. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and set the high-risk dates at 2 December 2027 and 2 August 2028. Providers planning high-risk AI in the EU therefore build most controls before the matching standards are cited. This article sets the two calendars side by side and explains how to run a credible programme against them.
The date is 2 December 2027, with important exceptions
Most high-risk AI obligations apply from 2 December 2027 for stand-alone Annex III systems, and from 2 August 2028 for high-risk AI embedded in products covered by Annex I legislation. Regulation (EU) 2026/1744 set both dates in the amended Article 113; it was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Teams should plan to those dates as the operational anchor, while accounting for specified exceptions and earlier applicability points in the Regulation. The Article 50 transparency duties have applied since 2 August 2026, with a grace period to 2 December 2026 for machine-readable marking on generative systems already on the market.
One commonly missed nuance is that certain product-related high-risk classification elements apply later (including Article 6(1) timing effects in the phased regime). This is why compliance roadmaps need legal date mapping, not one-line timeline assumptions.
For baseline context, align your legal calendar with the EU AI Act text and your role-specific interpretation from provider/deployer guidance.
Where the standards stand in October 2026
The standards workstream under CEN/CENELEC JTC 21 is broad and interdependent. QMS, risk management, trustworthiness, cybersecurity, conformity assessment, and data governance deliverables all influence each other. In October 2025 CEN-CENELEC set Q4 2026 as the target for the prioritized deliverables. The Commission request, M/593 as amended by M/613 (Decision C(2025)3871), expires on 28 February 2027.
At 17 October 2026 one deliverable has met the target. The stages below come from the CEN-CENELEC work programme and the JTC 21 site; enquiry outcomes are as reported by AI Standardisation Watch, edition 16, because CEN-CENELEC does not publish vote results on its public pages. The JTC 21 tracker keeps the full table and change log.
Multi-country consensus work takes time, and three of the drafts that reached enquiry this summer came back with enough objections to need another round. Plan on the assumption that most companion standards will not be cited before 2027.
| Deliverable | AI Act article | Stage |
|---|---|---|
| EN 18286:2026 | Article 17 | Published 22 July 2026; cited in the Official Journal 14 October 2026 |
| prEN 18228 | Article 9 | Under Approval; enquiry closed 30 July 2026; comment resolution in early November, then Formal Vote |
| prEN 18229-1 | Article 12 | Comment resolution after an enquiry that closed 20 August 2026 |
| prEN 18229-3 | Article 14 | Public enquiry, closes 22 October 2026 |
| prEN 18282 | Article 15 (cybersecurity) | Revision after an enquiry that closed 30 July 2026 |
| prEN 18229-2, prEN 18283, prEN 18284, prEN 18285 | Articles 10, 13, 43 | Commission review before enquiry |
The compliance gap you need to manage
For Article 17, the simplest presumption route now exists: conformity with EN 18286:2026. For Articles 9 to 15, no harmonised standard is cited, so providers rely on documented alternative measures, internal conformity logic, and evidence-heavy justification.
That does not block market activity, but it raises the burden of proof for providers and creates more variation in how authorities may assess implementation quality across member states.
- More emphasis on technical documentation quality and traceability evidence
- Higher need for explicit rationale when using non-harmonised controls
- Greater importance of reproducible internal review and decision records
- More scrutiny of role boundaries and substantial modification handling
Acceleration mechanisms help only after a positive enquiry
CEN/CENELEC set an accelerated route in which publication can proceed without a separate Formal Vote if the enquiry vote is positive. prEN 18228, prEN 18229-1 and prEN 18282 did not get a positive enquiry, so they go through comment resolution and a Formal Vote, the path EN 18286 took. Each Formal Vote runs for eight weeks under CEN-CENELEC rules, and the Commission then assesses a published standard before citing it.
Teams should treat acceleration updates as upside, while budgeting and staffing as if they must operate through a partial-standards period.
Execution plan through 2 December 2027
The practical model is a dual track: implement legally required controls now while preparing to absorb harmonised standards quickly when cited. The sixteen extra months move the deadline. The build takes the same amount of work.
- Track A: Build legally required controls (Articles 9-15) with auditable evidence, and run the Article 17 QMS against the cited EN 18286:2026
- Track B: Maintain standards delta maps for fast adoption when texts finalize
- Track C: Maintain a national-authority watchlist for consultation and guidance changes
- Track D: Run monthly governance reviews linked to launch and release gates. In our own test tenants, policy releases need two people, and reviewers see the draft replayed against the last 200 runs before they approve
Frequently Asked Questions
Should we wait for all standards to finalize before implementing controls?
No. Only EN 18286:2026 is cited so far, and the request for the rest expires on 28 February 2027 with several drafts still in comment resolution. Build against legal requirements now and maintain a standards-delta process to absorb harmonised texts as they are cited.
Can common specifications replace harmonised standards?
Potentially in specific cases, but organizations should not assume broad replacement. Build a primary plan around direct legal obligations and robust evidence of implementation.
What should executive teams track monthly?
Track control completion, unresolved legal interpretations, evidence quality, release-gate exceptions, and standards status updates from CEN/CENELEC and national bodies.
Key Takeaways
The workable posture through 2027 is staged execution: run the Article 17 QMS against EN 18286:2026 now that it is cited, build the Article 9 to 15 controls on the legal text, absorb the companion standards as they are cited, and keep evidence quality high enough to survive regulator-grade review. See the Omnibus timeline for every date the Digital Omnibus moved and the JTC 21 tracker for the current stage of each standard.