JTC 21 Standards Tracker: CEN-CENELEC AI Act Deliverables

What CEN-CENELEC JTC 21 Is¶

CEN-CENELEC Joint Technical Committee 21 'Artificial Intelligence' (CEN/CLC/JTC 21) was established on 1 June 2021 by CEN and CENELEC, following the CEN-CENELEC Focus Group road map on AI. Its secretariat is held by DS (Danish Standards / Dansk Standard), and it unites more than 300 experts from 20 European countries. Committee identity and membership are documented on the JTC 21 site and through CEN-CENELEC.

JTC 21 produces the European and harmonised standards that sit behind the EU AI Act conformity regime. Once a standard is finalized and its reference is published in the Official Journal, conformity with it carries a legal presumption of conformity with the corresponding AI Act requirements, the mechanism set out in Article 40.

The committee is organized into five working groups:

• WG1 — Strategic Advisory Group (SAG): programme coordination and strategic direction
• WG2 — Operational aspects: management-system deliverables, including risk management (prEN 18228), quality management (EN 18286), and conformity assessment (prEN 18285)
• WG3 — Engineering aspects: engineering methods, including bias management (prEN 18283) and dataset quality and governance (prEN 18284)
• WG4 — Foundational and societal aspects: the AI trustworthiness framework (the prEN 18229 parts covering logging, transparency, human oversight, accuracy, and robustness) and cross-cutting societal considerations
• WG5 — Cybersecurity for AI systems: cybersecurity specifications for AI systems (prEN 18282)

The Standardisation Request: M/593 and Amendment M/613¶

The AI Act work programme is defined by a formal standardisation request from the European Commission. The original request is M/593, issued as Commission Implementing Decision C(2023)3215 and adopted on 22 May 2023. M/593 asked CEN and CENELEC to deliver the harmonised standards supporting the AI Act, with an original delivery deadline of 30 April 2025. JTC 21 did not meet that deadline.

M/613 is Amendment 1 to that request, issued as Commission Implementing Decision C(2025)3871 and adopted on 23 June 2025. C(2025)3871 repealed and replaced the original C(2023)3215, continuing the same scope and deliverables under an extended timeline; the amended request expires on 28 February 2027, with progress reports due every three months. CEN-CENELEC continues to describe the deliverables as those 'requested under Standardization Request M/593 (and its Amendment M/613)'.

The Commission's AI Act standardisation page frames the request around ten areas: risk management, governance and quality of datasets, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. Each prEN deliverable in the work programme maps onto one or more of these areas.

In October 2025, CEN and CENELEC adopted an exceptional package of measures so the prioritized deliverables are made available by Q4 2026 at the latest. This Q4 2026 figure is the CEN-CENELEC programme-level availability target and is distinct from the Commission request expiry of 28 February 2027. The CEN-CENELEC acceleration notice sets out two mechanisms. First, after a positive Enquiry result a draft can move directly toward publication under the CEN-CENELEC Internal Regulations, shortening the path. Second, a small drafting group of already-active experts was tasked with finalizing the most delayed drafts. Individual Enquiry and Approval windows still move.

The Work Programme: Status Snapshot¶

The table below is the work-programme tracker: the prEN 18xxx family, the AI Act articles each operationalizes, the responsible working group, the stage reached, and the target. Stages are as of June 2026 — verify the live CEN-CENELEC work programme before relying on a stage or date. As of that snapshot, one deliverable (EN 18286) is at Approval, three (prEN 18228, prEN 18229-1, prEN 18282) are at Enquiry, and the remaining drafts are still in drafting; none is yet published or cited in the Official Journal.

How to Read a Stage, and Which Article Each Draft Operationalizes¶

One deliverable is near completion. EN 18286 (QMS) reached the Approval (Formal Vote) stage first; prEN 18228, prEN 18229-1, and prEN 18282 are at Enquiry, and the rest are still drafting. The CEN-CENELEC Q4 2026 date is an availability target for the prioritized deliverables, and it is not a guaranteed per-item publication date. Zero of these standards are published or cited in the Official Journal as of June 2026, so none yet grants Article 40 presumption of conformity.

Working-group attribution follows the JTC 21 working-group listing. Bias work (prEN 18283) and dataset governance (prEN 18284) sit in WG3 Engineering aspects; the AI trustworthiness framework parts (prEN 18229-1, prEN 18229-2, prEN 18229-3) sit in WG4 Foundational and societal aspects; cybersecurity (prEN 18282) sits in WG5; and the management-system and conformity-assessment standards (prEN 18228, EN 18286, prEN 18285) sit in WG2. For prEN 18283 specifically, the circulated working draft went out for a five-week consultation whose comment deadline was 30 April 2026, an earlier maturity stage than EN 18286.

CEN-CENELEC drafts move through a numbered stage ladder. The higher the stage, the closer the text is to publication. National mirror committees shape the drafts throughout, and debate inside them can be substantive, as the France prEN 18286 debate illustrates.

Article-to-Deliverable Map¶

Mapping the deliverables back to the regulation shows which AI Act requirement each draft is meant to operationalize. This is the inverse of the status table and is the quickest way to find the standard attached to an obligation you already have to meet.

How JTC 21 Uses ISO/IEC Standards¶

European standardisation preferentially relies on existing international standards from ISO/IEC where they fit the regulatory objective. JTC 21 uses ISO/IEC foundational work as input across the prEN family. The Commission explains this logic in its understanding standardisation FAQ.

Where an international framework does not align with an AI Act requirement, JTC 21 writes a bespoke European standard. The clearest case is quality management. The Commission found that the goals and definitions of ISO/IEC 42001:2023 are not aligned with the quality management system required under the AI Act, so prEN 18286 was developed as a dedicated European standard. For a deeper comparison of the QMS frameworks, see prEN 18286 vs ISO 9001 and ISO 42001.

Does an EN ISO/IEC adoption give Article 40 presumption today?

Not yet. JTC 21 may adopt some international standards as EN ISO/IEC texts, and teams already running an ISO/IEC 42001 management system have transferable structure they can reuse. No EN ISO/IEC text has yet been cited in the Official Journal as a harmonised standard granting Article 40 presumption. A statement-of-applicability layer can be built with the ISO 42001 SoA tool while the bespoke European deliverables remain in progress.

Article 40: From Draft to Presumption of Conformity¶

Article 40 of the EU AI Act is the legal payoff of the standardisation programme. A high-risk AI system that conforms to harmonised standards whose references have been published in the Official Journal of the European Union is presumed to conform with the requirements set out in Chapter III, Section 2 (the Article 8 to 15 requirements), and a general-purpose AI model with the corresponding Chapter V obligations, to the extent those standards cover the requirements. The AI Act Service Desk summary of Article 40 sets out the mechanism.

Article 17 (quality management system) sits in Chapter III, Section 3, outside the Section 2 requirements that Article 40(1) names. prEN 18286 operationalizes that Article 17 duty and is the deliverable nearest to citation, and quality management is within the standardisation request, so confirm the precise legal effect of any QMS citation against the published reference rather than assuming an automatic Article 40 presumption for Article 17. The interaction is set out in Article 17 mapping to prEN 18286.

Two conditions gate the presumption. The standard must be finalized and harmonised, and its reference must be cited in the Official Journal. Until both hold, a draft standard (prEN or working draft) gives no presumption of conformity; aligning to a draft builds readiness and audit evidence. The Commission FAQ states that the first harmonised standards are expected to be published by CEN and CENELEC in 2026, after which the Commission begins its review of whether the references can be cited in the Official Journal. OJEU citation follows that review.

For every entry in the status table, this means the same thing today. As of June 2026 none of the JTC 21 deliverables grants presumption, because none has been cited in the Official Journal. EN 18286, at Approval, is the most advanced and the most likely to be cited first.

How to Use This Tracker Now¶

The standards remain in draft while the high-risk obligations move toward application. Articles 9 to 15 and Article 17 apply from 2 August 2026 under Article 113, with the Article 6(1) classification rule for Annex I product-embedded systems applying from 2 August 2027. The Digital Omnibus, provisionally agreed in May 2026 but not yet adopted or published in the Official Journal as of June 2026, would, once in force, defer stand-alone Annex III high-risk obligations (including the Article 27 FRIA) to 2 December 2027. The defensible posture is to build the legally required controls now on the 2 August 2026 basis and absorb the harmonised standards quickly once cited.

• Maintain a standards-delta map: track each prEN against your existing controls so you can adopt the harmonised text quickly when it is cited.
• Build the legally required controls now (Articles 9-15 covering risk, data, transparency, oversight, accuracy, and robustness; the Article 17 QMS) with auditable evidence, using the EU AI Act requirements guide and high-risk classification guide to scope correctly.
• Watch the Enquiry and Approval moves, since those stages signal which standard is about to become citable; EN 18286 at Approval is the near-term one to track (see Article 17 mapping to prEN 18286).
• Treat your standards inventory as a controlled artifact with a named owner and a review cadence, kept next to your control library on the standards landing page.