JTC 21 Standards Tracker: CEN-CENELEC AI Act Deliverables

What CEN-CENELEC JTC 21 is¶

CEN-CENELEC Joint Technical Committee 21 'Artificial Intelligence' (CEN/CLC/JTC 21) was established on 1 June 2021 by CEN and CENELEC, following the CEN-CENELEC Focus Group road map on AI. Its secretariat is held by DS (Danish Standards / Dansk Standard), and it unites more than 300 experts from 20 European countries. Committee identity and membership are documented on the JTC 21 site and through CEN-CENELEC.

JTC 21 produces the European and harmonised standards that sit behind the EU AI Act conformity regime. Once a standard is finalized and its reference is published in the Official Journal, conformity with it carries a legal presumption of conformity with the corresponding AI Act requirements, the mechanism set out in Article 40.

The committee is organized into five working groups. The project list below follows the JTC 21 working-group page:

• WG1: Strategic Advisory Group (SAG): programme coordination and strategic direction
• WG2: Operational aspects: risk management (prEN 18228), quality management (EN 18286), and conformity assessment (prEN 18285)
• WG3: Engineering aspects: bias management (prEN 18283), dataset quality and governance (prEN 18284), plus computer-vision accuracy (prEN 18281), natural language processing (prEN ISO/IEC 23282) and logging (prEN ISO/IEC 24970)
• WG4: Foundational and societal aspects: the AI trustworthiness framework in five parts: logging (prEN 18229-1), transparency (prEN 18229-2), human oversight (prEN 18229-3), accuracy (prEN 18229-4) and robustness (prEN 18229-5)
• WG5: Cybersecurity for AI systems: cybersecurity specifications for AI systems (prEN 18282)

The standardisation request: M/593 and amendment M/613¶

The AI Act work programme is defined by a formal standardisation request from the European Commission. The original request is M/593, issued as Commission Implementing Decision C(2023)3215 and adopted on 22 May 2023. M/593 asked CEN and CENELEC to deliver the harmonised standards supporting the AI Act, with an original delivery deadline of 30 April 2025. JTC 21 did not meet that deadline.

M/613 is Amendment 1 to that request, issued as Commission Implementing Decision C(2025)3871 and adopted on 23 June 2025. C(2025)3871 repealed and replaced the original C(2023)3215, continuing the same scope and deliverables under an extended timeline; the amended request expires on 28 February 2027, with progress reports due every three months. The CEN-CENELEC record for EN 18286:2026 names M/613 as its mandate.

The Commission's AI Act standardisation page frames the request around ten areas: risk management, governance and quality of datasets, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. Each deliverable in the work programme maps onto one or more of these areas.

In October 2025, CEN and CENELEC adopted an exceptional package of measures so the prioritized deliverables are made available by Q4 2026 at the latest. The CEN-CENELEC acceleration notice sets out two mechanisms. After a positive enquiry, a draft can go to publication without a separate Formal Vote. A small drafting group of already-active experts was tasked with finalizing the most delayed drafts. At 15 October 2026, EN 18286 is the only prioritized deliverable published. A draft that fails enquiry goes through comment resolution and then a Formal Vote, which is the path prEN 18228, prEN 18229-1 and prEN 18282 are on, with four and a half months left before the request expires.

Status of each deliverable at 15 October 2026¶

Each row gives the stage, the source for that stage, and the change since the 29 June 2026 check. The CEN-CENELEC work programme is the primary source for stage labels. CEN-CENELEC does not publish enquiry vote results on its public pages, so outcomes of the summer enquiries come from AI Standardisation Watch, a newsletter that draws on JTC 21 communications; treat those rows as reported until the work programme reflects them.

Publication milestones: European, national, and Official Journal¶

Three separate events matter for each standard. European publication is the date CEN-CENELEC makes the final text available (DAV). National publication is the date a national standards body issues its own version, such as BS EN or DIN EN. Official Journal citation is the Commission decision that publishes the reference, and only that step triggers the Article 40 presumption. They happen on different dates, so the tracker keeps them in separate columns.

How to read a stage¶

CEN-CENELEC drafts move through a numbered stage ladder. The higher the stage, the closer the text is to publication. National mirror committees shape the drafts throughout, and debate inside them can be substantive, as the France prEN 18286 debate illustrates.

Article-to-deliverable map¶

Mapping the deliverables back to the regulation shows which AI Act requirement each standard supports. It is the quickest way to find the standard attached to an obligation you already have to meet.

How JTC 21 uses ISO/IEC standards¶

European standardisation preferentially relies on existing international standards from ISO/IEC where they fit the regulatory objective. JTC 21 uses ISO/IEC foundational work as input across the prEN family. The Commission explains this logic in its understanding standardisation FAQ.

Where an international framework does not align with an AI Act requirement, JTC 21 writes a bespoke European standard. The clearest case is quality management. The Commission found that the goals and definitions of ISO/IEC 42001:2023 are not aligned with the quality management system required under the AI Act, so EN 18286 was developed as a dedicated European standard. For a deeper comparison, see EN 18286 vs ISO 9001 and ISO 42001.

Does an EN ISO/IEC adoption give Article 40 presumption today?

Not yet. JTC 21 may adopt some international standards as EN ISO/IEC texts, and teams already running an ISO/IEC 42001 management system have transferable structure they can reuse. At 15 October 2026 the only reference cited under the AI Act is EN 18286:2026. A statement-of-applicability layer can be built with the ISO 42001 SoA tool.

Article 40: from draft to presumption of conformity¶

Article 40 of the EU AI Act is the legal payoff of the standardisation programme. A high-risk AI system that conforms to harmonised standards whose references have been published in the Official Journal of the European Union is presumed to conform with the requirements those standards cover. Article 40(1) names the Chapter III, Section 2 requirements (Articles 8 to 15) and, for general-purpose AI models, the Chapter V obligations. The AI Act Service Desk summary of Article 40 shows the consolidated text.

Article 17 sits in Chapter III, Section 3. Regulation (EU) 2026/1744 added text to Article 40(2) that refers to the requirements in Sections 2 and 3, and CEN-CENELEC describes the EN 18286 citation as giving presumption of conformity with the corresponding provisions of the AI Act. Confirm the exact reach of that presumption for your QMS with counsel. The EN 18286 citation note and the Article 17 mapping cover the detail.

For every other row in the status table, the position is unchanged since June: a draft (prEN or working draft) gives no presumption. Aligning to a draft builds readiness and audit evidence.

How to use this tracker now¶

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Under the amended Article 113, Chapter III applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 for Article 6(1) and Annex I products. Build the legally required controls on that basis and absorb the harmonised standards as they are cited.

• For Article 17, work against EN 18286:2026 now. It is cited, and the national version is available or due by 31 January 2027.
• Maintain a standards-delta map: track each prEN against your existing controls so you can adopt the harmonised text quickly when it is cited.
• Build the controls for Articles 9 to 15 on the legal text with auditable evidence, using the EU AI Act requirements guide and high-risk classification guide to scope correctly.
• Watch prEN 18228 (risk management) through its Formal Vote after the November comment resolution, and the prEN 18229-3 enquiry result. Those are the next candidates for citation.
• Do not wait for prEN 18229-1 to fix your log fields. Records sealed today cannot gain a field later: when we traced our own evidence path in September 2026, some decision receipts lacked the identity of the agent that acted, and we changed the path so every policy-gate receipt carries it.
• Treat your standards inventory as a controlled artifact with a named owner and a review cadence, kept next to your control library on the standards landing page.

Change log¶

Each check records what moved, with dates as reported by the source.

• 15 October 2026. EN 18286:2026 published (DAV 22 July 2026) and cited in the Official Journal on 14 October 2026 by Implementing Decision (EU) 2026/2274. prEN 18228 moved to Under Approval after a reported negative enquiry. prEN 18229-1 and prEN 18282 reported negative at enquiry. prEN 18229-3 opened for enquiry, closing 22 October 2026. prEN 18229-2, prEN 18283, prEN 18284 and prEN 18285 moved to Commission review. prEN 18229 part titles corrected to the JTC 21 numbering. Omnibus dates updated to the published Regulation (EU) 2026/1744.
• 29 June 2026. First snapshot. EN 18286 at Approval (Formal Vote); prEN 18228, prEN 18229-1 and prEN 18282 at Enquiry; the remaining drafts in drafting; nothing cited in the Official Journal.