EN 18286, the AI Act quality management system standard, was published in July 2026, and the wait is now over. As the AI Act allows you to integrate its requirements into your existing ISO 13485 QMS, you won’t need to build a parallel management system. So, no more excuses: it’s time to update your quality management system!
Does the EU AI Act apply to your medical device?
If your medical device contains AI features, you must comply with the EU AI Act, an additional regulation on top of the MDR or IVDR. When a device requires notified body involvement under the MDR or IVDR, its AI system is classified as high-risk, and its compliance with the AI Act must be assessed by a notified body.
When do the AI Act requirements apply to medical devices?
Unlike the MDR, the first AI Act obligations applied quickly: AI literacy requirements and prohibited practices have applied since February 2025, and transparency rules since August 2026. However, the high-risk requirements for AI systems that are regulated products, or safety components of regulated products such as medical devices, have been postponed until August 2, 2028.
National authorities have been able to enforce these obligations since August 2026.
The postponement comes from the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on July 27, 2026.
What is EN 18286?
EN 18286, “Artificial intelligence - Quality management system for EU AI Act regulatory purposes”, is the standard companies were waiting for. Published in July 2026, it is a quality management system standard designed for the specific requirements of the AI Act, not for AI governance in general.
One of the requirements that had companies scratching their heads was how to implement a management system compliant with the AI Act, as no standard like the good old ISO 13485 for medical devices was available for this new regulation.ISO/IEC 42001 “Artificial intelligence - Management system” had already been available since 2023, but as a general AI management system standard focused on responsible AI governance, it was never designed to meet the specific requirements of the AI Act.
And EN 18286 now has legal weight. On October 14, 2026, the European Commission cited it in the Official Journal through Implementing Decision (EU) 2026/2274, so applying it gives you a presumption of conformity for the AI Act requirements it covers. That presumption is limited to those requirements, and using the standard remains voluntary.
ISO 13485 vs EN 18286: Not the same philosophy
ISO 13485 is built to make your QMS and devices comply with the regulations of all the countries where you sell. EN 18286 is designed for one regulation and one regulation only… the AI Act! Where ISO 13485 leaves you a lot of flexibility, the AI Act is far more prescriptive on what and how you need to do things.
|
Aspect |
ISO 13485 |
EN 18286 |
|
Regulatory scope |
Regulations of all the countries where you sell |
One regulation: the AI Act |
|
Level of detail |
A lot of flexibility on how to implement your process; does not go into details |
A lot more prescriptive on what and how |
|
Structure |
Old structure (ISO 13485:2016) |
Harmonized Structure (HS), used by ISO 9001 since 2015 |
That’s why 37 times, you’ll find a requirement followed by the dreaded “and all applicable regulations”, which quickly becomes a challenge for any quality professional when regulations start piling up.
Since EN 18286 is a brand-new standard, it adopts the Harmonized Structure (HS) to organize the different sections. While this order has been used by ISO 9001 since 2015, ISO 13485:2016 still uses the old structure, and so you may have to do some mental gymnastics when comparing the two standards.
What’s really new in EN 18286?
Four things are really new when you compare EN 18286 with ISO 13485:
- a data management process covering the whole data life cycle
- fundamental rights in risk management, with an inception phase upstream of design and development
- defined processes for retiring an AI system
- a dedicated instructions for use (IFU) procedure for each AI system
Data management
This is probably the biggest novelty: ISO 13485 has no equivalent process for the data used to build and run an AI system. EN 18286 requires a data management strategy aligned with your regulatory compliance strategy, and a documented process covering the whole data life cycle. Each dataset version must be traceable to the AI system version it was used for.
Hopefully, if you have products on the market, you already have procedures to manage all your data, and it’s worth checking against EN 18286 to close the remaining gaps. If you’re a young company, write the procedure as early as possible and set up dataset versioning before your design records start piling up.
Fundamental rights
While medical device risk management focuses on safety and performance, EN 18286 widens the objective of the whole QMS and of risk management by bringing fundamental rights into the equation. Fundamental rights are related to dignity, freedom and other matters that are listed in the Charter of Fundamental Rights of the European Union.
This addition will require the creation of new harm categories, revised risk acceptability criteria and a revised evaluation of risk control measures. During management review, you’ll need to assess how effectively fundamental rights are protected.
Protection of fundamental rights must be included at the beginning of any product development. Simply adding it as a design requirement in your design and development (D&D) process is not enough: EN 18286 introduces inception, a dedicated phase upstream of design and development in which you determine the intended purpose of the AI system, address its potential impact on fundamental rights and, depending on the risk, consider consulting affected persons or their representatives. The outputs of inception then become inputs for design and development.
Retirement
ISO 13485 does not address the end of life of a product. EN 18286 asks you to define the processes and tasks to perform when an AI system is retired, such as risk control measures and data management measures. You must also inform deployers of every measure they have to perform themselves when the system is retired.
IFU procedure
Instructions for use are nothing new for medical device manufacturers, but EN 18286 requires a dedicated system and procedure to establish and maintain them for each AI system, with its minimal content defined in Article 13 of the AI Act. IFU is listed here rather than in the section below because it also takes on new roles: when you cannot monitor the AI system yourself, it must describe the monitoring that deployers need to perform, and it must be linked to the unique reference of each AI system version.
What’s new but not so new in EN 18286?
If you already market devices in the EU, three EN 18286 topics will give you a sense of déjà vu, as the medical device regulations already address them: regulatory strategy, post-market monitoring and vigilance. You can extend your MDR/IVDR procedures, but the AI Act adds AI-specific content, such as prescriptive monitoring requirements and a different definition of a serious incident.
Regulatory strategy
EN 18286 requires a documented strategy that covers at least compliance with the AI Act essential requirements, post-market monitoring, serious incident reporting, data management, the conformity assessment route and the management of modifications. So you’ll simply need to extend your MDR/IVDR procedure and strategy with the AI Act requirements, and the job is done.
Post-market monitoring
Post-market surveillance has existed since the Medical Device Directives, so this is a well-known topic, although the AI Act calls it post-market monitoring. EN 18286 follows the same logic: a post-market monitoring system, documented in a plan that is part of the technical documentation, that evaluates continued compliance with the essential requirements until the AI system is retired.
What changes is the content, as EN 18286 is way more prescriptive. Monitoring must consider AI-specific aspects such as data privacy, reasonably foreseeable misuse, interactions with other AI systems and technical constraints, and it often relies on the AI system’s logs to capture operational data, a capability you may need to build into your design.
Vigilance
The legislator had the good idea to mirror the reporting of serious incidents on the MDR model. Reporting serious incidents is familiar territory, and the AI Act time scales mirror the MDR ones. However, the AI Act definition of a serious incident is different from the medical one. As it also covers infringements of obligations protecting fundamental rights, your vigilance procedure needs to be reviewed. Finally, deployers can play a key role and must be considered in your procedure along with distributors, importers and authorities.
What needs some adaptation in your QMS?
Three parts of your existing QMS need some adaptation rather than a rebuild: HR, the design and development process, and identification. Training plans and job descriptions must cover the AI Act, EN 18286 is more prescriptive about documentation than ISO 13485, and each AI system version needs a unique reference linked to its instructions for use, technical documentation and datasets.
HR
Training plans and job descriptions will need to cover the AI Act and the intended purpose of each AI system, and competence requirements must take into account AI-specific factors such as the nature of the technology and data. While the equivalent of the management representative is also required, management must also assign people responsible for risk management and for monitoring regulatory requirements and the state of the art, together with explicit authority to intervene.
D&D process
EN 18286 is more prescriptive than ISO 13485, so while the D&D process doesn’t really change except for the new inception phase, you will have to review your documentation to ensure that all specific requirements for design output, test protocols, etc., are included in your documentation.
Identification
Your identification and traceability procedure provides a good basis, but each version of an AI system must now receive a unique reference. That reference must be linked to its instructions for use, technical documentation and datasets.
How to start updating your QMS for EN 18286
Start with a gap analysis of your quality management system against EN 18286, then prioritize the changes and update your procedures. You’ve got a good basis to start from, and you shouldn’t wait for 2028 to find out where your gaps are.
There are many other small little adjustments to perform here and there in your processes and documentation, but this blog is already quite long.
Our Qserve experts have already mapped EN 18286 against ISO 13485 and can help you perform a gap analysis of your quality management system, prioritize the changes and update your procedures. Contact us to get your QMS AI Act-ready.
Learn more about our AI regulatory support and QA support, or check where you stand first with our QMS AI readiness quiz.