The first harmonised standard under the EU AI Act has landed, giving medical device manufacturers a much clearer route through one part of the AI Act compliance puzzle.
EN 18286:2026 addresses the quality management system (QMS) requirements for providers of high-risk AI systems. For medtech companies whose products fall within the AI Act’s high-risk regime, it provides a practical framework for translating the requirements of Article 17 into an operational QMS.
More importantly, manufacturers do not necessarily need to start from scratch.
One QMS, Not Two
EN 18286 has been designed to work alongside existing management system standards, including ISO 9001 and ISO/IEC 42001, as well as sector-specific QMS frameworks such as ISO 13485 for devices.
Rather than building a separate “AI Act QMS” alongside their existing medical device processes, manufacturers can look to extend and adapt their existing QMS to address AI-specific requirements. For companies already grappling with the overlap between the MDR or IVDR and the AI Act, that is a welcome development.
What Does EN 18286 Actually Cover?
The standard turns Article 17’s relatively high-level requirements into a more structured management framework. Among other things, it addresses:
- Governance: Management responsibility, quality policies, and allocation of roles, responsibilities, and authorities.
- People and resources: Planning, resources, competence, and communication.
- The AI lifecycle: Inception, design and development, verification and validation, deployment, operation, and monitoring.
- Data: requirements and guidance around data management.
- Third parties: Supply-chain management and supplier controls.
- Change management: Managing changes to AI systems throughout their lifecycle.
- Post-market controls: Monitoring, serious incident reporting, and management of non-conformities.
- Performance and impact: Performance evaluation, fundamental-rights considerations, and assessment of risks and impacts on affected persons.
- Integration: The relationship with other standards and frameworks, including ISO 13485, ISO 9001, and ISO/IEC 42001.
What Should Medical Device Manufacturers Do Now?
Manufacturers developing high-risk AI-enabled medical devices should now run a gap analysis between EN 18286 and their existing QMS, particularly where that QMS is built around ISO 13485. The exercise should identify:
- What is already covered. Map existing MDR/IVDR and ISO 13485 processes against EN 18286.
- Where AI creates new requirements. Identify controls that are not adequately addressed by the existing medical-device QMS.
- Where existing procedures can be extended. Look first at adapting existing design controls, supplier management, change control, post-market monitoring and CAPA processes rather than creating parallel systems.
What About Deployers?
EN 18286 also gives deployers a more concrete benchmark for scrutinising high-risk AI systems before they are put into use.
For hospitals, healthcare providers and medical device manufacturers procuring third-party AI systems, the standard can support supplier due diligence and contract negotiations. But a statement of compliance should not become a substitute for proper scrutiny. Deployers should consider including contractual commitments to maintain compliance, provide relevant documentation and notify the deployer of material changes or serious incidents.
Missing Harmonised Standards: A Moving Target
EN 18286 is an important milestone, but it is only one piece of the high-risk AI compliance framework. The industry is still waiting for standards addressing other key AI Act requirements, including risk management, data and data governance, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity. That creates a practical challenge for manufacturers: implementation cannot wait until the complete standards package is published.
For medical device manufacturers in particular, the task is to build an integrated compliance framework across the AI Act, MDR/IVDR, and existing ISO standards today, while maintaining enough structural flexibility to incorporate future harmonised standards as they emerge.
