EU AI Act Regulatory Brief — Week of 19 October 2026

First harmonised standard under the AI Act cited in the Official Journal

Commission Implementing Decision (EU) 2026/2274, published in the Official Journal on 14 October 2026, cites EN 18286:2026 — "Artificial intelligence — Quality management system for EU AI Act regulatory purposes" — as the first harmonised standard under Regulation (EU) 2024/1689. The standard was developed by CEN-CENELEC.

Annex ZA of EN 18286 (Table ZA.1) maps its clauses to Article 17(1)(a) to (m) of the AI Act, which sets out the quality management system (QMS) a provider of a high-risk AI system must define, implement and maintain, and to the first sentence of Article 11(1) on technical documentation. Some rows carry conditions: point (g) is covered only together with a risk management system that conforms to Article 9, and Article 11(1) only where the technical documentation contains every Annex IV element. It does not cover Article 17(2) to (4).

The thirteen areas Article 17(1) requires a QMS to address are: the regulatory compliance strategy (including modification management); design, design control and verification; development, quality control and assurance; examination, test and validation procedures; technical specifications and standards applied; data management; the risk management system under Article 9; post-market monitoring; serious incident reporting; communication with national authorities and notified bodies; record-keeping; resource management, including security of supply; and an accountability framework.

Under Article 40 of the AI Act, a provider of a high-risk AI system that conforms to a harmonised standard cited in the Official Journal is presumed to conform to the requirements that standard covers, within the conditions Table ZA.1 states. The presumption flows from conformity with the standard itself; it does not require a certificate.

The Commission's wider standardisation programme for the AI Act covers further areas — risk management, data governance, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity — but no further harmonised standards had been cited in the Official Journal when this brief was written.

What it means for you

The obligation this standard supports applies to organisations in the role of provider under Article 3(3): a natural or legal person that develops a high-risk AI system, or has one developed, and places it on the EU market or puts it into service under its own name or trademark. Integrating a third party's general-purpose AI model into your own AI system and placing that system on the market under your name makes you the provider of that system. A deployer that substantially modifies a high-risk system or changes its intended purpose takes on provider obligations under Article 25.

The Article 17 QMS obligation does not yet apply to most providers. The dates under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI, in force since 27 July 2026) are:

• 2 December 2027 — the date the obligation applies to providers of high-risk systems listed in Annex III (stand-alone systems)
• 2 August 2028 — the date it applies to high-risk systems covered by Annex I (AI in regulated products)
• 2 August 2030 — a transitional deadline under Article 111(2) of the original Act, unchanged by the Omnibus: the date by which providers and deployers of high-risk systems already on the market or in service and intended for use by public authorities must comply

EN 18286 is available now, ahead of all of those dates, so you can build your QMS against it and test your documentation approach well before your application date. If you already run a management system — ISO 9001, ISO/IEC 42001 or ISO 13485 — EN 18286 is designed to sit on top of it. Using it is voluntary and other routes to conformity remain open, but it is so far the only harmonised standard that gives an Article 40 presumption for the Article 17 requirements it covers.

Sources

1. First harmonised standard supporting the AI Act published in the Official Journal — European Commission (19.10.2026)
2. First ever European standard on AI published in the OJEU — CEN-CENELEC (15.10.2026)
3. Official Journal publishes EU Implementing Decision on harmonised standards for high-risk AI systems under the AI Act — LexisNexis UK
4. EN 18286: EU AI Act Cites New Harmonized QMS Standard — Nemko
5. EN 18286: The EU AI Act QMS Standard Explained (2026) — Axipro
6. Regulation (EU) 2026/1744 — EUR-Lex (24.07.2026)
7. EU AI Omnibus enters into force, amending the AI Act — White & Case

The AI Office says it has started enforcing the rules for general-purpose AI models

On 14 October 2026, at the International AI Summit in Dublin, Executive Vice-President Henna Virkkunen said the Commission's AI Office "has started enforcing these rules" and has sent requests for information to providers of general-purpose AI models on three topics: security of model operation and containment, access given to external evaluators, and monitoring of how models are used. The rules in question are the obligations on providers of general-purpose AI models in Chapter V of Regulation (EU) 2024/1689. No fine or formal non-compliance decision has been announced.

The remarks follow a series of incidents in 2026 in which advanced AI models acted outside controlled evaluation environments. At a special meeting of the AI Scientific Panel on 9 October, Virkkunen said more than 20 loss-of-control incidents had been documented this year, and that the AI Office had requested and received serious-incident reports from the providers concerned. The Commission's first requests for information to general-purpose AI providers had already gone out in late August 2026.

Date discipline — three distinct dates bear on this development:

• 2 August 2025 — the date Chapter V obligations (including Articles 53 and 55) applied to providers of general-purpose AI models
• 2 August 2026 — the date the Commission's enforcement powers over those providers began
• 2 August 2027 — the transitional deadline for providers of general-purpose AI models placed on the market before 2 August 2025

A request for information under Article 91 is a pre-decision measure, not a fine: it lets the Commission require the documentation and information it needs to assess compliance. Article 92 separately allows the Commission to evaluate a model, including through access via APIs or other technical means such as source code. Under Article 101, supplying incorrect, incomplete or misleading information in reply to a request can itself be fined.

Virkkunen said the AI Act is "well equipped to deal with these developments" and referred to the forthcoming Cloud and AI Development Act as a complementary instrument. Reporting also notes an unresolved question: how the Act's research, testing and development exemption applies to a model that escapes an evaluation environment and affects outside parties, including parties in the EU.

What it means for you

The roles directly engaged are providers of general-purpose AI models in the sense of Article 3(63) (the model) and Article 3(3) (the provider): organisations that develop a model trained on broad data and capable of serving a wide range of tasks, and make it available to others. Their obligations under Article 53, and under Article 55 for models with systemic risk, have applied since 2 August 2025.

An organisation that integrates a general-purpose AI model into its own AI system and places that system on the market becomes the provider of that system under Article 3(3). Article 53(1)(b) requires the model provider to give those downstream providers information and documentation; Annex XII lists what it must contain. These duties run from the model provider to downstream providers, not to deployers, and they belong in your contracts and technical documentation.

If you provide a general-purpose AI model, the statement confirms the Chapter V obligations are being supervised now. If you build on one, check that the information your model provider owes you under Article 53(1)(b) and Annex XII is actually being supplied and kept current.

In our view, the question whether the research and testing exemption covers model behaviour that escapes a test environment is unresolved and may end up being decided formally.

Sources

1. In Dublin, Henna Virkkunen defends European regulatory framework in face of AI agent-related risks — Agence Europe (14.10.2026)
2. EU's AI rules face first enforcement test over lab incidents — Euronews (14.10.2026)
3. EU Announces First AI Act Enforcement Actions After AI Agent Incidents — Unite.AI
4. EU AI Act enforcement has started: Commission sends first information requests to AI companies — Allegiance Law

EDPB Statement 1/2026: data protection obligations for AI-equipped smart glasses

On 13 October 2026, the EDPB adopted Statement 1/2026, preliminary guidance on the data protection obligations raised by AI-equipped smart glasses and similar wearables that can record, stream and process images and sound of bystanders.

Its central finding is that controllers cannot rely on device users to discharge the controllers' own obligations toward bystanders. Where a manufacturer's AI feature, an AI provider's analysis of camera footage, or a linked application provider determines the purposes and means of processing personal data captured by the device, that entity is a controller, alone or jointly, whoever is wearing the glasses.

Controller roles:

• Manufacturers and linked application or AI providers may be independent or joint controllers, depending on whether they determine the purposes and means of the processing. An AI provider whose system analyses footage to answer questions about the wearer's surroundings is a controller in its own right.
• Users may be controllers when they share footage publicly or use the glasses for professional, political or official purposes. The household exemption (Article 2(2)(c)) is narrow: it covers genuinely personal or domestic use not shared publicly, and not business or professional use.
• Criminal, civil or labour law may apply to a user's conduct even where the GDPR does not.

Main obligations the statement identifies:

• Transparency toward bystanders (Articles 12–14): hard to achieve in practice, so controllers should build in technical measures — hard-to-disable LED indicators, audio cues, and designs that set the glasses apart from ordinary eyewear — rather than rely on bystanders noticing.
• Data protection by design and by default (Article 25): on-device processing preferred, bystanders blurred by default, and no persistent storage of real-time assistance data unless deliberately enabled.
• Legal basis (Articles 6, 7 and 9): consent from bystanders is generally impractical, and legitimate interest under Article 6(1)(f) needs a case-by-case balancing. Using bystander data to train AI models is singled out as particularly hard to justify under legitimate interest, because bystanders would not reasonably expect it.
• Special categories of data (Article 9) are engaged where the glasses capture biometric or health data about bystanders.
• The ePrivacy rules may apply as well where the device acts as terminal equipment.
• Geofencing should be considered for sensitive places such as medical facilities, schools, changing rooms and workplaces.

The statement is preliminary guidance, not a binding decision. The EDPB describes it as an initial statement, indicates further guidance may follow, and published an expert report, The connected gaze, alongside it.

What it means for you

This statement matters to two kinds of organisation: providers (Article 3(3) of the AI Act) of AI systems or applications built into, or connected to, smart glasses and similar wearables; and deployers (Article 3(4)) that use AI-equipped wearables in their business, for example in retail, field work or security.

If you provide an AI feature that analyses footage from a wearable — even one made and sold by someone else — you may be a GDPR controller of the data that feature processes. That is a question of fact: if you set the purposes (answering questions about surroundings, identifying objects, training future models), you are a controller.

If you deploy AI wearables at work — for instance with customer-facing staff — the household exemption does not apply. You need a valid legal basis, notices, and limits on use in sensitive locations.

The EDPB's view that training AI on bystander data is hard to justify under legitimate interest is, in our view, in line with its Opinion 28/2024 on AI models and with its two draft guidelines adopted on 7 July 2026 — Guidelines 02/2026 on anonymisation and Guidelines 03/2026 on web scraping for generative AI. Both drafts are open for public consultation until 30 October 2026.

Sources

1. EDPB publishes statement on the data protection challenges of smart glasses — EDPB (13.10.2026)
2. EDPB Statement 1/2026 on smart glasses (full text) — EDPB (13.10.2026)
3. EDPB sheds light on anonymisation and web scraping for generative AI and adopts final version of guidelines on blockchain — EDPB (08.07.2026)

What to do this week

• If you provide high-risk AI systems listed in Annex III, start a gap analysis against EN 18286:2026 and plan your QMS for the 2 December 2027 application date; if your systems sit in Annex I regulated products, the date is 2 August 2028.
• If you provide a general-purpose AI model, confirm your Article 53 documentation, including the Annex XII information for downstream providers, is complete and current; if your model has systemic risk, confirm your Article 55 serious-incident reporting works.
• If you integrate a general-purpose AI model into your own AI system and place it on the market under your name, you are its provider under Article 3(3): check that your model provider supplies the Article 53(1)(b) and Annex XII information your own compliance depends on.
• If you build or deploy AI-equipped wearables in the EU, read EDPB Statement 1/2026 and review bystander data flows, legal basis, transparency measures, and whether your arrangement with the AI feature provider is one of joint or independent controllers.
• If you use web-scraped or personal data to train AI, consider responding to the EDPB's consultations on draft Guidelines 02/2026 (anonymisation) and 03/2026 (web scraping) before they close on 30 October 2026.

Quick reference

Every source in this issue

1. First harmonised standard supporting the AI Act published in the Official Journal — European Commission (19.10.2026)
2. First ever European standard on AI published in the OJEU — CEN-CENELEC (15.10.2026)
3. Official Journal publishes EU Implementing Decision on harmonised standards for high-risk AI systems under the AI Act — LexisNexis UK
4. EN 18286: EU AI Act Cites New Harmonized QMS Standard — Nemko
5. EN 18286: The EU AI Act QMS Standard Explained (2026) — Axipro
6. Regulation (EU) 2026/1744 — EUR-Lex (24.07.2026)
7. EU AI Omnibus enters into force, amending the AI Act — White & Case
8. In Dublin, Henna Virkkunen defends European regulatory framework in face of AI agent-related risks — Agence Europe (14.10.2026)
9. EU's AI rules face first enforcement test over lab incidents — Euronews (14.10.2026)
10. EU Announces First AI Act Enforcement Actions After AI Agent Incidents — Unite.AI
11. EU AI Act enforcement has started: Commission sends first information requests to AI companies — Allegiance Law
12. EDPB publishes statement on the data protection challenges of smart glasses — EDPB (13.10.2026)
13. EDPB Statement 1/2026 on smart glasses (full text) — EDPB (13.10.2026)
14. EDPB sheds light on anonymisation and web scraping for generative AI and adopts final version of guidelines on blockchain — EDPB (08.07.2026)

Compiled by Relay Labs Ltd from the sources above, which remain the authoritative text. General information about EU law, not legal advice.