The missing harmonised standards: why CEN-CENELEC's delay reshaped the AI Act timeline

Most of the AI Act's high-risk obligations are written at the level of outcomes — risk management, data quality, human oversight, robustness — not of methods. The methods live somewhere else: in harmonised European standards. Understanding why those standards are late, and what was done about it in 2026, explains a timeline shift that otherwise looks arbitrary.

What a harmonised standard buys you

Under Article 40 of the AI Act, a high-risk system that conforms to a harmonised standard whose reference has been published in the Official Journal of the EU enjoys a presumption of conformity with the corresponding requirements. This is the same legal device that underpins CE marking across EU product law: the regulation sets the essential requirements; the standard supplies the testable specification; and a provider that follows the standard is presumed to meet the law, shifting the burden of proof. Without the standard, a provider must still meet the requirement — but has to demonstrate it from first principles, with far more legal uncertainty. For the conformity assessment that high-risk providers face, the harmonised standards are not a nicety; they are the practical route to compliance.

Who writes them, and why they are late

The European Commission tasked CEN and CENELEC — the EU's private standardisation bodies — through Standardisation Request M/593 (later amended by M/613) to deliver the AI Act's harmonised standards. The drafting runs through their joint technical committee, CEN-CLC/JTC 21 "Artificial Intelligence," active since 2021. The original delivery deadline was 30 April 2025. It was missed: writing testable specifications for concepts as contested as "robustness" or "bias" in general-purpose technology proved far harder than for cement or pressure vessels, and consensus among industry, academia, SMEs and civil society moved slowly.

The October 2025 emergency measures

At the joint Technical Boards meeting of 14–16 October 2025, CEN and CENELEC adopted an exceptional package to accelerate delivery and target availability by Q4 2026. Two measures stand out. First, where an Enquiry vote is positive, the boards allowed direct publication of the draft without a separate Formal Vote — collapsing two voting rounds into one. Second, a small drafting group of existing experts was set up to finalise six delayed drafts before wider working-group review. Among the key deliverables is prEN 18286, a standard for AI quality management systems that supports the conformity-assessment framework.

The link to the Digital Omnibus

The standards gap did not stay inside the standardisation world. When the Commission proposed the Digital Omnibus simplification package on 19 November 2025, the late arrival of harmonised standards was a stated reason for pushing the high-risk start dates back. As covered in our Digital Omnibus file, the application date for Annex III high-risk systems moved from 2 August 2026 to 2 December 2027. The causal chain is worth stating plainly: no standards, no presumption of conformity; no presumption of conformity, no realistic way for thousands of providers to certify on the original schedule; therefore the schedule moved.

Standards you can already use

The harmonised standards are not the only ones in play. The international EN ISO/IEC 42001:2026 — the European adoption of the ISO/IEC 42001 AI management-system standard — is available now and certifiable, and an organisation that builds an AI management system on it lays much of the groundwork a future harmonised QMS standard will demand. A 42001 certificate does not by itself grant the Article 40 presumption of conformity — only the harmonised standards listed in the Official Journal do that — but the overlap is substantial. The practical advice for a high-risk provider is therefore unchanged by the delay: build the management system now, and treat the harmonised standards, when they land in 2026–2027, as the formal specification to map onto work already done. See also our overview of high-risk obligations.