Harmonized Standards for EU AI Act Compliance

· About Harmonized Standards for EU AI Act Compliance

Key Takeaways

  • Harmonised standards for the EU AI Act are voluntary technical specifications, but providers that follow published standards can gain a presumption of conformity for covered high-risk requirements.[1][2]
  • The European Commission mandates CEN and CENELEC to draft these standards, and the Commission’s AI Office oversees the standardisation programme under the AI Act framework.[1][2]
  • The original target for the first batch of standards was August 2025, but the Commission states the work missed that timeline and remains ongoing in 2026.[1][3]
  • The Commission’s 2026 Digital Omnibus proposal links the high-risk AI timetable to standards availability, pushing stand-alone high-risk AI rules to 2 December 2027 and embedded high-risk AI rules to 2 August 2028.[1][8][13]
  • Until harmonised standards are published in the Official Journal, organisations should treat them as draft implementation guidance, not binding law, and continue complying directly with the AI Act’s legal requirements.[1][11]
  • Once in force, non-compliance with the AI Act can trigger fines of up to €35 million or 7% of worldwide annual turnover for the most serious infringements, plus other sanctions.[11]

What It Is

Harmonised standards for the EU AI Act are European technical standards designed to specify how providers can meet the Act’s high-risk obligations, especially around risk management, data governance, logging, transparency, human oversight, accuracy, robustness, cybersecurity, and quality management.[1][4] They are developed by the European standardisation organisations CEN and CENELEC under a Commission mandate, and they become legally meaningful for conformity purposes only when cited in the Official Journal of the EU.[1][2]

The AI Act itself is Regulation (EU) 2024/1689. It entered into force on 1 August 2024, became generally applicable on 2 August 2026, and applies in stages for different obligations.[11] The first harmonised-standard work programme was requested in May 2023, amended in June 2025 to align with the final AI Act text, and then slipped beyond the August 2025 target; the Commission says the standardisation work is still ongoing in 2026.[1]

Key phase-in dates now matter because the Commission has acknowledged that delayed standards threaten the high-risk rollout. The current Commission position is that the AI Omnibus / Digital Omnibus proposal would extend the high-risk application timeline to 2 December 2027 for stand-alone high-risk systems and to 2 August 2028 for high-risk AI embedded in regulated products.[1][8][13]

Who Must Comply

The standards are relevant primarily to providers of high-risk AI systems, because the standards are meant to help demonstrate conformity with the AI Act’s high-risk requirements.[1][4] They also matter to importers, distributors, deployers, and product manufacturers where the AI is embedded in a regulated product that falls under Union harmonisation law.[11][13]

The AI Act has extraterritorial reach: it applies to providers and deployers placing AI systems on the EU market or putting them into service in the EU, regardless of whether they are established inside or outside the Union.[11] That means non-EU vendors selling into Europe may need to design against the harmonised standards once those standards are published.

There are no special exemptions from the standards themselves because they are not standalone legislation. However, the AI Act’s broader carve-outs still matter, including certain uses outside scope, such as some military and national security activities, and some AI practices excluded by the Regulation’s text.[11] The practical rule is simple: if the AI system is in scope of the Act’s high-risk regime, the harmonised standards are the preferred compliance benchmark once available.

Core Requirements

  1. Risk management: Providers of high-risk AI systems must operate a documented risk-management process covering foreseeable risks throughout the system lifecycle, including testing, mitigation, and post-market monitoring.[4][7]
  1. Data governance and quality: Training, validation, and testing data must be relevant, sufficiently representative, and as complete and error-free as possible for the intended purpose.[4][11]
  1. Technical documentation: Providers must maintain technical documentation showing the system’s design, intended use, and compliance with the AI Act so regulators can assess it.[4][11]
  1. Logging and traceability: High-risk systems must have appropriate logging capabilities to support traceability, incident review, and accountability.[4][7]
  1. Transparency and instructions for use: Providers must give downstream users clear instructions, performance limits, and information needed to use the system safely and as intended.[4][11]
  1. Human oversight, robustness, and cybersecurity: High-risk AI must be designed for effective human oversight and engineered to perform consistently, resist manipulation, and maintain cybersecurity protections.[4][7]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | AI Act entered into force | 1 August 2024 | The Regulation became law across the EU.[11] | | Prohibited AI practices and AI literacy obligations | 2 February 2025 | These parts of the AI Act started applying.[11] | | High-risk AI rules originally expected under the first standards programme | August 2025 | The standards programme missed this target and remained in progress.[1][15] | | AI Act generally applicable | 2 August 2026 | Most core obligations began applying; enforcement started.[11] | | Proposed new date for stand-alone high-risk AI systems | 2 December 2027 | Commission proposal would delay this high-risk application date.[1][13] | | Proposed new date for embedded high-risk AI in regulated products | 2 August 2028 | Commission proposal would delay this product-linked high-risk application date.[1][13] |

Maximum fines under the AI Act reach €35 million or 7% of worldwide annual turnover, whichever is higher, for the most serious prohibited-practice breaches.[11] Lesser infringements can attract lower maximum penalties, and authorities may also impose corrective measures, withdrawal of non-compliant systems, or market restrictions.[11]

How to Comply

  1. Map your AI inventory to the AI Act classification model. Identify whether each system is prohibited, high-risk, limited-risk, or minimal-risk, then document the legal basis for each classification.[11]
  1. Build an AI governance system aligned to ISO 42001. Use ISO 42001 to structure policy, accountability, lifecycle controls, supplier oversight, and continual improvement for the AI management system.[4][7]
  1. Integrate AI risk into ISO 27001 and NIST CSF 2.0. Map cybersecurity, asset management, incident response, access control, and resilience controls to the system’s AI-specific risk profile.[7][11]
  1. Create a conformity file before the standards are final. Maintain design specs, datasets, test results, model cards, risk logs, human-oversight procedures, and post-market monitoring plans that can later be aligned to the harmonised standards.[1][4]
  1. Engineer logging, traceability, and reproducible testing. Ensure you can reconstruct outputs, inputs, versions, prompts, and human interventions, because traceability is central to the standards programme.[4][7]
  1. Run independent validation and red-team testing. Test for bias, robustness, security abuse, hallucination in relevant use cases, and failure modes under expected and adversarial conditions.[4][7]
  1. Prepare for the delayed timetable but do not wait for final standards. The Commission has already signalled delays, so organisations should implement against the AI Act’s direct requirements now and then reconcile to the final harmonised standards when published.[1][15]

Related Regulations

  • GDPR overlaps because both regimes require lawful data processing, data minimisation, and accountability, but the AI Act adds product- and system-specific obligations that GDPR does not cover.[11]
  • NIS2 overlaps on cybersecurity governance and incident management, especially for operators in essential and important sectors, but NIS2 is broader and not AI-specific.[11]
  • Product safety and sectoral harmonisation laws can conflict or overlap where AI is embedded in regulated products such as medical devices or machinery, which is why the AI Act has separate timing for Annex I systems.[11][13]
  • The Digital Services Act can overlap for online platforms using AI for recommender systems or content moderation, but DSA duties focus on systemic platform risks rather than AI conformity testing.[11]
  • ISO 27001 / ISO 42001 are not laws, but they are the clearest management-system standards to operationalise the AI Act’s control requirements and evidence posture.[4][7]

FAQ

Does the AI Act standards programme already bind companies?

Not yet as a standalone compliance obligation. The standards are drafts until published and cited, but the AI Act’s direct legal requirements still apply where relevant.[1][11] Companies should not wait for final standards before building documentation, testing, and oversight controls.

Does the delay mean high-risk AI compliance has been postponed indefinitely?

No. The Commission has said the standardisation work is still ongoing, and the Digital Omnibus proposal gives new dates rather than removing the regime.[1][8][13] The current direction is delay, not repeal.

Do non-EU vendors have to follow these standards?

If they place AI systems on the EU market or put them into service in the EU, yes in practice they must comply with the AI Act and will often need to follow the harmonised standards to prove conformity.[11] The territorial location of the vendor does not avoid the regime.

Are harmonised standards mandatory?

Formally, no: they are voluntary technical standards. In practice, they are extremely important because following them can create a presumption of conformity for covered requirements, making them the safest compliance route for high-risk systems.[1][2]

What should companies do while standards are still unfinished?

Build an AI management and compliance programme now, using the AI Act text, the Commission FAQs, and recognised management standards such as ISO 27001 and ISO 42001.[4][7][11] Then update the control set once the harmonised standards are final and published.

Do the new 2027 and 2028 dates already apply?

Not automatically if they arise from a proposal rather than adopted law. The Commission has proposed linking the timetable to standards availability, but organisations should verify whether the legislative amendment is finally adopted before relying on those dates.[1][13]

Sources

Put it into practice

More compliance guides