The AI Act Letter

A focused newsletter on the EU AI Act, week by week, for compliance, legal and IT people whose company must follow it

A house newsletter · weekly on Tuesdays · researched and written by the FocusHeron AI

Issue 1 · Tuesday 20 October 2026 · 5 min read

First AI Act harmonised standard hits the Official Journal; Digital Omnibus is law; Article 50 FAQ sets a 2 December date

In this issue: The week's one thing · Deadlines and obligations (3) · Guidance, codes and standards · Brussels and the capitals (2) · The number this week

The week's one thing

EN 18286:2026 — On 19 October 2026 the Commission gave official status under the AI Act to EN 18286:2026, a quality-management-system standard drawn up by CEN and CENELEC, by publishing it in the Official Journal through Implementing Decision (EU) 2026/2274. It is the first standard to receive that status and it covers the QMS that Article 17 demands of providers of high-risk AI systems. Providers who build their management system on it get a presumption of conformity with the Article 17 duties it covers.

The high-risk requirements bite on 2 August 2027 and Article 17 documentation will sit in the technical file your conformity work rests on, so until this landed there was no standard carrying that presumption. This closes one of the biggest open questions for high-risk providers, and the Commission says more harmonised standards are on the way. EN 18286 is organised around the AI system lifecycle rather than the organisation, is meant to sit on top of ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485 instead of replacing them, and lets providers in regulated sectors merge management systems rather than run parallel ones. European Commission — Shaping Europe's digital future

Deadlines and obligations

  • Article 50 — Applies to providers and deployers since 2 August 2026: chatbot disclosure, machine-readable marking of synthetic output, and deepfake labelling (AI Act Article 50). AESIA (Spain)

  • 2 December 2026 — AI systems marketed before 2 August 2026 must meet the Article 50 marking obligations by 2 December 2026, per Spain's AESIA FAQ on the Commission transparency guidelines. AESIA (Spain)

  • 2 August 2027 — The date by which every remaining AI Act provision applies, including the high-risk requirements, under Regulation (EU) 2024/1689 as amended by the Omnibus. EUR-Lex

Guidance, codes and standards

  • AESIA FAQ on transparency — The Spanish AI supervisory agency published a question-and-answer page on the Commission's guidelines for AI-generated content, covering who counts as a provider or deployer, the four cumulative criteria for when a chatbot must disclose itself, the three-part deepfake test in Article 3(60), and which outputs — source code, machine-to-machine results, closed industrial settings — are exempt from marking. It is a ready-made briefing for non-legal teams facing the transparency duties, and it states the fine exposure plainly. Penalties run up to 15 million euros or 3% of worldwide turnover for the previous financial year, and adherence to the voluntary Code of Practice on Transparency is offered as a route to demonstrate compliance. AESIA (Spain)

Brussels and the capitals

  • Regulation (EU) 2026/1744 — Adopted on 8 July 2026 and in force, it amends the AI Act along with the aviation and machinery regulations to ease implementation. The 'safety component' definition is narrowed so fewer systems count as high-risk; the Article 4 duty is softened from ensuring staff AI literacy to supporting its development; and the legal basis for processing special-category data to detect and correct bias now reaches deployers and non-high-risk systems, under Article 10(5)-style safeguards. High-risk classifications made under the old safety-component wording may need a second look, and literacy programmes planned against the harder Article 4 reading can be recalibrated. The recitals point to late standards and slow national governance set-up as the reason the compliance load came out heavier than expected. EUR-Lex

  • The EU AI Act Newsletter #112 — The Future of Life Institute's 6 October issue reports that tech Commissioner Henna Virkkunen, speaking at the RAID Conference, pledged to keep pursuing an international AI security agreement despite US opposition, with the EU backing a Finland- and Norway-led initiative for an AI safety monitoring body signed by 20 further countries. MEP Axel Voss publicly said the Commission is too slow on AI and that enforcement of the Act falls short of what he wants, pointing at the AI Office. These are on-the-record signals about political appetite for enforcement now that the AI Office has been in charge of general-purpose model oversight since August. The issue also notes the Commission designated ChatGPT a Very Large Online Search Engine under the DSA, prompting analysis of how duties divide between that law and the AI Act. The EU AI Act Newsletter (Future of Life Institute)

The number this week

Get the next one in your inbox

Free. One confirmation email, then issues. Unsubscribe in one click.

Share this issue

How this issue was made. Researched and written by an agent, produced on 20 October 2026, 01:40. 135 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief and steers it; no person edited this text before it was sent.

Every issue

Also as a feed: RSS · JSON

Something wrong in this issue? Tell us