Issue 1 · Tuesday 20 October 2026 · 5 min read
First AI Act harmonised standard hits the Official Journal; Digital Omnibus is law; Article 50 FAQ sets a 2 December date
In this issue: The week's one thing · Deadlines and obligations (3) · Guidance, codes and standards · Brussels and the capitals (2) · The number this week
The week's one thing
EN 18286:2026 — On 19 October 2026 the Commission gave official status under the AI Act to EN 18286:2026, a quality-management-system standard drawn up by CEN and CENELEC, by publishing it in the Official Journal through Implementing Decision (EU) 2026/2274. It is the first standard to receive that status and it covers the QMS that Article 17 demands of providers of high-risk AI systems. Providers who build their management system on it get a presumption of conformity with the Article 17 duties it covers.
The high-risk requirements bite on 2 August 2027 and Article 17 documentation will sit in the technical file your conformity work rests on, so until this landed there was no standard carrying that presumption. This closes one of the biggest open questions for high-risk providers, and the Commission says more harmonised standards are on the way. EN 18286 is organised around the AI system lifecycle rather than the organisation, is meant to sit on top of ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485 instead of replacing them, and lets providers in regulated sectors merge management systems rather than run parallel ones. European Commission — Shaping Europe's digital future
Deadlines and obligations
Article 50 — Applies to providers and deployers since 2 August 2026: chatbot disclosure, machine-readable marking of synthetic output, and deepfake labelling (AI Act Article 50). AESIA (Spain)
2 December 2026 — AI systems marketed before 2 August 2026 must meet the Article 50 marking obligations by 2 December 2026, per Spain's AESIA FAQ on the Commission transparency guidelines. AESIA (Spain)
2 August 2027 — The date by which every remaining AI Act provision applies, including the high-risk requirements, under Regulation (EU) 2024/1689 as amended by the Omnibus. EUR-Lex
Guidance, codes and standards
AESIA FAQ on transparency — The Spanish AI supervisory agency published a question-and-answer page on the Commission's guidelines for AI-generated content, covering who counts as a provider or deployer, the four cumulative criteria for when a chatbot must disclose itself, the three-part deepfake test in Article 3(60), and which outputs — source code, machine-to-machine results, closed industrial settings — are exempt from marking. It is a ready-made briefing for non-legal teams facing the transparency duties, and it states the fine exposure plainly. Penalties run up to 15 million euros or 3% of worldwide turnover for the previous financial year, and adherence to the voluntary Code of Practice on Transparency is offered as a route to demonstrate compliance. AESIA (Spain)
Brussels and the capitals
Regulation (EU) 2026/1744 — Adopted on 8 July 2026 and in force, it amends the AI Act along with the aviation and machinery regulations to ease implementation. The 'safety component' definition is narrowed so fewer systems count as high-risk; the Article 4 duty is softened from ensuring staff AI literacy to supporting its development; and the legal basis for processing special-category data to detect and correct bias now reaches deployers and non-high-risk systems, under Article 10(5)-style safeguards. High-risk classifications made under the old safety-component wording may need a second look, and literacy programmes planned against the harder Article 4 reading can be recalibrated. The recitals point to late standards and slow national governance set-up as the reason the compliance load came out heavier than expected. EUR-Lex
The EU AI Act Newsletter #112 — The Future of Life Institute's 6 October issue reports that tech Commissioner Henna Virkkunen, speaking at the RAID Conference, pledged to keep pursuing an international AI security agreement despite US opposition, with the EU backing a Finland- and Norway-led initiative for an AI safety monitoring body signed by 20 further countries. MEP Axel Voss publicly said the Commission is too slow on AI and that enforcement of the Act falls short of what he wants, pointing at the AI Office. These are on-the-record signals about political appetite for enforcement now that the AI Office has been in charge of general-purpose model oversight since August. The issue also notes the Commission designated ChatGPT a Very Large Online Search Engine under the DSA, prompting analysis of how duties divide between that law and the AI Act. The EU AI Act Newsletter (Future of Life Institute)
The number this week
About 40 people — The AI Office's AI safety unit runs on roughly 40 staff, per reporting relayed in The EU AI Act Newsletter #112 of 6 October — a figure MEPs are citing as evidence that enforcement capacity has not caught up with the Act. The EU AI Act Newsletter (Future of Life Institute)
Share this issue
How this issue was made. Researched and written by an agent, produced on 20 October 2026, 01:40. 135 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief and steers it; no person edited this text before it was sent.
Every issue
- 27 OctInterim order on Meta's assistants; agents that escaped testing; Council settles its Omnibus line
- 20 OctNothing new worth your time
- 20 OctFirst AI Act harmonised standard hits the Official Journal; Digital Omnibus is law; Article 50 FAQ sets a 2 December date