New standards for AI: EN 18286 and ISO/TS 24971-2 are out, presumption of conformity is not
Disclosure: The operator of this site provides engineering services in regulatory affairs for medical devices.
What happened: AI medical devices have two new reference documents. ISO/TS 24971-2 was published in June 2026. It is guidance on applying ISO 14971, the risk management standard for medical devices, to machine learning, and covers risks from training data, bias, explainability, autonomy and performance degradation over time. In July, CEN-CENELEC published the European standard EN 18286, which describes a quality management system (QMS) for the requirements of Article 17 of the AI Act.
The problem: Both documents help, but neither provides legal certainty yet:
- EN 18286 only grants a presumption of conformity once it is cited in the Official Journal of the EU. Presumption of conformity means that complying with the standard counts as meeting the corresponding legal requirements. Publication by CEN-CENELEC alone is not enough, and no citation had been confirmed at the time of writing.
- ISO/TS 24971-2 is a Technical Specification, in other words guidance. It supplements ISO 14971 without changing its requirements. It also explicitly excludes devices based on large language models and generative AI, which is exactly where most of the open questions are.
What manufacturers can do:
- No second QMS: Extend the existing ISO 13485 QMS with the requirements of EN 18286 instead of setting up a parallel system. A side-by-side comparison of the two standards shows the gaps.
- Add ML hazards to the risk file: List data shift, bias and misclassification as hazards in their own right in the ISO 14971 file, using ISO/TS 24971-2 as guidance.
- Justify generative components separately: There is no standard to point to for language models. Risk management has to document its own rationale for how incorrect outputs are detected and contained.
- Watch for the Official Journal citation: The presumption of conformity applies only once EN 18286 is cited. Until then, the standard is a good benchmark, not proof.
Context: The standards are paid documents. This article is based on catalogue and announcement pages and on expert commentary, not on the full text of the standards.
Source: ISO/TS 24971-2:2026 Medical devices — Guidance on the application of ISO 14971 — Part 2: Machine learning in artificial intelligence (ISO), of 17 Jun 2026