Harmonised Standards Under the EU AI Act: What They Are and Where They Stand
Harmonised standards under Article 40 give a presumption of conformity for high-risk AI. As of mid-2026 they are still being developed by CEN-CENELEC.
Harmonised standards are technical standards developed by the European standardisation bodies — CEN and CENELEC — that, once their reference is published in the Official Journal of the EU, give a presumption of conformity with the high-risk requirements of the EU AI Act. This mechanism is set out in Article 40 of Regulation (EU) 2024/1689.
A presumption of conformity is the practical prize: if you build a high-risk AI system in line with a harmonised standard, you are presumed to comply with the corresponding requirements (the Article 9–15 stack — risk management, data governance, documentation, transparency, human oversight, accuracy and robustness). Authorities must accept that, unless they can show otherwise. It turns "prove you meet a legal requirement" into "follow a published, testable specification."
The catch, as of mid-2026: the standards are not finished. That single fact has shaped the whole high-risk timeline.
How the presumption of conformity works
The Act states the high-risk requirements in outcome terms — a risk-management system "shall be established," data must be "relevant, sufficiently representative," and so on. It does not tell you, line by line, how to satisfy them. Harmonised standards fill that gap.
The chain is specific:
- The European Commission issues a standardisation request to CEN-CENELEC for AI Act standards.
- CEN-CENELEC's joint technical committee (JTC 21) drafts the standards.
- When a standard is judged to meet the request, its reference is cited in the Official Journal.
- From that citation, conformity with the standard presumes conformity with the matching legal requirement (Article 40).
The presumption is only as wide as the standard: it covers the requirements the standard addresses, "to the extent" those are covered. It is not a blanket compliance certificate.
Harmonised standards are not the law. They are a route to presuming you meet the law. The legal requirements live in Articles 9–15 and Annex IV; a standard is a sanctioned way to demonstrate them. Following a standard is voluntary — it is one path to conformity, not the only one (see Article 41 below).
The status as of mid-2026 — and why it matters
This is the part most pages get wrong by omission. As of mid-2026, the AI Act harmonised standards are still being developed; the full set has not yet been cited in the Official Journal. JTC 21 has been working through the Commission's standardisation request, but the standards arrived later than the original legislative timetable assumed.
That delay is one of the acknowledged reasons behind the deferral of the high-risk regime. Without published standards, providers lacked the off-the-shelf benchmark the Act was designed to give them — making the original deadline hard to meet in practice.
The deferral, stated precisely: under the Digital Omnibus, the stand-alone high-risk regime (Annex III, Article 6(2)) is deferred to 2 December 2027, and product-embedded high-risk AI (Article 6(1)) to 2 August 2028. The Digital Omnibus is now adopted — the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026 — so both dates are settled; only publication in the Official Journal (expected before 2 August 2026) remains outstanding, as a formality. Note these are fixed calendar dates — the deferral is not tied to when the standards become available (the "stop-the-clock", standards-contingent variant was proposed and rejected).
What to do while standards are pending: Article 41
You are not stuck waiting. Article 41 lets the Commission adopt common specifications — implementing acts that play the same presumption-of-conformity role — where harmonised standards are insufficient, delayed, or absent. And more fundamentally, a harmonised standard is not the only way to show conformity at all.
| Route | Basis | Effect |
|---|---|---|
| Harmonised standard | Article 40 | Presumption of conformity (once cited in OJ) |
| Common specification | Article 41 | Presumption of conformity (Commission implementing act) |
| Demonstrate by other means | General | You must show, by your own technical evidence, that Articles 9–15 are met |
A provider can always meet the requirements directly — by its own risk management, data governance, testing and documentation — and prove it through the conformity assessment under Article 43. The harmonised standard simply makes that easier and lower-friction. While the standards mature, building to the substance of Articles 9–15, and watching for both the OJ citations and any Article 41 common specifications, is the sound posture.
Worked example: Brückner Diagnostik GmbH
Brückner Diagnostik GmbH is a fictional German medtech SME — about 110 employees, ~€22M turnover — building an AI system that helps triage diagnostic images, a high-risk use.
Brückner's team wants the easy path: build to a harmonised standard, get the presumption of conformity under Article 40, and move on. But as of mid-2026 the relevant AI Act standards are not yet cited in the Official Journal, so there is no standard to "build to" for the presumption. Their plan, accordingly: (1) design the system to the substance of Articles 9–15 directly — documented risk management, data governance, human oversight, accuracy and robustness — so they can demonstrate conformity by other means through the Article 43 assessment; (2) track JTC 21's progress and the OJ for citations, and watch for any Article 41 common specifications; (3) plan against the deferred 2 December 2027 date, now adopted under the Digital Omnibus. When a standard is finally cited, they can map their existing controls to it and claim the presumption then.
How Confir helps
Confir's rule-based engine classifies whether a system is high-risk under Articles 5 and 6, then lays out the Article 9–15 requirements as plain-English checklists and assembles the Article 11 / Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity — the evidence you need to demonstrate conformity whether or not a harmonised standard is yet available. It cross-maps to ISO/IEC 42001 and the NIST AI RMF so existing governance work is reused. The finding is deterministic and reproducible: same intake, same cited result.
Related guides
- Harmonised standard, defined
- Article 40: harmonised standards
- Article 43: conformity assessment
- Conformity assessment, explained
- The Digital Omnibus and the 2027 deferral
- Is the EU AI Act delayed?
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →