The AI Act phrases the requirements for high-risk systems deliberately in general terms: appropriate risk management, suitable data quality, sufficient accuracy and robustness. Harmonised standards are meant to define what that looks like concretely. They are the link between legal text and technical implementation.
Who develops them
The Commission mandated the European standardisation organisations CEN and CENELEC to develop standards for the AI Act requirements. The work runs in a joint technical committee where industry, academia and civil society are represented. Only once a standard is finished and its reference published in the Official Journal of the EU does it take legal effect.
The presumption of conformity
Under Art. 40 AI Act, a high-risk system is presumed to meet the requirements insofar as it conforms to the relevant harmonised standards. That makes the conformity assessment considerably easier: instead of justifying why a solution is appropriate, the provider refers to the standard. The standards are voluntary; those choosing another route must demonstrate compliance themselves.
Common specifications as a fallback
Where suitable harmonised standards are not available, the Commission can adopt common specifications under Art. 41, which also give a presumption of conformity. They are intended as a fallback, not the norm.
Why standardisation affects the timeline
Without finished standards, companies lack practical guidance on how to meet the high-risk requirements. The delay in standardisation was a key reason the Digital Omnibus moved the obligations for Annex III high-risk systems to December 2027 and for Annex I systems to August 2028.
What it means for companies
Anyone developing high-risk systems should follow the draft standards and align development with them rather than waiting for publication. Much of the content is foreseeable, for example on risk management, data quality, logging and quality management. ISO/IEC 42001 additionally offers a framework for the management system. The bigger picture is in our article on high-risk obligations.