New AI standard EN 18286

What should an MD/IVD manufacturer do?

10/29/20263 min read

EN 18286 through an MD/IVD manufacturer’s eyes

The reference to EN 18286:2026 was published in the EU Official Journal on 14 October 2026. It is the first harmonised standard cited in support of the AI Act. It provides a presumption of conformity within its regulatory coverage, notably the quality management requirements of Article 17, not compliance with the entire AI Act.

I read the standard through the eyes of a medical device and IVD manufacturer and picked out a few points that caught my attention. This is not a review of the whole standard or a complete list of its requirements. All interpretations are my own.

For a manufacturer with an ISO 13485 quality management system, much is familiar: intended purpose, documented requirements, design controls, verification and validation, traceability and lifecycle processes. The question is: what needs to be added to the existing system?

A few points that stood out

Fundamental rights in risk management

AI-related risk management explicitly addresses fundamental rights alongside health and safety. Interested parties should also be consulted on the risks, including those affected by the system. This deserves particular attention when extending familiar device safety risk-management processes.

Data management, including data suppliers

Data includes training, validation and test data, logging data, input data and other data needed for the system’s purpose. It needs a strategy, documented processes and risk-proportionate measures. Archiving and destruction must meet applicable requirements, and data management may also be needed when the system is retired.

Neither ISO 13485 nor IEC 62304 offers a straightforward, ready model for this. Supplier controls also need to explicitly cover externally sourced data.

Continuously learning systems and pre-determined changes

This was the most interesting point for me. The manufacturer must define and document in advance what changes a learning system is allowed to make. These changes are considered in risk management and verified and validated. All changes are logged, and the learning is described in the technical documentation and instructions for use.

The term “pre-determined change” is not defined in the standard. The regulatory background is the AI Act: for continuously learning systems, changes pre-determined at the initial conformity assessment and described in the technical documentation do not constitute a substantial modification. A substantial modification requires a new conformity assessment.

This is not unrestricted permission to change the system. Applicable MDR/IVDR change requirements still need to be assessed. Anyone familiar with FDA’s Predetermined Change Control Plan (PCCP) will recognise the idea, although the EU and US mechanisms are not interchangeable.

Post-market monitoring and corrective action

Systematic monitoring, identifying emerging hazards, investigating incidents and taking corrective action are familiar activities. For AI systems, they need to address AI-specific risks and performance throughout use.

For medical devices and IVDs, AI Act incident reporting must be coordinated with MDR/IVDR vigilance, taking into account the specific reporting provisions for these devices.

What should an MD/IVD manufacturer do?

For an MDR/IVDR manufacturer acting as the provider of a high-risk AI system, the AI-specific requirements can be integrated into the existing EN ISO 13485-based QMS. The task is to identify and close the gaps, not create a parallel QMS.

I would start by reviewing fundamental rights in risk management, data lifecycle management, externally sourced data, learning systems and change control. These are starting points from my reading, not a complete compliance checklist.

Now is the time to get the standard and assess what it means for your products.

Sources

Quality and Regulatory Consulting

Expert services in medical device regulation and quality compliance.

contact information

Karkinen Consulting Oy, Helsinki, Finland
Business ID: 3103786-9
info@karkinen.com

NATO NCAGE code A10CG

© 2026. All rights reserved.