EN 18286:2026 · EU AI Act Article 17 · ISO 13485 · ISO/IEC 42001
EN 18286 in Practice: the quality system the AI Act requires
A provider implements a harmonised standard cover to cover, then finds at the assessment that part of Article 17 was never in its scope. The compliance strategy of clause 4.4 does not exist, so nothing connects to anything. None of these are hard problems: they are the consequence of reading EN 18286 as a list of clauses rather than as a set of artefacts you have to be able to produce.
Scope
What the course covers
Where a requirement is quoted, it is quoted in full and then explained. Where something is an interpretation rather than a rule, the course says so.
01
What the standard buys you
The presumption of conformity and its three conditions, what Annex ZA covers, and the three paragraphs of Article 17 that stay with you and need a written rationale.
02
The compliance strategy of clause 4.4
It has no equivalent in ISO 13485 or ISO 9001, and it is the document most often missing from an Article 17 file. Six mandatory elements, built across the course.
03
The AI system life cycle
Requirements against specifications, verification against validation, data management, continuous learning, the supply chain, and the substantial modification decision.
04
What sits next to what you already run
What transfers from an existing ISO 13485 system, what has to be extended, and what has to be built from nothing — because for a medical device with an AI component both regimes apply in full.
05
Post-market and the reporting clock
Monitoring, serious incidents and their deadlines, non-compliance and corrective action — the part that answers the question the assessment actually asks: how do you know it still works.
Outline
9 modules, in the order the standard is built
The course follows the clause sequence of the standard, and ends with the gap analysis you run on your own system.
Introduction
Course scope and how it works — free to watchArticle 17, EN 18286 and the presumption of conformity
What is covered, what is not, and how it sits next to ISO 13485The foundations: clause 4
Scope, regulatory requirements, compliance strategy, documented informationLeadership, planning and support
Accountability, the two kinds of risk, competence and communicationAI system realization: life cycle, risk, design, verification and validation
Requirements, specifications, and reproducible testingData, identification, continuous learning and documentation
The nine data operations, retention, and pre-determined changesOperations, supply chain and modifications
Model and annotation suppliers, and the substantiality determinationPost-market, serious incidents and non-compliance
Monitoring, the reporting deadlines, and corrective actionPerformance evaluation, and putting it in place
Management review, and the gap analysis you run on MondayFinal test
Covering the whole courseOutcomes
What you will be able to do
01
Know what the standard covers, and what it does not
Annex ZA states the extent of the presumption. The paragraphs of Article 17 that fall outside it stay with you, and need a written rationale rather than an assumption.
02
Write the compliance strategy of clause 4.4
Six mandatory elements, in a document whose absence is what leaves an Article 17 file with nothing connecting to anything.
03
Extend a quality system instead of rebuilding it
What transfers from what you already run, what has to be widened, and the few things that genuinely have to be built from nothing.
04
Handle data as the standard asks
The nine data operations, retention, and the changes that can be pre-determined rather than reassessed each time.
05
Decide whether a modification is substantial
The determination, its criteria, and the record that makes it defensible when the same question returns two versions later.
06
Run the gap analysis on your own system
All 146 requirements, in the order they are assessed, with the artefact each one obliges you to produce.
Format
Designed to be worked through, not watched
Self-paced and fully online, with progress saved to your account and every module replayable. Transcripts are downloadable, so the content stays searchable long after the video is finished. Access does not expire, and revisions made after your purchase are included.
Audience
Who the course is for
- Regulatory affairs and quality managers at providers of high-risk AI systems
- The person responsible for regulatory compliance, and quality managers of medical device manufacturers with an AI component
- Consultants building or auditing an Article 17 quality management system
- Internal auditors who will have to assess one
It assumes you already run a quality management system. It does not teach what a quality management system is, and it does not assume prior study of EN 18286.
Certificate
Verifiable by a third party
On passing the final test, the certificate carries a verification code derived from your name and the date of completion.
An employer, an auditor or a client can confirm it on a public page, and it can be filed as training evidence under your quality system.
MDR-XXXX-XXXX · mdregulatory.com/verify
Questions
Before you enrol
Do I need a copy of the standard?
The course does not reproduce the text of EN 18286:2026, which is protected by copyright and sold under a single-user licence. You will get considerably more from the course with a copy open next to it, and clause references are given throughout so you can go to the text yourself.
Does this replace ISO 13485?
No. If you make a medical device with an AI component, both regimes apply in full. The course is built around that case: what transfers from an existing system, what has to be extended, and what you have to build from nothing.
Do I need to be certified to ISO/IEC 42001?
No. Nothing in the AI Act requires it and no notified body can demand it. The two documents have different purposes, and the course explains where they overlap and where they do not.
Is EN 18286 mandatory?
No — it is voluntary, like every harmonised standard. But it is the only route with a presumption of conformity attached. Without it you carry the burden of demonstrating equivalent compliance, requirement by requirement.
How is this different from the AI Medical Devices course?
That course covers the product: qualification, classification, data, model, clinical evidence, markets. This one covers the system that governs it — Article 17, EN 18286, and how they sit on a quality management system you already run. They are complementary.
How long do I have access?
Access does not expire. The course stays in your account, including any updates made to the modules after your purchase.
Is there a certificate?
Yes. Passing the final test issues a certificate with a verification code, which anyone can check on our verification page.
Can I watch the modules in any order?
The modules unlock in sequence, because each one builds on the previous. Once unlocked, a module stays available and can be rewatched.
Do I need any prior knowledge?
The course assumes you work in the sector and know what a technical file and a notified body are. No knowledge of the specific technology is assumed.
Can my company buy several seats?
Yes. Write to us and we will set up team access with a single invoice.
Course and kit
The course explains the reasoning. The kit gives you the structure.
The workbook included with the course is a gap assessment of your own quality system: all 146 requirements, in the order they are assessed. Working through it produces a list of what is missing or partial.
That list maps to the templates in the EU AI Act QMS Kit.
Enrol
All 146 requirements, each mapped to the artefact it obliges you to hold.
9 modules, 2h 44min of video, downloadable transcripts, workbook and certificate. Self-paced, with no expiry.