Edition 12 (December 2025): the essence

About this issue

The newsletter is published on the JTC 21 website, the JTC 21 LinkedIn group and the ETUC website, with ETUC providing the secretariat. It repeats the reminder that ongoing projects are confidential and that details should be requested from national standards bodies.

News from the European Union

Digital Omnibus proposal. On 19 November 2025, the Commission presented its package to reduce administrative and compliance burdens. For AI, it proposed to link the application of the high-risk rules to the availability of support tools, including harmonised standards, so that providers and deployers would only have to apply those rules once the tools and standards are in place. The proposal also included simplifications, more room for real-world testing and centralised oversight of certain AI systems. The newsletter expected the package not to affect the ongoing standardisation work in JTC 21 significantly. The proposals were sent to the Parliament and the Council.

AI Act Service Desk. Since October 2025, the AI Office has run a service desk where stakeholders can submit questions on the AI Act in any official EU language, using an EU Login account, with replies by email.

Code of Practice on AI-generated content. On 5 November, the Commission started work on a voluntary Code of Practice on marking and labelling AI-generated content, to help providers of generative AI meet Article 50(2) and deployers meet Article 50(4). It will encourage consistent, machine-readable and detectable marking of synthetic audio, images, video and text, and guide deployers of deepfakes and other AI-generated content on disclosing AI involvement, particularly for information of public interest.

CEN-CENELEC JTC 21: the Copenhagen plenary

The 13th plenary took place in Copenhagen from 18 to 21 November 2025, with around 200 registered participants from 22 European countries and observers from Japan and Canada. Civil society was represented by ANEC, ETUC and Small Business Standards, and by non-profit organisations including Equinet, the 5Rights Foundation and ForHumanity. Others, such as SaferAI, took part through national delegations.

The Commission's message. DG CONNECT again stressed the tight delivery timelines. Its representatives attributed the significant delays largely to a shortage of technical expertise and supported the Technical Board's acceleration decisions. They confirmed that the Commission will carry out HAS assessments, the checks that determine whether a standard is eligible for harmonisation, on all mandated standards before they go to public enquiry. DG CONNECT also presented the Omnibus package and said guidance on reporting serious incidents was being prepared.

The delivery calendar

A new calendar was presented in Copenhagen, based on strictly time-boxed comment resolution. The newsletter stressed that it reflected the situation at the time and would be updated regularly. The calendar notes that publication by CEN-CENELEC is not the same as citation in the Official Journal, which may take weeks or months longer.

A second chart set out JTC 21's assumptions about four supporting ISO/IEC standards that are not candidates for citation in the Official Journal. The planned ISO publication dates were ISO/IEC TS 4213 (classification performance metrics) on 9 July 2026, ISO/IEC 24029-3 (statistical methods for assessing robustness) on 28 August 2026, ISO/IEC 23282 (evaluation of NLP systems) on 11 September 2026, and ISO/IEC 24970 (AI system logging) on 22 September 2026. The editors of ISO/IEC TS 4213 and ISO/IEC 23282 expected to skip the final draft stage and save about four and a half months.

Public enquiry is open to any stakeholder in a CEN-CENELEC member country, including those who are not members of their national standards body. National comment periods vary and may close before the overall deadline, so stakeholders should check their national body's timetable early.

Working group reports

WG1 (strategic advisory). Task Group Inclusiveness presented the results of its survey of JTC 21 participants, covering country representation, gender balance, stakeholder interests, standardisation experience, time commitment, and familiarity with the AI Act and with health, safety and fundamental rights issues. It also proposed measures to strengthen inclusiveness. The technical report on the overview and architecture of standards was expected at enquiry in early 2026. The Technical Coherence Forum agreed to work on three things: cross-cutting technical issues; common terminology, including finding new gaps by analysing the wording of provisions across projects; and worked examples showing how provisions are routed from one project to another.

WG2 (operational aspects). Quality management system. prEN 18286 was the first deliverable under the standardisation request to reach public enquiry, closing 22 January 2026. ISO/IEC 42001. prEN ISO/IEC 42001 was at enquiry for direct adoption from 20 November 2025 to 12 February 2026. The newsletter stated plainly that ISO/IEC 42001 does not cover all the AI Act's quality management requirements, and that EN 18286 is expected to meet them in full and serve as the harmonised standard.

Risk management. More than 400 reconsideration requests were being worked through, together with a review of the annexes and of the scope to clarify which entities the standard applies to, with a target of mid-December for the draft. A separate risk catalogue project will start in 2026, building on contributions set aside to speed up the main standard.

Conformity assessment. The editorial team was relaunched, with a draft due in December and public enquiry targeted for February 2026. The deliverable will address the requirements of Article 43.

WG3 (engineering aspects). Logging. ISO/IEC DIS 24970 on AI system logging, describing common capabilities, requirements and an information model for logging events, was at enquiry until 10 February 2026. Robustness. The DIS ballot on ISO/IEC 24029-3, on selecting, applying and managing statistical methods to assess the robustness of neural networks, was open.

Natural language processing. Committee draft consultations on ISO/IEC TR 23281 and ISO/IEC 23282 ran until 12 December. ISO/IEC TR 23281 maps AI tasks and functionalities for analysing and generating natural language, including competing terminologies and the effects of language diversity. ISO/IEC 23282 defines evaluation methods for NLP systems, with guidance on selecting, implementing and interpreting them.

Computer vision. Working-draft consultations on prEN 18281 (evaluation methods for computer vision) and prEN 18288 (taxonomy of computer vision tasks) ran until 17 December.

Datasets. Working drafts were expected in late 2025 or early 2026, and more contributions were needed. The standard will set guidance and requirements for creating and managing datasets, including design choices, data collection and preparation, and define metrics for representativeness, relevance, completeness and correctness.

Bias. Working drafts were likewise expected in late 2025 or early 2026. The standard covers the assessment and treatment of bias, including bias unwanted by providers and deployers according to their specification of the AI system.

WG4 (foundational and societal aspects). Work on the trustworthiness standards was speeding up, with two internal ballots being launched. prEN 18229-1 (Logging, transparency and human oversight) was expected at enquiry on 23 January 2026, and prEN 18229-2 (Accuracy and robustness) on 11 February 2026. The enquiry on prEN 18274 (Competence requirements for professional AI ethicists) closed on 11 December 2025. Work continued on environmental impact guidelines and metrics, upskilling on AI ethics, tools for ethical issues, fundamental rights impact assessment, and risk management in critical digital infrastructure.

WG5 (cybersecurity). The Commission reviewed the working draft of the cybersecurity specifications and identified a series of improvements needed for it to qualify as a harmonised standard conferring presumption of conformity. The drafting team was undertaking a full redraft, aiming to issue a new version before Christmas, with comment resolution running until the end of January 2026.

ISO/IEC JTC 1/SC 42

ISO/IEC 12792:2025 on the transparency taxonomy of AI systems was published. Amendment 1 to ISO/IEC 22989 and to ISO/IEC 23053, both on generative AI, was approved with comments, completing the first set of foundational generative AI standards. The committee draft of ISO/IEC 25029 on AI-enhanced nudging was approved with comments. It covers definitions, concepts, use cases and requirements for designing responsible nudging mechanisms. The committee draft of ISO/IEC 42102, the taxonomy of AI system methods and capabilities developed jointly with JTC 21 under ISO lead, was also approved with comments.

Several ballots were open. The DIS ballot on ISO/IEC 42105 (human oversight) ran from 24 November 2025 to 16 February 2026. The committee draft consultation on ISO/IEC 42007, a framework for developing conformity assessment and certification schemes for AI systems prepared with ISO CASCO, ran from 20 November 2025 to 29 January 2026. The committee draft of ISO/IEC TR 42109 (human-machine teaming use cases) was at ballot until 26 February 2026.

Fora

On 4 December, ANEC held an open webinar on consumer vulnerabilities and AI Act standards with Professor Malcolm Fisk (University of Central Lancashire, ANEC expert in JTC 21 WG1). On 1 December, CEN-CENELEC trained Annex III organisations on Annex Z, the mandatory cross-reference between a standard's clauses and the relevant EU legislation for any harmonised standard to be cited in the Official Journal; the recording and slides are online. The AI Office held three online workshops on 10–12 December on high-risk classification, covering, in turn, products under Annex I and related horizontal concepts; critical infrastructure, education, employment and essential services; and biometrics, law enforcement, migration and justice. The input will feed into the Commission's high-risk classification guidelines.

Nice to know, useful to read

AFNOR, with funding from EISMEA, is developing onboarding and training materials for current and future JTC 21 members, and invited everyone, whether active in JTC 21 or not, to answer a questionnaire on barriers to and needs in standardisation. Danish Standards published its DS PAS 2500 series in English, with practical guidance on transparency in automated decision-making, AI in public case management, bias management and AI literacy. ISO's policy brief on using international standards for responsible AI was recommended again. French researchers published a free Academic Guide to AI Act Compliance, edited by Marion Ho-Dac, Cécile Pellegrini and Bernard Long, which structures an AI Act compliance plan along the lines of ISO management system standards.

My reading

The Copenhagen calendar is the most concrete plan the series has published, and it is worth keeping next to the actual record. It placed almost every harmonised standard at public enquiry between February and May 2026 and at publication in the last week of December 2026. Datasets and bias came last, at April 2027, which is after the amended standardisation request expires on 28 February 2027.

HAS assessment before enquiry. The Commission will run its eligibility check on every mandated standard before public enquiry. The cybersecurity redraft shows what that means in practice: problems are caught earlier, but the Commission's legal reading shapes the text before the public sees it.

The two-track management system picture is now explicit. ISO/IEC 42001 is being adopted, but only EN 18286 is expected to serve as the harmonised standard for Article 17.

A frank diagnosis. The Commission attributed the delays mainly to a shortage of technical expertise. That fits the Technical Board's decision to rely on small groups of experts already active, and it sits uneasily with the inclusiveness agenda that this newsletter exists to serve.

The Copenhagen delivery calendar

Publication by CEN-CENELEC is not the same as citation in the Official Journal, which may take weeks or months longer. The calendar reflected the situation in November 2025 and was to be updated regularly.

For the live status of each standard, see the Standards Explorer.

Since then (status September 2026)

Stages for the prEN drafts are drawn from public trackers and commentary as of mid-2026. Verify against the live CEN-CENELEC work programme before relying on them. No JTC 21 deliverable gives a presumption of conformity until its reference is cited in the Official Journal.