Edition 13 (February 2026): the essence

About this issue

The newsletter is published on the JTC 21 website, the JTC 21 LinkedIn group and the ETUC website, with ETUC providing the secretariat. As before, it notes that ongoing projects are confidential and that details should be requested from national standards bodies.

News from the European Union

High-Level Forum. The Forum's Sherpa subgroup, its main operational body, held its 12th meeting online on 10 February 2026. It discussed the Forum's work programme for 2026–2028, wrapped up the activities of its first mandate, and prepared the 4th Forum meeting, scheduled for 19 March in Brussels.

Final report of Workstream 12 on AI. The workstream aimed to raise awareness of the AI standards being developed under the Commission's request, encourage broader participation, and improve understanding of their scope. Its final report gives an overview of the outreach carried out on the AI Act, the standardisation request, and the role of JTC 21 working with ISO/IEC JTC 1/SC 42.

CEN-CENELEC JTC 21

Inclusiveness survey. The survey carried out in spring 2025 received 146 responses from the 195 eligible JTC 21 members and observers. The newsletter cautions that representativeness cannot be fully guaranteed, but says the results show strengths, gaps and opportunities for more equitable participation. A summary is on the JTC 21 website.

Next plenary. The next plenary was to be held online on 11–13 March 2026.

Overall progress. Work on the standards supporting the AI Act had accelerated considerably since December 2025.

WG1 (strategic advisory). The Commission reviewed the final version of the technical report Overview and architecture of standards in support of the AI Act before its public enquiry. The report presents the standards being prepared under the standardisation request C(2025) 3871 and explains how they relate to each other and to the requirements of the Act.

Working group reports

WG2 (operational aspects). Risk management. prEN 18228 was finalised in December 2025 and submitted to the Commission ahead of public enquiry, with a revised scope awaiting approval. It sets requirements and practical guidance for identifying, addressing and mitigating risk across the AI lifecycle, for a broad range of AI-based products and services, with explicit attention to vulnerable people. It covers risks to health and safety and to fundamental rights, with potential impacts on individuals, organisations, markets and society. It also sets out methods for determining whether a set of risk management measures can keep identified risks monitored and managed at an acceptable level.

Quality management system. The public enquiry on prEN 18286 closed at the end of January 2026, and the draft did not obtain the required approval, failing both the count of national members in favour and the weighted population criterion. It received 1,288 comments. The project editor had prepared proposed resolutions for all of them, and requests for reconsideration were to be handled at a five-day hybrid meeting in London from 2 to 6 March.

ISO/IEC 42001. The enquiry on direct adoption of ISO/IEC 42001 ran until 12 February. The newsletter repeated that it is not intended to be harmonised under the AI Act. EN 18286 is the candidate harmonised standard for the Act's requirements in this area, including those relating to health, safety and fundamental rights.

WG3 (engineering aspects). Bias. prEN 18283 defines concepts, measures and requirements for assessing and treating bias not intended by the provider or deployer under their specification of the AI system. It covers data-related bias, including bias in datasets used to develop, train or assess AI systems, and system or model bias arising from algorithmic factors such as design choices.

Datasets. prEN 18284 sets guidance and requirements for creating and managing datasets, including design choices, collection and preparation, and defines metrics for representativeness, relevance, completeness and correctness across training, validation and test data, for any AI technology.

Timeline for both. The two drafts were reviewed in depth at a three-day hybrid workshop in Delft in early January. Further adjustments were being made, with the aim of submitting them to the Commission ahead of public enquiry by 15 June 2026.

Natural language processing. ISO/IEC TR 23281 (overview of NLP tasks, including the effects of language diversity across all languages, dialects and variants, official or not) and prEN ISO/IEC 23282 (evaluation methods for NLP systems, including requirements on implementing metrics and on the technical resources used in evaluation) were both approved with comments.

Logging. prEN ISO/IEC 24970 was at European enquiry until 10 February, as a parallel project under SC 42 lead. It describes common capabilities, requirements and an information model for logging events in AI systems, for use together with a risk management system. Subject to a positive Commission assessment, it was expected to support Article 12 at least in part.

WG4 (foundational and societal aspects). prEN 18229-1 (Logging, transparency and human oversight). The revised draft with the editor's responses was circulated in December. Reconsideration requests were received until 4 January and reviewed on 7 and 9 January, after which the final working group version was sent to the Commission ahead of enquiry.

prEN 18229-2 (Accuracy and robustness). The revised draft was also circulated in December. Reconsideration requests closed on 27 January and were reviewed on 28 and 30 January, and the final version was due to go to the Commission at about the time the newsletter was published.

prEN 18274 (Competence requirements for professional AI ethicists). The draft was approved at enquiry with comments. It sets out the knowledge, skills and attitudes required of AI ethicists, including a strong understanding of European values and fundamental rights. The editor's proposed disposition of comments was published on 13 January, with further contributions invited until 5 February, reconsideration requests until 10 February, and discussion on 12 February.

WG5 (cybersecurity). COBALT, an EU Horizon project on cybersecurity certification of ICT using decentralised digital twins, was granted liaison status.

ISO/IEC JTC 1/SC 42 (selected work)

Ballots and advanced drafts. Data quality visualisation. The draft technical report ISO/IEC 5259-6, a visualisation framework for assessing the results of data quality measures, was at ballot until 19 February.

Robustness. ISO/IEC 24029-3, on statistical methods for assessing neural network robustness, was at ballot until 27 April.

Human oversight. ISO/IEC 42105 was at ballot until 19 February.

Nudging. Comment resolution on ISO/IEC 25029 was due to finish in early March, before a draft international standard ballot. The standard is meant to support both organisations using AI-enhanced nudges and those protecting consumers, workers and the public.

Conformity assessment schemes. The committee draft of the high-level framework for developing conformity assessment schemes for AI systems (listed here as ISO/IEC 42107) was approved with comments.

Human-machine teaming use cases. The draft technical report ISO/IEC 42109 was collecting use cases from many sectors, structured by relation type, objective, data characteristics, stakeholder considerations and trustworthiness considerations, in coordination with ISO/IEC 25589 and ISO/IEC 25880.

New projects. Human-machine teaming. A ballot on ISO/IEC 25880, requirements and guidance for organisational implementation of human-machine teaming, ran until 20 April.

Large language models. ISO/IEC 26200, a framework for evaluation, ethical use and interoperability of LLMs, was approved. It will cover testing methods, performance criteria, bias mitigation, risk management, security, sector-specific applications and regulatory alignment.

Bias in healthcare. ISO/IEC TS 26312, on how healthcare organisations should identify and address bias in AI during procurement, implementation and monitoring, was at new-project ballot. It covers algorithmic, data representation, labelling and deployment-related bias in clinician- and patient-facing applications. The newsletter noted that the healthcare sector is very active in AI standardisation.

Functional correctness. ISO/IEC 26582, on conformity assessment of the functional correctness of AI systems based on the ISO/IEC 25059 quality models, was at ballot until 29 April.

Fora

On 3 February, ANEC and the EU Fundamental Rights Agency held a webinar on FRA's report Assessing High-risk Artificial Intelligence: Fundamental Rights Risks. Based on interviews with providers, deployers and experts in education, employment, migration, law enforcement and public benefits, the report argues that a fundamental rights approach to AI is feasible and supports the trust needed for innovation and competitiveness.

Nice to know, useful to read

The issue pointed to NIST's Generative Artificial Intelligence Profile (NIST AI 600-1, July 2024) under the AI Risk Management Framework, and to a December 2025 report by the EU-funded law enforcement network CYCLOPES with standardisation recommendations based on practitioners' needs in fighting cybercrime.

It also highlighted a December 2025 guide by the Danish Institute for Human Rights and the European Center for Not-for-Profit Law on fundamental rights impact assessments under the AI Act. The guide treats the FRIA as a decision point before deployment, involving scoping, structured deliberation on the severity and likelihood of harms with affected people and rights experts, mitigation and monitoring, public transparency and thorough documentation. It stresses that FRIAs work best when embedded in an organisation-wide AI governance strategy with clear roles and resources.

My reading

The headline is easy to miss: the quality management standard, the first harmonised AI Act standard to reach public enquiry, failed its enquiry vote on both the number of national members and the weighted population criterion, with 1,288 comments. That matters for two reasons. It shows that national standards bodies were not willing to wave the first harmonised standard through, whatever the time pressure. And because the Technical Board's fast track to publication applies only after a positive enquiry, EN 18286 had to go the longer way, through reconsideration and a formal vote.

The figure on the last page deserves close reading. It confirms that EN 18286 is mapped not only to Article 17(1) but also to Articles 11(1) and 72, which is broader than a pure quality management standard. It shows prEN 18283 on bias and prEN 18285 on conformity assessment as referenced documents that do not seek presumption of conformity, with bias under Article 10 carried instead by the datasets standard. And it shows ISO/IEC 24970 on logging in the same non-presumptive role, even though the text says it may support Article 12 subject to the Commission's assessment. Readers relying on any of these standards for compliance should check which role each one is intended to play.

Finally, the new scope of prEN 18228 names fundamental rights risks explicitly and includes methods for judging whether residual risk is acceptable. That is a substantive answer, in the text of the standard itself, to the criticism that standards cannot carry fundamental rights obligations.

Which standards are meant to carry presumption of conformity

A figure accompanying the technical report maps each area of the standardisation request to the standards expected to support it. It distinguishes standards that seek to provide presumption of conformity from referenced standards that do not. The figure notes that the Annex ZA of each harmonised standard gives the detailed mapping of clauses to legal requirements, and that presumption applies only after citation in the Official Journal.

For the live status of each standard, see the Standards Explorer.

Why drafts fail: see the vote overview.

Since then (status September 2026)

Stages for the prEN drafts are drawn from public trackers and commentary as of mid-2026. Verify against the live CEN-CENELEC work programme before relying on them. No JTC 21 deliverable gives a presumption of conformity until its reference is cited in the Official Journal.