Edition 9 (June 2025): the essence

About this issue

The newsletter is published on the JTC 21 website, the JTC 21 LinkedIn group and the ETUC website, with ETUC providing the secretariat. This issue opens with a reminder that all ongoing standardisation projects are confidential. Readers who want details on a specific standard should contact their national standards body, and every European standard goes through a public enquiry before final adoption.

News from the European Union

A standardisation request on a trusted data framework. The Commission was preparing a request to CEN and CENELEC for a trusted European data framework. It is expected to cover trusted data transactions, implementation of data catalogues, an implementation framework for semantic assets, quality assessment of internal data governance processes, and maturity assessment of common European data spaces. The request is separate from the AI request handled by JTC 21, but there are clear overlaps and potential synergies. Civil society representatives hoped inclusiveness would be written into it as a core requirement.

Consultations and reports. In May 2025 the Commission consulted on the use of data for developing AI, on simplifying data rules and on international data flows, as input to its forthcoming Data Union Strategy. A report by the Centre for European Policy Studies (CEPS) for the AI Office analysed stakeholder feedback from the consultations on the AI system definition and prohibited practices. In April, the Commission had run a targeted consultation to inform guidelines clarifying the key concepts in the AI Act's provisions on general-purpose AI models. The AI Office also announced a call for tenders for technical assistance in monitoring compliance, focused on assessing risks from general-purpose AI models at Union level.

A new strategic advisory group. In May 2025, CEN and CENELEC set up a Strategic Advisory Group on standardisation topics linked to EU legislation. It will identify cross-cutting requirements where CEN and CENELEC can provide strategic input and recommend how to address them more systematically, to make the system more flexible and responsive. AI is one of many areas it may cover.

CEN-CENELEC JTC 21: the Stavanger plenary

JTC 21 held its 11th plenary in Stavanger, Norway, on 12–15 May 2025, in hybrid format, with more than 160 participants. Alongside national standards bodies, it was attended by observers from Canada and Japan, the CEN-CENELEC Management Centre, professional and civil society organisations, and the Commission, which again stressed the urgency of delivering the standards on time.

Published documents. The plenary reviewed the eleven AI documents CEN and CENELEC had published so far, most of them adoptions of ISO/IEC work: CEN/CLC/TR 17894:2024 on conformity assessment; EN ISO/IEC 22989:2023 on concepts and terminology; EN ISO/IEC 23053:2023 on the framework for machine learning systems; CEN/CLC/TR 18115:2024 on data governance and quality in the European context; CEN/CLC/TR 18145:2025 on environmentally sustainable AI; CEN/CLC ISO/IEC/TS 12791 on unwanted bias in classification and regression; EN ISO/IEC 25059:2024, the quality model for AI systems; EN ISO/IEC 23894:2024 on risk management guidance; CEN/CLC ISO/IEC/TR 24027:2023 on bias in AI systems and AI-aided decision making; CEN/CLC ISO/IEC/TR 24029-1:2023 on robustness of neural networks; and EN ISO/IEC 8183:2024 on the data life cycle framework.

In addition, parts 1 to 4 of ISO/IEC 5259 on data quality for analytics and machine learning had received positive votes and were expected to be published shortly as European standards.

WG1 (strategic advisory) updated the "architecture of standards" document describing the response to the Commission's request, with proposals for consistency across working groups on terminology, testing methods, interplay matrices and high-level requirements. It was also preparing a cross-cutting introductory document for future users of the harmonised standards, drawing on that architecture, stakeholder terminology and the introductory clauses of each standard. A survey of JTC 21 participants collected data on country, gender, represented interest and prior experience, with results due in June. WG1 discussed cooperation with ISO on ISO/IEC TS 22443 (societal concerns and ethical considerations). It was also agreed to ballot the direct adoption of ISO/IEC 42001 as a European standard.

WG2 (operational aspects) reported good progress on the quality management system and risk management standards, whose committee drafts had both gone to ballot. Work was now concentrating on the interplay between standards and on the risk catalogue. The AI conformity assessment framework was expected to go to ballot by September 2025.

WG3 (engineering aspects) had several committee draft ballots under way or planned: logging (in progress), natural language processing (June/July 2025), datasets and bias (August 2025), with a working draft on computer vision expected in September 2025. A committee draft of the taxonomy of AI system methods and capabilities, developed in parallel under ISO lead, was expected in November 2025. The plenary also decided to start parallel development, under ISO lead, of ISO/IEC 22440 on functional safety and AI systems.

WG4 (foundational and societal aspects) had published the technical report on environmentally sustainable AI earlier in the year. The AI trustworthiness framework, a key deliverable under the request, was at committee draft stage, and WG4 was to decide by the end of June whether to split it into several parts, given the different pace of progress on its topics. Work items had been approved on impact assessment in the context of EU fundamental rights and on competence requirements for AI ethics professionals, the latter probably in cooperation with CEN-CENELEC TC 428 on ICT professionalism. Preliminary work items covered environmental impact metrics, upskilling on AI ethics, tools for handling ethical issues, and risk management in critical digital infrastructure. A possible new project on AI-intervention labelling, a label indicating that an application is AI-based, was under consideration.

WG5 (cybersecurity) was in full comment resolution on cybersecurity specifications for AI systems, with public enquiry expected in July 2025. Because cybersecurity cuts across all the standards, WG5 held regular coordination meetings with the other working groups and worked with ETSI's Securing Artificial Intelligence committee (including its baseline cybersecurity requirements for AI models and systems) and with CEN-CENELEC JTC 13.

Liaisons and partners. The number of external organisations involved with JTC 21 was growing. At the plenary, the partner organisations ANEC, ETUC and Small Business Standards reported on their work, as did the liaison organisations 5Rights Foundation and NoLeFa, the Commission-designated pilot preparing a future Union testing facility to support market surveillance under the AI Act. OWASP and the Big Data Value Association had sent reports that were not presented.

ISO/IEC JTC 1/SC 42

Since the New Delhi plenary covered in the previous issue, several SC 42 documents had moved forward. ISO/IEC 42005 on AI system impact assessment was published in May 2025. ISO/IEC 42006 on requirements for certification bodies was approved, with publication expected shortly. ISO/IEC 12792 (transparency taxonomy) was at final ballot after comment resolution. The draft technical specification ISO/IEC 6254 on explainability and interpretability was approved with comments, and the draft technical report ISO/IEC 20226 on environmental sustainability was approved for publication with corrections. The amendments to ISO/IEC 22989 and ISO/IEC 23053 on generative AI were in final review, with final ballot expected shortly.

The committee draft consultation on ISO/IEC TS 22443 had closed, with cooperation with JTC 21 under consideration. Comments on ISO/IEC 42105 (human oversight) were being resolved in meetings planned for June and July, and ISO/IEC TR 42106 on differentiated benchmarking was ready for final ballot. Two new projects were formally approved: a machine learning model description framework (ISO/IEC 25623) and SME-oriented implementation guidance for ISO/IEC 42001 (ISO/IEC 25651).

Fora

Following the 4 February webinar, the UK AI Standards Hub and Task Group Inclusiveness held an invitation-only online workshop on 22 April. International civil society participants heard the project editors of the European risk management standard present its structure and were able to give their views.

On 9 April, ANEC held a webinar on how AI standards can address risks to fundamental rights, looking at how the AI Act's risk-based approach relies on harmonised standards. Speakers from the EU Fundamental Rights Agency and ANEC discussed how to translate principles such as privacy and non-discrimination into technical requirements, and stressed the need for continuous risk assessment and for standards flexible enough to keep pace with AI.

The CEN-CENELEC Management Centre scheduled an online "harmonisation bootcamp" for JTC 21 experts on 19 June 2025, covering the vademecum on European standardisation, drafting principles, normative references in harmonised standards, Annex ZA, and the common checklist.

Nice to know, useful to read

The JTC 21 website now includes a learning centre with links, webinars and training on standardisation. The ETUC Standardisation Committee marked ten years of work since 2015 to strengthen trade union participation in standardisation. Under its STAND project, ETUC published the handbook Standards at the Workplace and a video on trade unions and standardisation.

ANEC's AI Taskforce, funded by the European AI & Society Fund, was set up in early February with nine consumer professionals from eight countries (Austria, Bulgaria, Cyprus, Germany, Greece, Italy, the Netherlands and Spain). It provides training so that members can take part in national mirror committees of JTC 21, and its members will join ANEC's AI experts in drafting comments on AI standards for use at national level.

The Nordic standards bodies, Danish Standards, SIS (Sweden), Standard Norge, SFS (Finland) and Staðlaráð Íslands, produced a two-hour webinar, Decoding the AI Act: European Standards and the Future of AI Regulation, with a shorter PDF presentation. Speakers were Tatjana Evas (European Commission) on the status and timeline of the Act; Jesper Løffler Nielsen (Fokus Advokater) on the surrounding legal landscape; Ana Paula Gonzalez Torres (Aalto University and the Finnish Standards Association) on AI standards; Anders Kofod-Petersen (OptikosPrime and NTNU) on the SME perspective; and Luis Martinez (ASSA ABLOY) on compliance from a product perspective.

My reading

Stavanger captured the pipeline at its most optimistic. The plan was a cascade of ballots over summer and autumn 2025: logging under way, natural language processing in June or July, datasets and bias in August, conformity assessment in September, and cybersecurity at public enquiry in July. Very little of that timetable held. By October 2025, CEN-CENELEC needed exceptional measures, and the quality management standard became the first to reach public enquiry only at the end of that month.

Two decisions deserve a note. WG4's pending choice on whether to split the trustworthiness framework explains the multi-part prEN 18229 series that exists today. And the decision to ballot ISO/IEC 42001 for adoption as a European standard, while a separate quality management standard was being written for the AI Act, means Europe will have two management system standards with different legal roles: one as a general AI management system, the other as the route to Article 17 compliance. Users will need to be clear about which one carries which function.

The harmonisation bootcamp is also worth noticing. Its agenda (drafting principles, normative references, Annex ZA, the common checklist) lists the formal hurdles a standard must clear before the Commission will cite it. Those hurdles, more than technical content, are often what decides whether a standard gives presumption of conformity.

For the live status of each standard, see the Standards Explorer.

Since then (status September 2026)

Stages for the prEN drafts are drawn from public trackers and commentary as of mid-2026. Verify against the live CEN-CENELEC work programme before relying on them. No JTC 21 deliverable gives a presumption of conformity until its reference is cited in the Official Journal.

Correction, 15 September 2026: an earlier version of this table described prEN 18229 as a three-part series. It has been updated to reflect the current five-part structure.