It can be difficult to understand how AI standard setting relates to the EU AI Act. This page aims to improve public understanding of the AI Act’s standard setting. This summary was put together by Hadrien Pouget, an AI policy expert at the Carnegie Endowment for International Peace. He hopes it will help others trying to navigate the AI Act, and is happy to respond to further questions at firstname.lastname@example.org.
“Harmonised standards” play an important role in EU legislation by making what are at times vague essential requirements into concrete technical requirements. For more information about how these standards fit into the AI Act (AIA), see the following report.
It is these standards that will specify, for example, what the “suitable risk management measures” mentioned in the AIA include. They are standards specifically designed to support EU legislation, and adhering to them carries a “presumption of conformity” with the essential requirements. Not all standards developed in the EU are harmonised standards, only those intended to support EU legislation.
Figure 3. A simplified view of the creation of harmonised standards.
2. Key Actors
1. European Commission (the Commission) – Composed of 27 Commissioners, put forward by member states and approved by the European Parliament. It acts as the executive branch of the EU.
2. The European Standards Organisations (ESOs) –
- Three organisations are responsible for all EU standard-setting: CEN, CENELEC, and ETSI. CEN and CENELEC are taking the lead in creating standards in support of the AIA, although ETSI will likely develop some relevant standards too.
- These bodies are independent of the EU institutions but can be mandated by the Commission to produce standards intended to become harmonised standards. They can also create other standards by their own initiative, but these would not necessarily gain the status of “harmonised” standards, and would not be published in the Official Journal of the EU.
- They are required to bring together different stakeholders, including those listed below.
3. National Standards Bodies (NSBs) – These are the bodies responsible for standards in each of the member states. They can represent their government, industry, and civil society.
4. European Stakeholder Organisations – These organisations represent a variety of interests within the EU, particularly those of Small and Medium-sised Enterprises (SMEs), trade unions, the environment, and consumers.
5. Harmonised Standards Consultants – These private consultants hired by the Commission (currently, the Commission has a contract with Ernst & Young to provide these consultants) ensure the standards, developed by the ESOs, are suitable for publication by the EU.
The process for developing harmonised standards is complex, bringing together elements from the ESOs typical standard-development processes and measures unique to harmonised standards. The following lays out a simplified view of this process.
- The Commission creates a standardisation request.
- The Commission develops a draft standardisation request for the ESOs, including details on scope, timelines, and the legal requirements the standards should fulfil. These legal requirements ensure the developed standards will respond directly to the essential requirements laid out in the act.
- This request is developed in consultation with ESOs and other stakeholders so that it will be acceptable to all.
- After being approved by the Commission, the request is published and ESOs must respond.
- The ESOs draft the standards.
- NSBs provide technical experts who work within a technical committee to run the drafting process. The technical committee also includes a selection of stakeholders as observers. In this case, it is a joint technical committee between CEN and CENELEC.
- The technical committee forms a “Working Group” of experts from NSBs and observers to draft the document. There is not necessarily one expert per country in the group; the committee is free to choose the composition of the group. It produces a draft based on consensus.
- As a rule, ESOs defer to international standards produced by the Organization for International Standardization (ISO) or the International Electrotechnical Commission (IEC) when they are available. This is to ensure international consistency and is an important part of the WTO’s Technical Barriers to Trade agreement, which prevents countries from using standards to block international trade.
- The NSBs are then responsible for collecting feedback from any stakeholders, and may choose to update the draft based on the feedback
- Harmonised Standards Consultants
- Consultants assess whether the standards comply with the requirements in the standardisation request and are therefore suitable for publication. The consultants can be included throughout the process, but the standards must be deemed compliant by the time they are voted on – only small changes are possible after the vote.
- Inclusion in the Official Journal of the European Union (OJEU)
- If the standards are deemed compliant, they are published in the OJEU and become harmonised standards.
- Adoption by NSBs
- NSBs are responsible for adopting the new harmonised standards into their national standards and for eliminating any conflicting standards.
Before the AI Act is officially passed, the ESOs will not officially be aiming to produce harmonised standards. Instead, they are being asked to develop “European Standards,” which will not explicitly respond to essential requirements in the AI Act. However, these are clearly being designed to serve as a basis for harmonised standards, whose development will start once the AIA is finalised.
|European Commission||European Standards Organisations|
|20th May 2022: Released first draft standardisation request in support of safe and trustworthy AI.|
|End of June 2022: Draft sent back with amendments and requests for clarification.|
5th December 2022: Published draft based on ESO and stakeholder consultation.
Published through their notification system, available here.
End of 2022 – Early 2023: Request approved by Commission and published.
Expected to make the official request, after the draft passes through internal EC approval.
Within 1 month: Accept or Deny.
Expected to accept.
Jan 2023: Work starts on general, horisontal AI standards.
These standards will largely borrow from ISO work, and are not necessarily intended to become harmonised standards.
Late 2023 – Early 2024: Begin work on harmonised standards.
Once the AI Act is finalised, work on harmonised standards can begin. May require more sector-specific approaches.
|Early 2025: Finalise standards, to be in place before AI Act is applied.|
 These are the organisations cited in Annex III of the above-cited Regulation (EU) No 1025/2012, available here. They are given EU funding and encouraged to participate in standard-setting activities.