Three AI governance standards landed in one week. Here is what each one changes.

Between 14 and 16 October 2026, three standards arrived that every AI governance programme will be asked about. They do different jobs, and only one of them has a formal role under the law.

ISO/IEC 27090:2026 is guidance on security threats and compromises to AI systems. It covers the attacks conventional controls miss — data and model poisoning, evasion, membership inference, model inversion, model extraction through ordinary-looking queries, and prompt and output injection — and the mitigations: threat modelling, red teaming, logging and monitoring, supply-chain security and limiting model use. It builds on ISO/IEC 27001 and complements ISO/IEC 42001. It is not certifiable.

EN 18286:2026 is the first harmonised standard under the EU AI Act. Its reference was published in the Official Journal on 14 October 2026, so following it gives a presumption of conformity with the Article 17 quality management system requirements it covers. That presumption is narrower than it sounds: it covers the points listed in the standard's Annex ZA, not Article 17(2) to (4), and it is not a certificate. ISO/IEC 42001 overlaps with it, but ISO/IEC 42001 is not a harmonised standard.

IEEE 2863-2026 is a recommended practice for the organisational governance of AI. It sets out principles for the governing body to consider and prioritise, processes to put them into practice, and case studies on resolving tensions between principles. It is guidance, not requirements, and it is a useful frame for a board that is new to AI oversight.

In AI Gov Map, all three are now in the catalogue and mapped to the same twenty-two controls, so a control you already evidence for ISO/IEC 42001 or the EU AI Act shows where it also counts for the new standards. If your high-risk AI obligations start in December 2027, EN 18286 is the one to plan around now.

Published by NexGuide.AI · October 2026 · Not legal advice.