The era of voluntary “Ethics AI” is over
On October 30, 2025, something monumental happened in the world of AI regulation—and almost nobody noticed. With little fanfare, theEuropean Committee for Standardization (CEN) released prEN 18286, setting a newbar for what “AI governance” will mean in the real world for years to come.
For too long, AI governance has relied on toothless ethics boards and high-minded principles—ideas that looked good on paper but could beignored in practice. prEN 18286 is the line in the sand. It’s not an aspirational framework or another “best practice” guide. This is the official playbook: if your quality management system matches this standard, the regulators will presume your AI system is compliant with Article 17 of the EUAI Act; if it doesn’t, you’ll have to prove your compliance.
Why is this such a big deal? Because, starting soon, this standard makes governance evidence-based and enforceable. The days of ethics-washing are officially over. Auditable processes, design controls, real accountability, defensible risk management—these will be the hard requirements for gaining and keeping access to the European market.
While the EU has made it clear that prEN 18286 is being custom-built as the compliant path for the AI Act, the draft standard includes notes intended to help users who have already implemented ISO/IEC 42001, as well as Annexes that map the structure to both ISO/IEC 42001 and ISO 9001. So getting a head start with ISO/IEC 42001 still has an advantage.
The business implications are profound and urgent. By late 2026, prEN 18286 will set in stone what AI documentation, incident response,lifecycle risk management, and regulator communications must look like. Early movers who operationalise the standard now will hold a decisive advantage when enforcement kicks in; those scrambling late will be playing catch-up, under regulatory pressure.
And this is not just Europe’s problem. Thanks to the extraterritorial scope of the AI Act, US SaaS firms, global platforms, manufacturers, and anyone touching European data or markets are on the hook,too. Like GDPR, prEN 18286 is about to become the global watermark for credibleAI governance.
The bottom line: The era of voluntary “Ethics AI” is over. The era of documented, auditable, verifiable governance—of AI compliance as amarket requirement—has begun. This reflects Europe’s distinct vision of governance as legal infrastructure, not philosophy.
Anna Felländer, co-founder Asenion, President Asenion Europe
