IAPP Europe Congress 2026
Privacy | AI governance | Cybersecurity law
Brussels
16-19 November
Conference
18-19 Nov.
Training
16-17 Nov.
Workshops
17 Nov.
What an EN 18286 Assessor Will Ask You to Show for Every High-risk AI System
Thursday, 19 Nov.
09:45 - 10:45 CET
Silver Hall
Intermediate level
The EU AI Act’s Annex III high-risk obligations will apply after 2 December 2027, and EN 18286 is now cited in the Official Journal as the standard for the provider’s quality management system. This session follows a high-risk AI system from classification to assessment, covering what counts as an AI system, the two routes into high-risk and how companies become providers under Article 25 without realizing it, e.g. by building agents on vendor platforms. The speakers then compare what ISO/IEC 42001 gives you with what EN 18286 adds for each system and set out a twelve-month plan.
What you will learn:
- Why an EN 18286 assessment asks for evidence per system and what an ISO/IEC 42001 certificate does and does not supply.
- How to spot when your company is the provider, including agents your people build on vendor platforms for Annex III uses such as recruitment.
- A twelve-month plan from 2 December 2027, with what providers and deployers each need in place by when.
Sponsored by Modulos
Featured in this session

Daniel Manimbo
CIPP/US
Principal | ISO Practice Director | AI Assessment Leader
Schellman & Company, LLC

Kevin Shinners
Senior Vice-President