EN 18286 is out. What would an auditor ask about your AI agents?

I work at Permit. Our VP of R&D wrote up what EN 18286:2026 means for teams shipping AI agents. We sell authorization, so read this with that bias in mind.

What the standard is

EN 18286:2026 is the first harmonised standard under the EU AI Act. It turns the Article 17 quality management system requirements for providers of high-risk AI systems into processes an auditor can check. CEN approved it on 12 July 2026, and its reference was published in the Official Journal around October 14. Following it gives you a presumption of conformity for the Article 17 requirements it covers. It's meant to sit on top of a QMS you may already have, like ISO/IEC 42001 or ISO 9001.

It doesn't mention AI agents, authorization or MCP anywhere. It also only applies to high-risk systems, and most agents won't be classified that way. I still think agent teams should read about it, because the processes it asks for (risk management, human oversight, data quality, cybersecurity) are the same things enterprise security reviews already ask about agents.

The questions it leads to

Once an agent can call tools, change data or send messages, those processes turn into pretty concrete questions:

• What is the agent allowed to do, and where is that written down?
• How do you manage risk when it acts for a user?
• Who approves the sensitive actions before they run?
• What record shows it stayed inside policy?

Why "it uses the user's token" is a weak answer

A lot of agents authenticate as the user and run with everything that user can do. If an auditor asks which actions the agent was authorized to take, the honest answer is all of them. Why was a given action allowed? Because the user could have done it. What oversight happened first? None was required.

What the post suggests instead

• Give the agent its own identity and credentials, even when it acts for a user, so the delegation is explicit.
• Run a policy check before every tool call, looking at the user, the agent, the resource, the action and the context.
• Block sensitive actions until a human approves, and store the approval with the decision.
• Log the authorization decision along with the tool output: who acted, for whom, on what, under which policy version, with what result.
• Put scope in policy. A prompt telling the agent to stay away from something can't enforce it.
• If agent A calls agent B, check and log each hop.

The post also covers where Permit fits. It says plainly that the standard doesn't prescribe any vendor, and that EN 18286 covers Article 17 only, so it won't make you AI Act compliant on its own.

Full write-up: https://www.permit.io/blog/en-18286-qms-eu-ai-act-agent-authorization?utm_source=devto&utm_medium=social&utm_campaign=en-18286&utm_content=authbyexample-article

Is anyone here getting asked about EN 18286 yet, either by a notified body or by enterprise customers?