Standards, drafts, and presumption of conformity

⚡ TL;DR

A standard is a written agreement on how to do something well. An ISO standard is published — finished, internationally agreed, and ready to use; ISO 23894 is the published process guide for managing AI risk. A prEN is a draft European standard, still working its way through the system (the pr means “project,” the EN means “European Norm”). The one that matters for AI risk is prEN 18228 — the EU’s own attempt to write down, clause by clause, what Article 9 of the EU AI Act demands. The twist that trips everyone up: a draft EN gives you a real, usable, projectable process today, but it does not give you the legal shortcut called presumption of conformity — not until it is cited in the Official Journal of the European Union. So you can run prEN 18228, project your evidence onto it, and report real verdicts — while presumption is still, honestly, false.

🎯 By the end you'll be able to…

• Say what a prEN is (a draft European standard, still in the Enquiry stage) and how it differs from a published EN or ISO standard.
• Place ISO 23894 correctly: a published international process guide that tells you how to manage AI risk — and grants no presumption of conformity, because it is not a European harmonised standard.
• Place prEN 18228 correctly: a harmonised draft, the EU’s operationalisation of Article 9, with presumption = false until it is cited in the Official Journal.
• Explain presumption of conformity (Article 8): the legal shortcut where “I followed the cited standard” stands in for “I met the law” — and why only a cited harmonised standard (or a Commission common specification) grants it.
• Read the maturation arc — prEN draft → cited in the Official Journal → presumption — and avoid the common over-claim of saying a draft is “on its way to presumption.”

A standard is a written agreement; the letters tell you its status

Before the acronyms, the idea: a standard is people agreeing, in writing, on a good way to do something — so that everyone can do it the same way and check each other’s work. What changes from one standard to the next is not just what it says but how official it is, and who stands behind it. The letters in front of the number are a status code:

• ISO — International Organization for Standardization. A published ISO standard is finished: agreed by national bodies worldwide, given a year (ISO 23894:2023), and ready to cite. It is global, and it is voluntary — ISO writes good practice, never law.
• EN — European Norm. A standard adopted across the European standardisation system (CEN/CENELEC). A published EN is finished, like an ISO.
• prEN — the pr is “project”: a draft EN, not yet published. prEN 18228 is the draft, not the final EN 18228. It is real enough to read and apply, but it can still change before it is finalised.

Where a prEN sits in its life

A European standard moves through stages: drafting, then Enquiry (public consultation — anyone can comment), then a final vote, then publication as an EN. prEN 18228 is in the Enquiry stage (public consultation, around mid-2026). The text you apply today is the consultation draft; the published EN may differ. That is exactly why a draft, however good, cannot yet carry the legal weight of a finished, cited standard — the text is not frozen.

ISO 23894 — published, international, a process guide, no presumption

ISO/IEC 23894:2023 is the published international standard for the process of managing AI risk: identify → analyse → evaluate → treat → monitor. (If those words are new, read What is a risk? first.) It is the spine the froga engine implements directly, and it is excellent — but notice what it is not: it is not European law, and it is not a harmonised standard. ISO writes good engineering practice for the whole world; it has no special legal relationship with the EU AI Act.

That has a precise consequence inside the engine. froga ranks every standard by its authority — how much legal weight a citation of it carries. ISO 23894 sits at the rank for a published international standard: solid, citable, projectable. But its authority does not include presumption of conformity, because presumption is a uniquely European mechanism reserved for European harmonised standards. So a system can be fully conformant to ISO 23894’s process and still owe the regulator a separate argument that it meets the law. ISO tells you how to do the work well; it never says “and therefore you are legal.”

prEN 18228 — the EU’s Article 9, in draft, presumption = false today

prEN 18228 is different in kind. It is the European standardisation system’s deliberate effort to write down, clause by clause, what Article 9 of the EU AI Act (the risk-management requirement for high-risk AI) actually asks for. It even tabulates the mapping in its Annex ZA — clause X of the standard covers requirement Y of the law. This is the standard designed to be the operationalisation of the legal duty.

Because of that intent, the engine assigns prEN 18228 a special category — HarmonizedDraft — that sits at a different place in the authority ranking than a plain international standard. It is recognised as the harmonised candidate. But its presumption flag is false. A draft is not yet a cited harmonised standard, so following it does not yet grant the legal shortcut. The honest framing, and the one Level 2 uses:

Today, a system citing prEN 18228 gets a real, projectable process with real clause-by-clause verdicts — and presumption = false. Not “almost.” Not “on its way to presumption.” False, today.

The over-claim to avoid

It is tempting to say a draft harmonised standard is “on its way to presumption,” because everyone expects it to get there. Resist it. Expecting a future state is not being in it. Until prEN 18228 is cited in the Official Journal, presumption is false — full stop. Saying otherwise would sell a legal benefit that does not yet exist, which is exactly the kind of dishonesty this course refuses. The engine encodes this for you: it will not flip presumption to true on a draft, no matter how mature.

Presumption of conformity — the shortcut, and who actually grants it

So what is this prize that a draft cannot yet give you? Presumption of conformity is a legal shortcut written into Article 8 of the EU AI Act (and the broader New Legislative Framework). The idea, in one sentence: if you follow a harmonised standard that has been cited in the Official Journal of the European Union, you are presumed to comply with the corresponding legal requirement — the burden flips, and the regulator must show you don’t comply rather than you having to prove from scratch that you do.

The word doing all the work is cited. A standard earns presumption only once the European Commission publishes a reference to it in the Official Journal of the European Union (the OJEU; DOUE in Spanish). Inside the engine, that is a different category again — call it the cited harmonised standard — and it sits at the highest authority rank, with presumption = true. There is one other route: a Commission common specification (a fallback the Commission can issue when harmonised standards are missing or insufficient) also grants presumption. Nothing else does:

• A published ISO standard → no presumption (international, not harmonised).
• A prEN harmonised draft → no presumption (presumption = false, however good the draft).
• A harmonised standard cited in the OJEU → presumption = true.
• A Commission common specification → presumption = true.

This is why “which standard, and at what stage” is not pedantry: it is the difference between a strong engineering argument and an actual legal shortcut.

The maturation arc — and why the engine refuses to round up

Put the stages on a timeline and the rule becomes visual. A standard’s presumption status is not a slider that creeps upward as the draft improves; it is a step function that flips exactly once, at the moment of citation in the Official Journal.

flowchart LR
  ISO["ISO 23894:2023<br/>Published · International<br/>process guide<br/><b>presumption: NO</b>"]
  D["prEN 18228 (today)<br/>HarmonizedDraft · Enquiry stage<br/>operationalises Art. 9<br/><b>presumption: false</b>"]
  C["EN 18228, cited in the OJEU<br/>Harmonised · cited<br/>highest authority<br/><b>presumption: true</b>"]
  D -->|"finalised + cited in the Official Journal"| C
  ISO -.->|"never grants presumption<br/>(not a harmonised standard)"| ISO

Read it left to right. ISO 23894 sits on its own: published and useful, but it never crosses into presumption, because it is not a harmonised standard — that is why it loops back to itself with no arrow forward. prEN 18228 today is a harmonised draft: it operationalises Article 9 and the engine projects real verdicts onto it, yet presumption = false. The single arrow forward — finalised and cited in the Official Journal — is the only event that flips the flag. The instant that citation lands, the standard becomes the cited harmonised EN, jumps to the highest authority rank, and presumption becomes true. Until that arrow fires, the honest answer about prEN 18228 is “false.”

Why this matters for one signed bundle

The pay-off is the one-bundle → N-standards projection you meet in Level 2. A single signed evidence bundle is projected onto both ISO 23894 and prEN 18228 at once, with real per-clause verdicts (Covered / Attested / Partial / Gap). For each article the engine reports the highest authority that covers it and whether that authority grants presumption. With prEN 18228 in draft, that presumption column reads false today — truthfully — even while the verdicts themselves are real. The same bundle would gain presumption automatically the day EN 18228 is cited, with no re-annotation: only the flag changes, not your evidence.

Self-check

❓ What does the 'pr' in prEN 18228 mean, and why does it matter legally?

The pr means “project” — prEN 18228 is a draft European Norm, not the finished EN. It is currently in the Enquiry (public-consultation) stage, so its text is not yet frozen and can still change. That draft status is precisely why it cannot grant presumption of conformity yet: presumption is reserved for a finished harmonised standard that has been cited in the Official Journal. A draft can be applied and projected against, but it carries presumption = false.

❓ ISO 23894 is a published, internationally agreed standard. So why doesn't it grant presumption of conformity with the EU AI Act?

Because presumption is a European mechanism reserved for harmonised standards — ones written into the EU system specifically to operationalise an EU legal requirement and then cited in the Official Journal. ISO 23894 is an excellent international process guide, but it is voluntary global good practice with no special legal relationship to the AI Act. The engine ranks it as a published international standard — citable and projectable — but its authority does not include presumption. ISO tells you how to manage risk well; it never says “and therefore you are legal.”

❓ A team applies prEN 18228 today and the engine projects real verdicts onto its clauses. Is the team's system 'on its way to presumption of conformity'?

No — and saying so would be the over-claim to avoid. Today prEN 18228 is a HarmonizedDraft with presumption = false. The team gets a real, projectable process and real clause-by-clause verdicts, which is valuable — but presumption is a step function, not a slider. It flips to true at exactly one moment: when EN 18228 is cited in the Official Journal of the European Union (or if the Commission issues a common specification). Until that citation lands, the honest answer is “presumption = false, today” — not “almost” and not “on its way.”

Where to go next

You now have the standards vocabulary Level 2 runs on. See it carry a real, signed bundle — and watch the presumption column read false honestly while the verdicts stay real:

Level 2 · Student selectionThe law walks in: an admission/placement system, high-risk under Annex III §3, declaring AI Act + prEN 18228 + ISO 23894. The data-minimization gate for a minor's data closes clean GREEN, and the one-bundle → N-standards projection shows presumption = false today.

prEN 18228 — AI risk management (harmonised standard)The reference page: the product-safety paradigm, the clause catalogue the engine models, and where Venturalítica aligns with and diverges from the draft.

ISO 23894 — AI risk managementThe reference page for the published international process guide the engine implements as its spine: identify → analyse → evaluate → treat → monitor.

GlossaryEvery term, glossed: harmonised standard, presumption of conformity, Official Journal, common specification, and the rest of the regulatory vocabulary.