Reading the AI Act's harmonised standards, clause by clause.

Twenty-one briefs on the drafting of the M/613 harmonised standards and the law they run on. The first five, marked as the launch set, are the most immediately useful to anyone preparing for inspection from December 2027; the rest build the structural argument beneath them.

1. Voluntary by Design Launch set

   Every citation, every Annex ZA, every presumption of conformity this series has examined runs on a regulation from 2012 that this series has never opened. It calls harmonised standards voluntary and then builds a market that cannot function without them. A court, a rival standards body and the EU's own legislature are now testing whether that description survives contact with the market it created.
2. The Text That Came Back Launch set

   Regulation (EU) 2026/1744 was sold as a delay. Read against the consolidated version of 27 July 2026, the delay is the least interesting thing in it: the scope moved, the enforcement centralised, and the Commission started writing the compliance artefacts itself.
3. The Inspector Reads the Same Standard Launch set

   Fifteen briefs have traced how the provider writes its own exam. Article 74 is where somebody else marks it. This is the inspection, phase by phase: who arrives, what they can demand, what they will test against, and what a provider must have ready before the letter comes.
4. The Measurement Nobody Owns Launch set

   Every accuracy figure in the Act's architecture is a legal statement. Almost nothing in the architecture says how it must be measured, by whom, or with what uncertainty. The metrology of the AI Act is its emptiest room, and the harmonised standard is the only furniture it will get.
5. Conformity by Reference to Documents That Do Not Exist Launch set

   A harmonised standard cannot confer presumption of conformity by pointing at a document nobody can buy. The M/613 drafts do it repeatedly, and the machinery for catching it has a name, a checklist, and a category of failure reserved precisely for this.
6. Two Meanings of Robustness

   A word crosses from alignment research into a European standard and quietly changes what it denotes. The consequence decides which instrument carries the duty to protect a vulnerable user, and whether a fashionable research programme has anything to sell to a conformity assessor.
7. The Second Request

   The first standardisation request built the horizontal machine for high-risk systems. The evidence base for the next one is now on the table, and it points somewhere else: agents, general-purpose models, and the energy bill. What the Member States asked for, and what it reveals.
8. Representative of What?

   Everyone knows the AI Act requires representative training data. Almost everyone is wrong about what it means. The dataset standard severs representativeness from the demographic reading, and the moral question moves to a different clause with a different owner.
9. Fairness Becomes an Acceptance Criterion

   Bias mitigation is defined, in the draft standard, as a risk control measure. Follow that sentence and you arrive at the two decisions that will actually determine what non-discrimination means in European AI, both of which are made by the provider.
10. Human Oversight Is a Latency Budget

    The popular image is a person watching a screen with a red button. The standard turns oversight into an engineering derivation, and the human into a component with a measured failure rate.
11. The Loop, the Update, and the Agent

    There are three ways an AI system's behaviour can change after it is placed on the market. European law has drafted for two of them. Agents are built almost entirely out of the third.
12. The System That Changes After the Exam

    European product law assumes a product is fixed at the moment it is placed on the market. Machine learning systems are updated weekly and some of them learn continuously. The concept holding the line is substantial modification, and it is under more strain than any other in the Act.
13. The Provider Writes the Exam

    Intended purpose is declared by the provider. Every requirement in Chapter III is relative to it. Narrow the declaration and the entire compliance burden shrinks with it, lawfully, and with a complete paper trail.
14. Words That Look Alike

    Testing, verification, validation, evaluation, conformity, compliance, presumption, assessment, certification, accreditation, notification. The AI Act's machinery runs on a dozen terms that read as synonyms and are not. Confusing any two of them produces a compliance strategy with a hole in it.
15. Compliance Is a Property of Your Organisation

    For most high-risk AI systems, there is no external examiner. The conformity assessment is internal control, the audited artefact is a quality management system, and the model is barely in the room.
16. No Safety Property Is Self-Justifying

    Every essential requirement in Chapter III terminates in the same process, and none of them owns the line it is judged against. Article 9 is not one requirement among seven. It is the one that decides what the other six mean.
17. The Handoff

    Article 14 lets the provider assign oversight measures to the deployer. The standard turns the instructions for use into a formal instrument of responsibility transfer, complete with a written statement of the harm that survives compliance.
18. The Same Input, Two Regulations

    A perturbed image breaks a classifier. Whether that is a robustness failure or a cybersecurity incident depends on a fact about the world that the system cannot perceive and the evidence cannot establish: whether anyone meant it.
19. The Act's Answer to the Black Box Is Logging

    Europe was asked to solve the opacity of machine learning. It did not choose explanation. It chose traceability, and wrote the choice into an essential requirement almost nobody discusses.
20. Transparency Is a Document

    Article 13 is owed to the deployer, not to the person the system is used on. The transparency standard is, in consequence, a specification for technical writing. The right people assume it creates lives elsewhere, and no harmonised standard discharges it.
21. What the CE Mark Actually Promises

    The Regulation contains a provision titled `Compliant AI systems which present a risk'. The law has already conceded the point this series has been circling: full conformity and actual safety are different things, and it says so in a heading.

Alongside the briefs

Training on the AI Act quality management system.