August 2, 2026 was a deadline. Under the EU AI Act, the general-purpose AI provisions and the prohibited AI practices framework became fully enforceable. For quality managers in aerospace and automotive, this is one of five active regulatory tracks that require monitoring and action in Q4 2026. The others: EASA cybersecurity regulation 2023/203 and its November 2025 amendment, EU Battery Regulation 2023/1542 enforcement now in active phase, IA9100 publication expected September-October 2026, and REACH Regulation amendments with Q2 2026 substance additions directly affecting aerospace materials. Each of these creates a specific compliance obligation for quality management systems. None of them are isolated.
The pattern is recognizable to anyone who has tracked regulatory development across multiple frameworks: individual regulations that appear to address separate domains — AI safety, aviation cybersecurity, battery sustainability, product quality standards, chemical restrictions — are converging toward a common set of organizational requirements. Documented risk management. Supply chain traceability. Incident reporting. Change notification. Audit-ready documentation. These are quality management requirements, regardless of which regulation generates them.
1. EU AI Act — August 2, 2026: Quality Management System Requirements for High-Risk AI
The EU AI Act’s Article 17 requires providers of high-risk AI systems to establish a documented quality management system. Compliance Week’s January 2026 analysis identified this as a landmark step: „The first EU standard to drive conformity and facilitate enforcement of the EU AI Act has been published in draft.“ The standard — prEN 18286:2025, drafted by CEN and CENELEC — specifies QMS requirements that directly parallel ISO 9001 and sector standards: design and development controls, supplier management, post-market monitoring, incident reporting, and documentation discipline. The CMS Law December 2025 analysis of prEN 18286 was specific: „The requirements can be built into existing sector quality systems such as medical devices or automotive rather than creating a new standalone QMS, provided those systems are updated to incorporate all of this standard’s controls.“
For aerospace and automotive quality managers, the practical question is not whether your organization uses AI — it is whether any AI system in your supply chain or production environment qualifies as high-risk under the Act’s Annex III categories. Annex III includes AI used in safety components of products covered by harmonized EU legislation — which explicitly includes machinery, aviation, automotive, and defense product categories. If your suppliers use AI in quality inspection, predictive maintenance, or process control, those systems may qualify.
2. EASA Cybersecurity — 2022/1645 and 2023/203: Now Fully Active
The EASA cybersecurity framework — Regulation 2022/1645 (Part IS IA) and Regulation 2023/203 (Part IS CA) — is the aerospace-sector implementation of aviation cybersecurity requirements. The November 2025 amendment to 2023/203 extended Information Security Management System (ISMS) requirements to organizations operating under declaration rather than formal approval — bringing a broader range of maintenance organizations, aerodrome operators, and design organizations within scope. The sassofia.com May 2026 regulatory update confirmed: this amendment „harmonizes information security protocols across the entire aviation value chain“ by amending multiple foundational regulations including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014.
For Part 145 maintenance organizations and Part 21 production approval holders: an ISMS is not optional. The IA9100 cybersecurity integration requirement — one of six named areas in the IAQG Key Change Summary — aligns with the EASA framework. Building an ISMS that satisfies both EASA 2023/203 and IA9100’s Clause 8.1 cybersecurity requirement produces a single integrated system rather than two parallel compliance programmes.
3. REACH 2026 — Active Substance Additions Affecting Aerospace Materials
REACH Regulation 1907/2006 received amendment 2026/0859 in Q2 2026 — the addition of 2,4-Dinitrotoluol to the substances of very high concern list. Your Excel-based regulatory monitoring records this as requiring notification to procurement and design teams to prevent use in new designs. The pattern of REACH additions continues: authorization list updates, SVHC candidate list additions, and restriction proposals under evaluation for substances used in aerospace adhesives, coatings, and composite processing materials. For quality managers, REACH compliance is an approved material list maintenance issue — every SVHC addition potentially affects existing process approvals and requires systematic review of current material specifications.
4. EU Battery Regulation 2023/1542 — Enforcement Phase Active
The carbon footprint declaration requirement for industrial batteries above 2 kWh has been active since February 18, 2026. The Digital Battery Passport becomes mandatory February 18, 2027. For aerospace and automotive quality managers, this regulation matters beyond direct battery manufacturing: any product containing industrial batteries above 2 kWh capacity — ground support equipment, avionics test benches, hybrid powertrain components, manufacturing facility energy storage — is in scope. The nine-month window before the DBP deadline is the implementation window that remains.
5. IA9100 — Publication This Quarter
ISO 9001:2026 is expected September-October 2026. IA9100 follows in alignment. The six named change areas are confirmed and stable in the IAQG Key Change Summary. Gap analysis conducted now — before the final text publishes — will be accurate to within 90-95% of final requirements. Organizations that wait for the published text are starting their preparation 3-6 months later than those who started from the Key Change Summary.
3 Concrete Actions
1. Build a cross-regulatory compliance matrix for your quality management system. Map each active regulation — EU AI Act, EASA 2023/203, REACH, EU Battery Regulation, IA9100 — against your existing QMS processes. Where the same process (supplier evaluation, change notification, incident reporting, document control) appears in multiple regulatory frameworks, you have an opportunity to build a single integrated process that satisfies all of them simultaneously. This is more efficient than building separate compliance programmes for each regulation.
2. Add regulatory monitoring to your standard supplier audit agenda. For each critical supplier, the Q4 audit should verify: ISMS status consistent with EASA 2023/203 for aviation suppliers, AI Act high-risk system inventory for suppliers using AI in quality-critical processes, REACH SVHC status for all materials on approved material lists, and EU Battery Regulation carbon footprint declaration status for battery-containing products. These are not separate compliance checks — they are standard supplier qualification verification against current regulatory requirements.
3. Contact your certification body this quarter about IA9100 transition planning. Request their specific transition audit timeline, early adoption options, and whether combined surveillance/transition audits are available for your certification cycle. The organizations that engage their certification bodies in Q4 2026 will have better transition planning visibility than those who wait for 2027.
👉 Request a Technical Consultation → www.skqc.org
Sources
- Compliance Week — First Standard for EU AI Act Targets Quality Management Regime (January 7, 2026), complianceweek.com
- CMS Law — prEN 18286: What the First Draft AI Act Standard Signals for Quality Management (December 12, 2025), cms.law
- VDE — EU AI Act: Quality Management System Requirements (April 10, 2026), vde.com
- sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
- European Parliament and Council — Regulation (EU) 2023/203 Part IS CA, as amended November 2025, eur-lex.europa.eu
- European Parliament and Council — Regulation (EU) 2022/1645 Part IS IA, eur-lex.europa.eu
- European Parliament and Council — Regulation (EU) 2023/1542 on Batteries and Waste Batteries, eur-lex.europa.eu
- IAQG — IA9100 Key Change Summary (November 2023), iaqg.org
- REACH Regulation (EU) 2026/0859 — Amendment adding 2,4-Dinitrotoluol, eur-lex.europa.eu
#RegulatoryCompliance #QualityManagement #EUAIAct #EASA #REACH #EUBatteryRegulation #IA9100 #AerospaceQuality #SKQC