Standards for trustworthy AI in the European Union: technical rationale, structural challenges, and an implementation path

Standards translate legal requirements into practical engineering: The paper shows that EU AI regulations require technical standards to convert abstract legal obligations into concrete, auditable practices that companies can actually implement and regulators can verify—making compliance measurable rather than subjective.

AI systems need ongoing monitoring, not just pre-deployment checks: Unlike traditional products, AI systems behave unpredictably due to their dependence on data and stochastic (random) properties. The paper proposes that standards must require "comprehensive logging" and "assurance cases that evolve over the system lifecycle," meaning companies need to continuously monitor and document AI performance after deployment, not just certify it once.

Different sectors need different safety thresholds: The paper argues for a "layered approach" where horizontal standards set basic process requirements across all AI systems, while "sectoral profiles specify domain-specific thresholds"—meaning healthcare AI would have stricter safety standards than, say, recommendation systems, reflecting real-world risk differences.

Documentation and reproducibility are central to trustworthy AI: The framework emphasizes "structured documentation" and "reproducible technical checks" as core mechanisms for trust. This means companies must maintain detailed records of how their AI systems work and be able to demonstrate consistent performance—enabling both regulators and independent auditors to verify claims.

Standardization is challenging but necessary for fair enforcement: The paper acknowledges that AI standardization faces "unique challenges" but argues these standards remain "essential for enabling scalable conformity assessment across providers, assessors, and enforcement authorities"—preventing a fragmented system where only large companies can afford compliance.