What a "standard" actually is, in plain language
If you have ever looked at the CE mark on a drill, a child's toy or a heat pump, a harmonised standard is part of the reason it is there. These documents — drawn up mostly through the European standards bodies CEN, CENELEC and ETSI — describe how something should be built, tested or documented. Follow the standard, and you get a legal shortcut: national authorities presume your product complies with the relevant EU law. Ignore it and you can still comply, but you have to prove it yourself, usually with a lawyer in the room.
That is why standards are not a technical footnote. They are the plumbing of the single market, and whoever writes them quietly decides which designs are cheap to sell in Europe and which are expensive.
There is also a fairness problem that has bothered the Court of Justice of the European Union. In March 2024 the Court ruled, in a case brought by Public.Resource.Org against the Commission, that harmonised standards are part of EU law and that there is an overriding public interest in free access to them. If you must obey a rule, the logic goes, you should not have to buy it first. Ever since, the Commission has been working out how to turn that principle into something workable.
The leak: four problems, one regulation
The draft now circulating revises Regulation 1025/2012, the rulebook that governs how European standards are commissioned and recognised. According to the leaked text, it targets four long-standing complaints:
Delays. Standardisation work that takes years can leave products waiting at the border of the market, with companies unsure whether they comply.
Who gets a say. Large industrial players have historically had the loudest voice. SMEs, start-ups and open-source developers are underrepresented, even though they are the ones most affected by the outcome.
Money. National standards bodies and European organisations need stable funding to keep going.
Global influence. Europe's weight in international standard-setting has been slipping, while the same standards increasingly shape products sold worldwide.
The draft also pushes the principle of free access to harmonised standards to the centre of the framework — a direct nod to that Court of Justice ruling.
The numbers: €30 million, €295 million, and a budget line
Three figures from the draft are worth holding on to, because they are the kind of numbers that get argued about in the European Parliament.
Faster harmonisation and fewer delays are estimated to save businesses around €295 million a year in compliance costs. Removing the paywalls on harmonised standards is estimated to save businesses another €30 million a year directly — money that currently goes on buying the rulebook. And the Commission has pencilled in €165.998 million of EU budget spending across the 2028–2034 programming period to modernise how standards are commissioned and managed.
Seen from a small workshop, €30 million spread across the whole single market is not dramatic on its own. Seen from a standards committee, it signals something bigger: free access is being treated as infrastructure, not as an optional courtesy.
Why "open source" in the draft is the real shift
Open-source involvement in standardisation has been discussed for years, mostly in non-binding policy papers. The difference now is that the leaked text moves it into the regulation itself, with language about integrating open-source processes and communities — and, notably, reference implementations — into how European standards are built.
The reasoning is practical. If a standard is written around a proprietary technology stack, everyone who wants to comply has to license that stack. If a standard can be demonstrated with open code that anyone can inspect, test and reuse, the barrier drops. This lines up with the broader shift in European AI policy, where the emphasis has moved away from large grant-funded flagship models and towards open-weight adoption, domain-specific tools and deployment in European sovereign cloud infrastructure. The Commission's own open-source observatory has argued for years that public money should produce publicly reusable code.
The AI Act is the reason the timing matters
Since 2 August 2026, the transparency obligations in Article 50 of the EU AI Act are legally binding, with direct enforcement powers held by the Commission and the European AI Office. That is a significant change: the era of voluntary preparation and self-regulatory codes is over.
But enforcement through standards only works if the standards exist. Many of the technical documents that AI providers will lean on to demonstrate compliance are still being drafted. So the question of who sits in those drafting rooms — and whether the outcome is readable by a three-person start-up in Brno or only by a legal department in Munich — is no longer abstract. It is the difference between a rule that companies can follow and one they can only afford to be advised on.
What to watch on 6 October
It is worth being clear about what this is: a leaked draft, not law. The Commission's target date for presenting the Standardisation Act proposal is 6 October 2026, alongside the European Product Act. After that comes the ordinary legislative process — Parliament, Council, amendments, probably two years of negotiation, and a budget that only starts in 2028. Nobody's compliance paperwork changes this autumn.
Still, the direction of travel is now visible in legislative language rather than in a communication. Open source is being written into the machinery of European standard-setting, and free access to harmonised standards is being treated as a rule rather than a favour. For the many small European businesses that make up roughly 99% of companies in the EU, that is the part worth following.
Will I be able to download harmonised standards for free?
That is the aim of the draft, and it follows a 2024 Court of Justice ruling that harmonised standards form part of EU law. What is still unresolved is the detail: whether free access means reading on a national standards body's website, full reuse rights, or something in between. Those details will be argued over during the legislative process, so no change applies today.
Does this change anything for AI companies specifically?
Indirectly, yes. The AI Act relies on harmonised standards to give providers a clear route to demonstrating compliance, and many of those standards are still being written. If the new rules give open-source developers and smaller companies a stronger role in drafting them, the technical requirements that AI providers ultimately face could look rather different — and potentially be cheaper to demonstrate.
I run a company outside the EU. Does it matter to me?
Often it does. European standards are frequently adopted or mirrored internationally, and any product sold into the single market has to meet the same requirements regardless of where it was made. If the cost of reading and applying those standards falls, exporters outside Europe benefit from the same reduction as European ones.
