{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","id":"AIPT-OBL-0012","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0012","title":"Achieve appropriate accuracy, robustness and cybersecurity","short_title":"Accuracy, robustness and cybersecurity","category":"accuracy_robustness_security","summary":"High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.\n","practical_action":"Include AI-specific threat modelling and adversarial testing in your security programme.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 15","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["biometrics","finance_and_credit","safety_critical"],"applicability":[{"description":"Providers of high-risk AI systems.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Accuracy metrics and test evidence","description":null,"artifact_type":"report"},{"title":"AI security assessment","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on AI system verification and validation","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Clause 8 and Annex A security controls","note":"Original editorial mapping for cybersecurity aspects.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.5, 2.6, 2.7","note":"Validity, safety, security and resilience measurement.","confidence_level":"high","is_original":true}],"controls":[{"slug":"genai-red-team-testing","title":"Adversarial and red-team testing for generative AI","kind":"technical","relationship":"supports","note":"Adversarial exercises cover poisoning, evasion and extraction attempts.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/genai-red-team-testing"},{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"satisfies","note":"Declared accuracy metrics, robustness and AI-specific security testing come from the release test programme.","confidence_level":"high","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Consistent performance over the lifecycle is confirmed in operation.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}