Accuracy, robustness and cybersecurity: AI obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Sort

Reset

3 of 117 obligations match · Download these as CSV

Category: Accuracy, robustness and cybersecurity

Legal requirement Accuracy, robustness and cybersecurity European Union

Achieve appropriate accuracy, robustness and cybersecurity

EU AI Act · Article 15

High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.

Pending review Applies from 2 Dec 2027

Legal requirement Accuracy, robustness and cybersecurity New York (United States)

Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool

NYC Local Law 144 (automated employment decision tools) · NYC Administrative Code Section 20-871(a)(1); 6 RCNY Section 5-301

An automated employment decision tool may not be used to screen candidates or employees for hiring or promotion in New York City unless it has been the subject of a bias audit by an independent auditor within the year before use. The audit calculates selection rates and impact ratios by sex, race/ethnicity and their intersections, and scoring-rate comparisons for tools that score rather than select, using the employer's historical data or, where insufficient, test data as the DCWP rules allow.

Verified 26 Sep 2026 Applies from 5 Jul 2023

Legal requirement Accuracy, robustness and cybersecurity European Union

Providers of systemic-risk GPAI models must secure the model and its infrastructure

EU AI Act · Article 55(1)(d)

Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.

Verified 26 Sep 2026 Applies from 2 Aug 2025

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.