Accuracy, robustness and cybersecurity: AI obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Sort

Reset

2 of 117 obligations match · Download these as CSV

Legal requirement Accuracy, robustness and cybersecurity European Union

Achieve appropriate accuracy, robustness and cybersecurity

EU AI Act · Article 15

High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.

Pending review Applies from 2 Dec 2027

Legal requirement Accuracy, robustness and cybersecurity European Union

Providers of systemic-risk GPAI models must secure the model and its infrastructure

EU AI Act · Article 55(1)(d)

Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.

Verified 26 Sep 2026 Applies from 2 Aug 2025

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.