Standards · Artificial intelligence

ETSI EN 304 223 Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems

PublishedFree · December 2025

Summary

This ETSI European Standard sets baseline cybersecurity requirements for artificial intelligence models and systems, including those based on deep neural networks such as generative AI. It organises thirteen principles into five lifecycle phases: secure design, development, deployment, maintenance and end of life. The principles range from awareness of AI-specific threats, such as data poisoning and indirect prompt injection, to protecting assets, infrastructure and the supply chain, documenting data, models and prompts, testing, security updates, monitoring system behaviour and securely disposing of data and models. For each principle it states who is responsible among developers, system operators and data custodians, with attention to protecting end users. The ETSI TS 104 216 specification describes how to assess conformity with it.

Reference

ETSI EN 304 223

Official title

Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems

Body

ETSI – Technical committee: ETSI TC SAI

Type

Standard

Status

Published

Published

December 2025

Edition

V2.1.1

Access to the text

Free

Sectors

• Artificial intelligence
• Supply chain

Notes

Adopted on 8 December 2025 (version V2.1.1) at the end of the approval procedure with national standards bodies, it takes over the technical specification ETSI TS 104 223 of April 2025; national bodies had to adopt it by 30 September 2026. The developer and system operator roles can correspond to the provider and deployer roles of the AI Act, but the standard was not drawn up at the Commission’s request and is not a harmonised standard under the regulation. The PDF is free on the ETSI website.

Last verified

29 October 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)