Law / Frameworks / ETSI EN 304 223
ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems
Below are its 72 provisions in the framework's own order, and under each one the laws we track that bear on it. Each mapping is our reading that a law bears on a provision, never a finding that running the provision meets the law.
Where the law lands in the framework
20of 72 provisions have law436laws166jurisdictions
Of these laws, 359 are in force, 60 not yet in force, 1 blocked by a court, and 16 proposed and not law.
25 of the 31 provisions under 5.2 have no law we track under them.
- in force
- not yet in force
- blocked by a court
- proposed
- no law we track
Read through the kinds of duty each AI, scraping and news aggregation law we track carries, counting a kind of duty only where the law's own requirement lines, as read against the NIST AI Risk Management Framework, bear it out.
5.1
9 of 26 provisions with lawDesign stage, covering principles 1 to 4: awareness, design choices, threat analysis and human oversight.
| Provision | What it says | Laws, by state | Laws | Jurisdictions | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| 5.1.1Staff training and awareness on security threats particular to AI. | |||||||
| 5.1.1-1 | AI security content in the regular staff training programme, kept current. no law we track | no law we track | |||||
| 5.1.1-1.1 | That training is adjusted to each person's role. no law we track | no law we track | |||||
| 5.1.1-2 | All staff kept aware of current AI-related threats and the mitigations that exist. no law we track | no law we track | |||||
| 5.1.1-2.1 | Threat updates circulated through several internal channels. no law we track | no law we track | |||||
| 5.1.1-2.2 | Developers trained in secure coding and system design for AI work. no law we track | no law we track | |||||
| 5.1.2Building security into how an AI system is designed, next to its performance goals. | |||||||
| 5.1.2-1 | Business need and security risks written down and assessed before deciding to build an AI system. 156 laws, 17 not yet in force, 1 blocked, 8 proposed | 156 | 94 | 17 | 1 | 8 | |
| 5.1.2-1.1 | Data custodians inside the developer's own organisation join the requirements discussion. no law we track | no law we track | |||||
| 5.1.2-2 | System built to hold up against adversarial attacks, unexpected inputs and failures. 3 laws, 1 not yet in force | 3 | 2 | 1 | 0 | 0 | |
| 5.1.2-3 | Audit trail covering models, datasets and prompts through their lifecycle. no law we track | no law we track | |||||
| 5.1.2-4 | Security risk assessment and due diligence before using an external component. no law we track | no law we track | |||||
| 5.1.2-5 | Data custodians check that the intended use suits how sensitive the training data is. no law we track | no law we track | |||||
| 5.1.2-5.1 | Staff encouraged to raise AI security concerns, with safeguards in place for doing so. no law we track | no law we track | |||||
| 5.1.2-6 | Access the AI system gets to other systems and data sources is minimal and risk assessed. 145 laws, 3 not yet in force | 145 | 107 | 3 | 0 | 0 | |
| 5.1.2-7 | Due diligence on external providers, including whether they follow this standard. 2 laws, 1 not yet in force | 2 | 2 | 1 | 0 | 0 | |
| 5.1.3Threat modelling and risk handling for AI systems, including attacks specific to AI. | |||||||
| 5.1.3-1 | Threat modelling and risk management, reviewed regularly and covering AI-specific attacks. 16 laws, 3 not yet in force, 5 proposed | 16 | 11 | 3 | 0 | 5 | |
| 5.1.3-1.1 | Threat modelling repeated whenever a setting or configuration option is added or changed. no law we track | no law we track | |||||
| 5.1.3-1.2 | Developers manage the risk from model capabilities the system does not need. no law we track | no law we track | |||||
| 5.1.3-1.3 | Operators apply controls to the risks found, weighed against cost and their risk tolerance. no law we track | no law we track | |||||
| 5.1.3-2 | Threats developers cannot resolve are passed to operators and on to end-users. 70 laws, 16 not yet in force, 12 proposed | 70 | 44 | 16 | 0 | 12 | |
| 5.1.3-3 | Operators seek assurance from outside parties who hold responsibility for identified risks. no law we track | no law we track | |||||
| 5.1.3-4 | Continuous monitoring and review of infrastructure against the organisation's risk appetite. no law we track | no law we track | |||||
| 5.1.4Keeping people able to oversee an AI system and answer for what it produces. | |||||||
| 5.1.4-1 | Capability for human oversight designed in and maintained. 78 laws, 27 not yet in force, 1 proposed | 78 | 37 | 27 | 0 | 1 | |
| 5.1.4-2 | Systems designed so people can judge the outputs they answer for. no law we track | no law we track | |||||
| 5.1.4-3 | Where oversight is a risk control, the technical measures behind it are built, verified and maintained. 5 laws, 2 not yet in force | 5 | 3 | 2 | 0 | 0 | |
| 5.1.4-4 | Developers verify that the data custodian's security controls made it into the build. no law we track | no law we track | |||||
| 5.1.4-5 | End-users told which uses of the system are prohibited. 143 laws, 15 not yet in force, 1 blocked, 3 proposed | 143 | 86 | 15 | 1 | 3 | |
5.2
6 of 31 provisions with lawBuild stage, covering principles 5 to 9: assets, infrastructure, supply chain, records and testing.
| Provision | What it says | Laws, by state | Laws | Jurisdictions | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| 5.2.1Inventory, tracking and protection of the assets an AI system depends on. | |||||||
| 5.2.1-1 | Full inventory of assets, including their dependencies and connections. 78 laws, 27 not yet in force, 1 proposed | 78 | 37 | 27 | 0 | 1 | |
| 5.2.1-2 | Tooling and processes to track, authenticate, version and secure AI assets. no law we track | no law we track | |||||
| 5.2.1-3 | Disaster recovery plans adapted to attacks aimed at AI systems. no law we track | no law we track | |||||
| 5.2.1-3.1 | A known good state can be restored. no law we track | no law we track | |||||
| 5.2.1-4 | Sensitive data such as training and test sets protected from unauthorised access. 3 laws, 1 not yet in force | 3 | 2 | 1 | 0 | 0 | |
| 5.2.1-4.1 | Checks and sanitisation applied to data and inputs, and repeated when the model is revised. no law we track | no law we track | |||||
| 5.2.1-4.2 | Proportionate protection where training data or model weights may be confidential. no law we track | no law we track | |||||
| 5.2.2Protecting the infrastructure around models, data and processing pipelines. | |||||||
| 5.2.2-1 | Access-control review, and measures to secure APIs, models, data and pipelines. no law we track | no law we track | |||||
| 5.2.2-2 | Controls, such as rate limits, on any API offered to outside parties. no law we track | no law we track | |||||
| 5.2.2-3 | Separate environments for development and tuning, with least privilege enforced technically. no law we track | no law we track | |||||
| 5.2.2-4 | A published, easy-to-find vulnerability disclosure policy. no law we track | no law we track | |||||
| 5.2.2-5 | AI-specific incident management and recovery plans that are created, tested and maintained. 27 laws, 7 not yet in force, 1 proposed | 27 | 16 | 7 | 0 | 1 | |
| 5.2.2-6 | Contracts with cloud providers that back the requirements above. 2 laws, 1 not yet in force | 2 | 2 | 1 | 0 | 0 | |
| 5.2.3Supply-chain security for the models and components that go into an AI system. | |||||||
| 5.2.3-1 | Secure software supply-chain practice for developing models and systems. no law we track | no law we track | |||||
| 5.2.3-2 | Written justification when using models or components that are poorly documented or secured. no law we track | no law we track | |||||
| 5.2.3-2.1 | Mitigating controls and a risk assessment for those components. no law we track | no law we track | |||||
| 5.2.3-2.2 | That justification shared with end-users in an accessible way. no law we track | no law we track | |||||
| 5.2.3-3 | Evaluations run again on released models before they are adopted. no law we track | no law we track | |||||
| 5.2.3-4 | End-users told before a model is updated. no law we track | no law we track | |||||
| 5.2.4Written records about training data, models and prompts. | |||||||
| 5.2.4-1 | Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream. 78 laws, 27 not yet in force, 1 proposed | 78 | 37 | 27 | 0 | 1 | |
| 5.2.4-1.1 | That documentation records security-relevant facts such as data sources, scope, guardrails and failure modes. no law we track | no law we track | |||||
| 5.2.4-1.2 | Cryptographic hashes published for model components handed to others. no law we track | no law we track | |||||
| 5.2.4-2 | Records of how publicly sourced training data was obtained, where it came from and how it is used, because of poisoning risk. no law we track | no law we track | |||||
| 5.2.4-2.1 | Minimum record for training data: its source, such as a page URL, and when it was collected. 18 laws, 1 not yet in force | 18 | 16 | 1 | 0 | 0 | |
| 5.2.4-3 | Audit log of changes to system prompts and other configuration that alter behaviour. no law we track | no law we track | |||||
| 5.2.5Security testing and evaluation around release. | |||||||
| 5.2.5-1 | Every model, application and system is security-assessed before release. no law we track | no law we track | |||||
| 5.2.5-2 | Operators test before deployment, with developer support. no law we track | no law we track | |||||
| 5.2.5-2.1 | Independent testers with relevant AI skills used for security testing. no law we track | no law we track | |||||
| 5.2.5-3 | Developers pass their test findings to operators. no law we track | no law we track | |||||
| 5.2.5-4 | Outputs evaluated so that non-public details of the model or its training data cannot be reverse engineered. no law we track | no law we track | |||||
| 5.2.5-4.1 | Outputs evaluated so users cannot gain unintended influence over the system. no law we track | no law we track | |||||
5.3
3 of 5 provisions with lawRelease stage, holding only principle 10: what users and affected parties are told.
| Provision | What it says | Laws, by state | Laws | Jurisdictions | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| 5.3.1What developers and operators tell users and affected parties about data use, proper use and incidents. | |||||||
| 5.3.1-1 | Users told where and how their data is used, accessed and stored, with developers informing operators. 70 laws, 16 not yet in force, 12 proposed | 70 | 44 | 16 | 0 | 12 | |
| 5.3.1-2 | Accessible guidance on using, managing, integrating and configuring the system. no law we track | no law we track | |||||
| 5.3.1-2.1 | That guidance covers proper use, limits and likely failure modes. 70 laws, 16 not yet in force, 12 proposed | 70 | 44 | 16 | 0 | 12 | |
| 5.3.1-2.2 | Users proactively told about security-relevant updates. no law we track | no law we track | |||||
| 5.3.1-3 | Support for users and affected parties during and after a security incident, set out in contracts. 1 law | 1 | 1 | 0 | 0 | 0 | |
5.4
2 of 8 provisions with lawRunning stage, covering principles 11 and 12: updates and watching how the system behaves.
| Provision | What it says | Laws, by state | Laws | Jurisdictions | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| 5.4.1Security updates and patches, and re-testing after model changes. | |||||||
| 5.4.1-1 | Developers issue security patches and notify operators, who pass them to users. no law we track | no law we track | |||||
| 5.4.1-1.1 | Contingency mechanisms for cases where an update cannot be issued. no law we track | no law we track | |||||
| 5.4.1-2 | A major update is treated as a new model version and re-tested. no law we track | no law we track | |||||
| 5.4.1-3 | Operators helped to evaluate model changes, for example with preview access and versioned APIs. no law we track | no law we track | |||||
| 5.4.2Logging and monitoring of a running AI system. | |||||||
| 5.4.2-1 | Operators log system and user actions. 78 laws, 27 not yet in force, 1 proposed | 78 | 37 | 27 | 0 | 1 | |
| 5.4.2-2 | Logs analysed for anomalies, breaches and effects of drift or poisoning. 3 laws, 1 not yet in force | 3 | 2 | 1 | 0 | 0 | |
| 5.4.2-3 | Internal system states monitored where that helps address security threats. no law we track | no law we track | |||||
| 5.4.2-4 | Model and system performance tracked over time for shifts in behaviour that touch security. no law we track | no law we track | |||||
5.5
0 of 2 provisions with lawRetirement stage, holding only principle 13: disposal of data and models.
| Provision | What it says | Laws, by state | Laws | Jurisdictions | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| 5.5.1Secure disposal when data or a model changes hands or is decommissioned. | |||||||
| 5.5.1-1 | Data custodians involved and assets securely disposed of when training data or a model changes hands. no law we track | no law we track | |||||
| 5.5.1-2 | Data custodians involved and data and configuration securely deleted when a model or system is decommissioned. no law we track | no law we track | |||||
Where the law and the framework part
52 of the 72 provisions have no law we track under them.
Kinds of duty this framework has no provision for: age verification, attribution, consent, content labelling, data subject rights, design code, licensing, transfer.
The framework's text
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Read it from the publisher: www.etsi.org