Law / Frameworks / ETSI EN 304 223 / 5.1

ETSI EN 304 223, 5.15.1.3-1

Threat modelling and risk management, reviewed regularly and covering AI-specific attacks. Our summary; European Telecommunications Standards Institute (ETSI)'s text is not ours to print.

We read each law below as bearing on this provision. That does not mean the provision, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: DPIA, security.

16: laws
11: jurisdictions
0: with court rulings behind them
3: not yet in force
5: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMAP 5.1 Likelihood and magnitude of each identified impact (both potentially..., 9 laws
NIST AI RMFMANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP..., 5 laws
NIST AI RMFMEASURE 2.10 Privacy risk of the AI system – as identified in the MAP function – is..., 4 laws
3 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-04 Data Privacy, 16 laws
NIST AI 600-1GAI-RISK-09 Information Security, 3 laws
NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 2 laws
NIST AI 200-22.4 Synthesize & Interrogate, 13 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 4 laws
NIST AI 200-22.2 Define & Construct, 3 laws
1 more in the NIST AI 200-2
OWASP LLM Top 10LLM01:2026 Prompt Injection, 3 laws
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure, 3 laws
OWASP LLM Top 10LLM04:2026 Supply Chain, 3 laws
2 more in the OWASP LLM Top 10
OWASP Agentic Top 10ASI01 Agent Goal Hijack, 3 laws
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 3 laws
OWASP Agentic Top 10ASI04 Agentic Supply Chain Vulnerabilities, 3 laws
1 more in the OWASP Agentic Top 10
MIT mitigations3.1 Testing & Auditing, 16 laws
MIT mitigations1.2 Risk Management, 14 laws
MIT mitigations1.7 Societal Impact Assessment, 13 laws
6 more in the MIT mitigations
NIST CSF 2.0PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and..., 2 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 14 laws
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 3 laws
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 3 laws
10 more in the FINOS AIGF

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI governance

7 laws, 7 jurisdictions

Jurisdiction	Law	How it reaches this provision
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its DPIA duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its DPIA duty. What it requires
Canada	Council of Europe Framework Convention on Artificial Intelligence, signed by Canada proposed	Through its DPIA duty. What it requires
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	Through its DPIA duty. What it requires
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its DPIA duty. What it requires
United Kingdom	Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom proposed	Through its DPIA duty. What it requires

AI risk obligations

5 laws, 3 jurisdictions

Jurisdiction	Law	How it reaches this provision
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 13 months	Through its security duty. What it requires
European Union	AI Act, Article 27 (fundamental rights impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	Through its security duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its DPIA duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its DPIA duty. What it requires

AI sector rules

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this provision
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its security duty. What it requires
Mauritius	FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services	Through its DPIA duty. What it requires

AI prohibited practices

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its DPIA duty. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Hungary	Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data	Through its DPIA duty. What it requires

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI. Every provision of the framework.