OWASP LLM Top 10 LLM05:2026Data and Model Poisoning

Data and Model Poisoning describes a class of attacks and failures where an adversary (or unsafe process) manipulates data or model artifacts to embed harmful behavior, bias, or exploitable weaknesses into an AI system. In modern GenAI environments, poisoning is not limited to "training data" in the traditional sense. It can occur anywhere data is ingested, transformed, retrieved, or reused, including during pre-training, fine-tuning, embedding creation, retrieval augmentation (RAG), and model distribution. The result is an AI system that may still appear functional but behaves in ways that undermine trust, safety, and security.OWASP Top 10 for LLM Applications, 2026 edition, August 2026, LLM05:2026

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: security.

4: laws
3: jurisdictions
0: with court rulings behind them
1: not yet in force
1: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the..., 3 laws
NIST AI RMFMEASURE 2.7 AI system security and resilience – as identified in the MAP function – are..., 3 laws
NIST AI RMFMEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable...., 2 laws
NIST AI 600-1GAI-RISK-04 Data Privacy, 4 laws
NIST AI 600-1GAI-RISK-09 Information Security, 4 laws
NIST AI 200-22.2 Define & Construct, 4 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 4 laws
OWASP Agentic Top 10ASI01 Agent Goal Hijack, 4 laws
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 4 laws
OWASP Agentic Top 10ASI04 Agentic Supply Chain Vulnerabilities, 4 laws
MIT mitigations2.1 Model & Infrastructure Security, 4 laws
MIT mitigations2.3 Model Safety Engineering, 4 laws
MIT mitigations3.1 Testing & Auditing, 4 laws
1 more in the MIT mitigations
NIST CSF 2.0PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and..., 2 laws
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 4 laws
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 4 laws
FINOS AIGFAIR-PREV-012 Role-Based Access Control for AI Data, 4 laws
4 more in the FINOS AIGF
ETSI EN 304 2235.1.2-2 System built to hold up against adversarial attacks, unexpected inputs and failures., 4 laws
ETSI EN 304 2235.1.3-1 Threat modelling and risk management, reviewed regularly and covering..., 4 laws
ETSI EN 304 2235.2.1-4 Sensitive data such as training and test sets protected from unauthorised access., 4 laws
1 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI risk obligations

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 13 months	Through its security duty. What it requires
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	Through its security duty. What it requires

AI sector rules

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its security duty. What it requires

AI transparency

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
New York City	Chatbot Data Privacy, Security, and Transparency proposed	Through its security duty. What it requires

Excerpts of the OWASP Top 10 for LLM Applications, CC BY-SA 4.0. OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim. Every control of the framework.