European UnionAI Act, Article 15 (accuracy, robustness and cybersecurity)
Regulation (EU) 2024/1689, Article 15
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Security, Governance
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
- If you are the provider of a high-risk AI system, design and develop it to achieve an appropriate level of accuracy, robustness and cybersecurity, held consistently throughout its lifecycle.NIST AI RMFMEASURE 2.5NIST AI RMFMEASURE 2.7
- Declare the levels of accuracy and the relevant accuracy metrics of your high-risk AI system in its accompanying instructions of use.NIST AI RMFMEASURE 2.3
- Build your high-risk AI system to be as resilient as possible to errors, faults or inconsistencies, including those arising from its interaction with people or other systems, through technical and organisational measures.NIST AI RMFMEASURE 2.6
- If your high-risk AI system continues to learn after it is placed on the market or put into service, develop it to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, and put mitigation measures in place for any feedback loop that remains.NIST AI RMFMEASURE 2.11
- Make your high-risk AI system resilient against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting vulnerabilities, with technical solutions appropriate to the circumstances and the risk.NIST AI RMFMEASURE 2.7
- Where appropriate to the risk, include measures to prevent, detect, respond to, resolve and control for data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and other model flaws.NIST AI RMFMEASURE 2.7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.3AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented.
- MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated and documented.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-09Information Security
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM01:2026Prompt Injection
- LLM02:2026Sensitive Information Disclosure
- LLM04:2026Supply Chain
- LLM05:2026Data and Model Poisoning
- OWASP Agentic Top 10
- MIT mitigations Draft
- NIST CSF 2.0
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
- DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ETSI EN 304 223
- 5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.
- 5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.
- 5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.
- 5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16, point (a), requires a provider to ensure its high-risk AI system complies with the Section 2 requirements this row states; brought in by Article 16, point (a)'s reference to Section 2, which covers the Article 15 accuracy, robustness and cybersecurity requirement; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- What level of accuracy is 'appropriate' under Article 15(1), when Article 15(2) requires the Commission only to 'encourage' the development of benchmarks and measurement methodologies?
What it makes you log
Logging duty
Article 15 sets substantive design requirements for accuracy, robustness and cybersecurity and requires the system's declared accuracy metrics to appear in its instructions of use; nothing in the article asks the provider to keep a log or a record of what the system did. The declaration in the instructions of use is a disclosure to deployers that accompanies the system, not an ongoing record.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Providers of a high-risk AI system must design and develop it to achieve an appropriate level of accuracy, robustness and cybersecurity, performing consistently in those respects throughout its lifecycle. The system's accuracy levels and metrics must be declared in its accompanying instructions of use.
The system must be as resilient as possible to errors, faults or inconsistencies, including those arising from its interaction with people or other systems, through technical and organisational measures, and a system that continues to learn after deployment must be developed to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, with mitigation measures for any feedback loop that remains.
The system must be resilient against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting vulnerabilities, with technical solutions appropriate to the circumstances and the risk, including, where appropriate, measures against data poisoning, model poisoning, adversarial examples or model evasion, and confidentiality attacks.
A high-risk AI system that is a product with digital elements within the scope of the Cyber Resilience Act (Regulation (EU) 2024/2847), meets that Regulation's essential cybersecurity requirements and has a declaration of conformity under it that demonstrates the level of cybersecurity Article 15 requires is deemed to comply with Article 15's cybersecurity requirement, though no such presumption covers accuracy or robustness.
Article 15 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Article 15 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .