AI regulation · EU AI Act Security Testing
Security evidence for the EU AI Act
Article 15 expects high-risk AI systems to resist poisoning, adversarial inputs and confidentiality attacks. We test your system against exactly those threats and document the results.
What does the EU AI Act require for cybersecurity?
For high-risk AI systems, Article 15 of the EU AI Act (Regulation (EU) 2024/1689) requires an appropriate level of accuracy, robustness and cybersecurity, including resilience against data poisoning, model poisoning, adversarial examples or model evasion, and confidentiality attacks. Providers of general-purpose AI models with systemic risk must also run and document adversarial testing under Article 55. Security testing of the AI system produces evidence for both.
Last reviewed by the Mighty Infosec team. This page is guidance, not legal advice.
Regulation (EU) 2024/1689
What the AI Act asks for
Article 15
High-risk AI systems must achieve appropriate accuracy, robustness and cybersecurity throughout their lifecycle.
Article 15(5)
Technical measures against data poisoning, model poisoning, adversarial examples or model evasion, and confidentiality attacks.
Article 55
Providers of general-purpose AI models with systemic risk must perform and document adversarial testing.
Article 50
Transparency duties, such as telling people they are interacting with an AI system, apply even to many systems that are not high-risk.
How we help
AI-native testing, verified by experts
Map Article 15 threats
An AI threat model that links your system to each threat class named in Article 15(5).
Adversarial testing
Prompt injection, evasion, data extraction and poisoning scenarios run against your real system.
Align with standards
Findings mapped to OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF and ISO/IEC 42001 controls.
Documentation you can use
Results written to slot into your technical documentation and risk management system.
What you receive
- AI threat model mapped to Article 15(5)
- Adversarial test results and evidence
- Mapping to NIST AI RMF and ISO/IEC 42001
- Remediation plan and retest
FAQ
EU AI Act Security Testing questions
Is my AI chatbot high-risk under the AI Act?
Most customer support chatbots are not high-risk, but they still carry transparency duties under Article 50 and the same security risks. High-risk uses are listed in Annex III and include areas such as hiring, credit scoring, education and critical infrastructure. Classification is a legal question for your counsel. We provide the technical security evidence.
Does the AI Act apply to companies outside the EU?
It can. The Act applies to providers placing AI systems on the EU market and in some cases where output is used in the EU, wherever the provider is based.
When do the obligations apply?
The AI Act entered into force on 1 August 2024 and its obligations phase in over several years, with timelines that can be adjusted by EU lawmakers. Check the current dates for your system's category with your counsel.
Services
Services behind this engagement
AI Threat Modeling
Design-stage threat modeling for LLM apps and agentic systems: data, tools, autonomy and trust.
AI & LLM Security Testing
LLM and AI chatbot penetration testing for RAG pipelines, AI agents and MCP servers: prompt injection, data leakage, tool abuse.
AI Application Security
Secure code review and guardrail engineering for the code that wires LLMs into your product.
Talk to us about EU AI Act Security Testing
Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.