EU AI Act raises security demands for AI deployments

The EU AI Act, Regulation 2024/1689, extends AI compliance obligations to vendors, developers, and enterprises that do business with EU companies. Customer-facing uses of AI-generated content or data require transparency, while products with “digital elements” sold in the EU market face mandatory cybersecurity expectations covering standalone AI tools, embedded AI, and remote data processing components.

High-risk AI systems are expected to meet “appropriate levels of cybersecurity robustness” across the product lifecycle under Article 15, including threat modeling, secure coding, security testing, quality management, and documented risk mitigation. LLM vendors and software providers must address model-layer risks such as data poisoning, prompt injection, jailbreaking, and privacy attacks, while maintaining secure-by-default configurations, timely patches, SBOMs, technical documentation, and testing records.

Adjacent rules including NIS 2, DORA, the Cybersecurity Act, the Cyber Resiliency Act, GDPR, and ETSI EN 304 223 broaden the operational burden. Enterprises integrating third-party AI remain accountable for governance, vendor oversight, data security, monitoring, human override workflows, and incident response. Serious cybersecurity incidents or systemic malfunctions may need to be reported in less than 72 hours, and in some cases as little as 24 hours.

A timing correction notes that AI Omnibus amendments entered into force on 27 July 2026 and moved high-risk obligations for Annex III to 2 December 2027 and Annex I products to 2 August 2028. General-purpose model enforcement and Article 50 transparency duties became applicable on 2 August, while NIS 2, DORA, and CRA obligations continue on their own schedules.