Navigating the New ETSI AI Security Standard

ETSI EN 304 223 establishes foundational security requirements for artificial intelligence that organizations should embed within their governance structures.

As enterprises integrate machine learning into core workflows, this European Standard provides specific provisions for protecting AI models and systems. It is the first globally applicable European Standard for AI cybersecurity, formally approved by National Standards Organizations, which reinforces its credibility across international markets.

Serving as a complementary benchmark to the EU AI Act, this standard acknowledges that AI systems carry unique risks—including data poisoning, model obfuscation, and indirect prompt injection—which conventional software security practices frequently overlook. It applies to deep neural networks, generative AI, and basic predictive systems, explicitly excluding only those used exclusively for academic research.

ETSI standard defines the chain of accountability for AI security

One persistent challenge in enterprise AI deployment is assigning risk ownership. The ETSI standard addresses this by delineating three core technical roles: Developers, System Operators, and Data Custodians.

In many organizations, these boundaries become unclear. For example, a financial services company that fine-tunes an open-source model for fraud detection qualifies as both a Developer and a System Operator. This dual role imposes strict responsibilities: the firm must secure the deployment environment while documenting training data provenance and model design audits.

The explicit inclusion of "Data Custodians" as a separate stakeholder group directly affects Chief Data and Analytics Officers (CDAOs). These individuals manage data permissions and integrity—a role now carrying clear security obligations. Custodians must verify that the system's intended use matches the sensitivity of its training data, effectively embedding a security gatekeeper within data management processes.

The ETSI AI standard emphasizes that security must not be an afterthought added only during deployment. In the design phase, organizations must perform threat modeling that accounts for AI-specific attacks, such as membership inference and model obfuscation.

One requirement mandates that developers limit functionality to minimize the attack surface. For example, if a system employs a multimodal model but only processes text, the unused modalities—such as image or audio processing—become risks that need mitigation. This pushes technical leaders to rethink the common habit of deploying large, general-purpose foundation models when a smaller, more specialized model would be sufficient.

The standard also mandates rigorous asset management. Developers and System Operators must keep a detailed inventory of assets, covering interdependencies and connectivity. This facilitates discovery of shadow AI—IT leaders cannot protect models they are unaware of. Additionally, the standard requires disaster recovery plans specifically designed for AI attacks, ensuring that a "known good state" can be restored if a model is compromised.

Supply chain security poses a direct challenge for organizations that depend on third-party vendors or open-source repositories. Under the ETSI standard, if a System Operator opts to use poorly documented AI models or components, they must justify that choice and document the accompanying security risks.

In practice, procurement teams can no longer accept "black box" solutions. Developers must supply cryptographic hashes for model components to verify their authenticity. When training data is obtained from public sources—common for large language models—developers must record the source URL and acquisition timestamp. This audit trail supports post-incident investigations, especially when determining whether a model was affected by data poisoning during training.

Enterprises that provide APIs to external customers must implement controls to counter AI-specific attacks, such as rate limiting to prevent adversaries from reverse-engineering the model or overwhelming defenses to inject poisoned data.

This lifecycle approach continues into the maintenance phase, where the standard views major updates—like retraining on new data—as deploying a new version. Under the ETSI AI standard, such updates require fresh security testing and evaluation.

Continuous monitoring is also systematized. System Operators must analyze logs not only for uptime but also to identify "data drift" or gradual behavioral changes that might signal a security breach. This shifts AI monitoring from a performance metric to a security function.

The standard also covers the "End of Life" phase. When a model is retired or transferred, organizations must engage Data Custodians to ensure secure disposal of data and configuration details. This requirement prevents sensitive intellectual property or training data from leaking through discarded hardware or forgotten cloud instances.

Executive oversight and governance responsibilities

Complying with ETSI EN 304 223 requires revisiting current cybersecurity training programs. The standard demands role-specific training, ensuring that developers grasp secure coding for AI while general employees stay alert to threats like social engineering through AI outputs.

"ETSI EN 304 223 marks a significant milestone in creating a shared, robust foundation for AI system security," said Scott Cadzow, Chair of ETSI's Technical Committee for Securing Artificial Intelligence.

"As AI becomes more embedded in critical services and infrastructure, the value of clear, practical guidance that acknowledges both the complexity of these technologies and the realities of deployment cannot be overstated. The effort behind this framework stems from broad collaboration, enabling organizations to trust AI systems that are resilient, trustworthy, and secure by design."

Adopting the baselines outlined in the ETSI AI security standard creates a framework for safer innovation. Through documented audit trails, well-defined roles, and supply chain transparency, organizations can reduce the risks of AI adoption while building a defensible stance for future regulatory reviews.

A forthcoming Technical Report (ETSI TR 104 159) will apply these principles specifically to generative AI, addressing challenges such as deepfakes and disinformation.

Also read: Allister Frost on tackling workforce anxiety for successful AI integration

Interested in insights from AI and big data experts? Explore the AI & Big Data Expo in Amsterdam, California, and London. This comprehensive event, part of TechEx, is co-located with other leading technology conferences. Click here for details.

AI News is brought to you by TechForge Media. Discover other upcoming enterprise technology events and webinars here.