ETSI EN 304 223 Securing AI 5.1.2-4: AI-specific risk assessment and due diligence for external components

What does 5.1.2-4 require?

When a developer or system operator brings in an external component, it performs a due diligence step and an AI-focused security risk review, following its usual software development process, that looks specifically at the AI risks the component introduces.

Maintained by Gerard Blokdyk

Other controls in Clause 5.1: Secure design (Principles 1 to 4) – ETSI EN 304 223 Securing AI

5.1.1-1 AI security content in the cyber security training programme
5.1.1-2 Ongoing staff awareness of AI threats, with secure AI coding training for developers
5.1.2-1 Assess the need, the risks and the mitigations before building an AI system
5.1.2-2 Design for resilience against adversarial attack, unexpected input and failure
5.1.2-3 Create an audit trail for the AI system
5.1.2-5 Match intended use to data sensitivity, and encourage staff to report AI security risks
5.1.2-6 Least-privilege, risk-assessed permissions for the AI system on other systems
5.1.2-7 Due diligence on external providers

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ETSI EN 304 223 Securing AI controls