ETSI EN 304 223 Securing AI 5.1.2-7: Due diligence on external providers

What does 5.1.2-7 require?

Before working with an external provider, a developer or system operator carries out a due diligence assessment and seeks assurance that the provider follows this standard.

Maintained by Gerard Blokdyk

Other controls in Clause 5.1: Secure design (Principles 1 to 4) – ETSI EN 304 223 Securing AI

5.1.1-1 AI security content in the cyber security training programme
5.1.1-2 Ongoing staff awareness of AI threats, with secure AI coding training for developers
5.1.2-1 Assess the need, the risks and the mitigations before building an AI system
5.1.2-2 Design for resilience against adversarial attack, unexpected input and failure
5.1.2-3 Create an audit trail for the AI system
5.1.2-4 AI-specific risk assessment and due diligence for external components
5.1.2-5 Match intended use to data sensitivity, and encourage staff to report AI security risks
5.1.2-6 Least-privilege, risk-assessed permissions for the AI system on other systems

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ETSI EN 304 223 Securing AI controls