ETSI EN 304 223 Securing AI
ETSI's baseline cyber security standard for AI models and systems: 13 principles across secure design, development, deployment, maintenance and end of life, stated as provisions on developers, system operators and data custodians, covering training, threat modelling, human oversight, asset protection, infrastructure, supply chain, documentation, testing, end-user communication, patching, monitoring and disposal.
ETSI EN 304 223 Securing AI is a compliance framework from Europe (ETSI member states) with 5 domains and 50 controls. The largest domains are Clause 5.2: Secure development (Principles 5 to 9) – ETSI EN 304 223 Securing AI (21 controls), Clause 5.1: Secure design (Principles 1 to 4) – ETSI EN 304 223 Securing AI (18 controls), Clause 5.4: Secure maintenance (Principles 11 and 12) – ETSI EN 304 223 Securing AI (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Clause 5.1: Secure design (Principles 1 to 4) – ETSI EN 304 223 Securing AI
| Code | Title |
|---|---|
| etsi-en-304-223-securing-ai::5.1.1-1 | AI security content in the cyber security training programme |
| etsi-en-304-223-securing-ai::5.1.1-2 | Ongoing staff awareness of AI threats, with secure AI coding training for developers |
| etsi-en-304-223-securing-ai::5.1.2-1 | Assess the need, the risks and the mitigations before building an AI system |
| etsi-en-304-223-securing-ai::5.1.2-2 | Design for resilience against adversarial attack, unexpected input and failure |
| etsi-en-304-223-securing-ai::5.1.2-3 | Create an audit trail for the AI system |
| etsi-en-304-223-securing-ai::5.1.2-4 | AI-specific risk assessment and due diligence for external components |
| etsi-en-304-223-securing-ai::5.1.2-5 | Match intended use to data sensitivity, and encourage staff to report AI security risks |
| etsi-en-304-223-securing-ai::5.1.2-6 | Least-privilege, risk-assessed permissions for the AI system on other systems |
| etsi-en-304-223-securing-ai::5.1.2-7 | Due diligence on external providers |
| etsi-en-304-223-securing-ai::5.1.3-1 | Threat modelling and risk management for AI systems |
| etsi-en-304-223-securing-ai::5.1.3-2 | Pass unresolved AI threats down the chain to operators and end-users |
| etsi-en-304-223-securing-ai::5.1.3-3 | Assurance over external parties responsible for AI risks |
| etsi-en-304-223-securing-ai::5.1.3-4 | Continuous monitoring and review of system infrastructure against risk appetite |
| etsi-en-304-223-securing-ai::5.1.4-1 | Build in and maintain capabilities for human oversight |
| etsi-en-304-223-securing-ai::5.1.4-2 | Make outputs easy for responsible humans to assess |
| etsi-en-304-223-securing-ai::5.1.4-3 | Technical measures where human oversight is a risk control |
| etsi-en-304-223-securing-ai::5.1.4-4 | Verify the data custodian's specified controls are implemented |
| etsi-en-304-223-securing-ai::5.1.4-5 | Tell end-users which uses of the system are prohibited |
Clause 5.2: Secure development (Principles 5 to 9) – ETSI EN 304 223 Securing AI
| Code | Title |
|---|---|
| etsi-en-304-223-securing-ai::5.2.1-1 | Comprehensive asset inventory including interdependencies |
| etsi-en-304-223-securing-ai::5.2.1-2 | Processes and tools to track, authenticate, version and secure AI assets |
| etsi-en-304-223-securing-ai::5.2.1-3 | Disaster recovery plans tailored to attacks on AI systems |
| etsi-en-304-223-securing-ai::5.2.1-4 | Protect sensitive data and sanitise inputs, with proportionate protection of weights |
| etsi-en-304-223-securing-ai::5.2.2-1 | Evaluate access control frameworks for APIs, models, data and pipelines |
| etsi-en-304-223-securing-ai::5.2.2-2 | Controls on externally offered APIs against attacks on the AI system |
| etsi-en-304-223-securing-ai::5.2.2-3 | Dedicated, segregated environments for development and model tuning |
| etsi-en-304-223-securing-ai::5.2.2-4 | Publish a clear vulnerability disclosure policy |
| etsi-en-304-223-securing-ai::5.2.2-5 | AI system incident management plan and recovery plan |
| etsi-en-304-223-securing-ai::5.2.2-6 | Cloud service contracts that support these requirements |
| etsi-en-304-223-securing-ai::5.2.3-1 | Secure software supply chain processes for AI development |
| etsi-en-304-223-securing-ai::5.2.3-2 | Justify, mitigate and disclose use of poorly documented or unsecured components |
| etsi-en-304-223-securing-ai::5.2.3-3 | Re-run evaluations on released models before use |
| etsi-en-304-223-securing-ai::5.2.3-4 | Tell end-users before models are updated |
| etsi-en-304-223-securing-ai::5.2.4-1 | Document system design and maintenance plans, and publish component hashes |
| etsi-en-304-223-securing-ai::5.2.4-2 | Record the provenance and use of public training data |
| etsi-en-304-223-securing-ai::5.2.4-3 | Audit log of changes to system prompts and model configuration |
| etsi-en-304-223-securing-ai::5.2.5-1 | Security assessment testing before release of models, applications and systems |
| etsi-en-304-223-securing-ai::5.2.5-2 | Operator testing before deployment, using independent skilled testers |
| etsi-en-304-223-securing-ai::5.2.5-3 | Share testing and evaluation findings with system operators |
| etsi-en-304-223-securing-ai::5.2.5-4 | Evaluate outputs for leakage of model internals and unintended influence |
Clause 5.3: Secure deployment (Principle 10) – ETSI EN 304 223 Securing AI
| Code | Title |
|---|---|
| etsi-en-304-223-securing-ai::5.3.1-1 | Tell end-users where and how their data is used, accessed and stored |
| etsi-en-304-223-securing-ai::5.3.1-2 | Accessible guidance for end-users, including limitations and security updates |
| etsi-en-304-223-securing-ai::5.3.1-3 | Support end-users and affected entities through incidents |
Clause 5.4: Secure maintenance (Principles 11 and 12) – ETSI EN 304 223 Securing AI
| Code | Title |
|---|---|
| etsi-en-304-223-securing-ai::5.4.1-1 | Provide security updates and patches, with contingency where updates are impossible |
| etsi-en-304-223-securing-ai::5.4.1-2 | Treat major updates as a new version and support operators through model changes |
| etsi-en-304-223-securing-ai::5.4.2-1 | Log system and user actions |
| etsi-en-304-223-securing-ai::5.4.2-2 | Analyse logs for anomalies, breaches and unexpected behaviour |
| etsi-en-304-223-securing-ai::5.4.2-3 | Monitor internal states of the AI system where useful for security |
| etsi-en-304-223-securing-ai::5.4.2-4 | Monitor model and system performance over time for security-relevant change |
Clause 5.5: Secure end of life (Principle 13) – ETSI EN 304 223 Securing AI
| Code | Title |
|---|---|
| etsi-en-304-223-securing-ai::5.5.1-1 | Secure disposal when training data or a model is transferred |
| etsi-en-304-223-securing-ai::5.5.1-2 | Secure deletion when a model or system is decommissioned |
What is ETSI EN 304 223 Securing AI and who does it apply to?
ETSI EN 304 223 Securing AI is a compliance framework from Europe (ETSI member states) with 5 domains and 50 controls. ETSI's baseline cyber security standard for AI models and systems: 13 principles across secure design, development, deployment, maintenance and end of life, stated as provisions on developers, system operators and data custodians, covering training, threat modelling, human oversight, asset protection, infrastructure, supply chain, documentation, testing, end-user communication, patching, monitoring and disposal. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ETSI EN 304 223 Securing AI actually require?
ETSI EN 304 223 Securing AI has 50 controls organised across 5 domains. The largest domains are Clause 5.2: Secure development (Principles 5 to 9) – ETSI EN 304 223 Securing AI (21 controls), Clause 5.1: Secure design (Principles 1 to 4) – ETSI EN 304 223 Securing AI (18 controls), Clause 5.4: Secure maintenance (Principles 11 and 12) – ETSI EN 304 223 Securing AI (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ETSI EN 304 223 Securing AI do I already cover?
ETSI EN 304 223 Securing AI does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ETSI EN 304 223 Securing AI?
Start your ETSI EN 304 223 Securing AI compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ETSI EN 304 223 Securing AI requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 50 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required