What does the EU AI Act require of a CISO?

The EU AI Act, Regulation (EU) 2024/1689, expects the security function to make high-risk AI systems resilient against attacks such as data poisoning, model poisoning and adversarial inputs, to keep system logs, and to report serious incidents within fixed deadlines. The Act became applicable on 2 August 2026, while the obligations for high-risk systems in the sensitive Annex III areas now apply from 2 December 2027 after the AI Omnibus amendment entered into force on 27 July 2026.

The Act's duties attach to roles such as provider and deployer rather than to job titles, so a CISO's exposure depends on which of those roles the organization plays for each system.

What does Article 15 require on cybersecurity?

Article 15 requires high-risk AI systems to be designed and developed to reach an appropriate level of accuracy, robustness and cybersecurity, and to perform consistently on all three across their lifecycle. It is the clause that most directly turns AI risk into security engineering work.

The article says these systems must resist attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities, and that the technical measures must fit the circumstances and the risks.

It then names the AI-specific attacks a control set should cover where appropriate: manipulation of training data, poisoning of pre-trained components, inputs crafted to make a model err, confidentiality attacks and model flaws. The measures it lists run from prevention and detection through response, resolution and control.

Robustness may be achieved through technical redundancy, including backup or fail-safe plans, and systems that keep learning after release must be built to limit feedback loops in which biased outputs shape future inputs. Accuracy levels and metrics must be declared in the instructions of use.

What must an organization that deploys high-risk AI do?

A deployer must monitor the system against the provider's instructions, keep the automatically generated logs it controls for at least six months, and escalate risks and serious incidents without delay. Article 26 sets out these duties, and most enterprise security teams will meet the Act here first.

If a deployer has reason to think the system presents a risk, it must inform the provider or distributor and the market surveillance authority and suspend use. When it identifies a serious incident, it must immediately inform the provider first, then the importer or distributor and the authorities.

How quickly must serious incidents be reported?

Providers of high-risk systems must report a serious incident to the market surveillance authority of the Member State where it happened no later than 15 days after becoming aware of it, and sooner once a causal link is established. Article 73 shortens that window to two days for a widespread infringement and to 10 days where a person dies.

An incomplete initial report is allowed when needed to meet the deadline. The provider must then investigate, and it must not alter the AI system in a way that could affect later evaluation of the cause before telling the competent authorities, which has direct consequences for how responders preserve evidence.

What do the general-purpose AI rules mean for security teams?

The obligations on general-purpose AI model providers have applied since 2 August 2025, and the heaviest security duties sit with providers of models that carry systemic risk. Under Article 55 those providers must run and document adversarial testing, report serious incidents to the AI Office without undue delay, and secure both the model and its physical infrastructure.

Such providers may rely on a code of practice to show compliance until a harmonised standard is published. The Commission describes its GPAI Code of Practice as a voluntary tool covering transparency, copyright, and safety and security, which gives enterprise buyers a reference point when questioning model vendors.

Where does the timeline stand in September 2026?

Enforcement is live. Since 2 August 2026 the AI Office and national authorities have been responsible for supervising and enforcing the Act, and the transparency rules took effect the same month.

Prohibited practices and AI literacy duties have applied since 2 February 2025. The Omnibus, proposed on 19 November 2025 and politically agreed on 7 May 2026, moved the Annex III high-risk rules to 2 December 2027 and the rules for high-risk AI embedded in products such as machinery, toys and lifts to 2 August 2028.

The article texts quoted on this page come from the Service Desk explorer, which reproduces the official version of 13 June 2024, so teams should check the Omnibus text on EUR-Lex for any amended wording.

A practical sequence for the next 14 months: classify every AI system as provider or deployer use and flag anything touching the Annex III areas (this site's Annex III lookup walks through each category); map existing controls against the attack classes Article 15 lists; extend log retention and SIEM coverage to AI system logs; write the Article 73 deadlines and evidence-preservation rule into the incident response plan; and add adversarial testing and code-of-practice questions to AI vendor assessments.