ETSI publishes TS 104 223, baseline cyber security requirements for AI

ETSI TS 104 223 is a technical specification that lays down baseline cyber security requirements for AI models and systems across their full lifecycle. It was published as version V1.1.1 in April 2025 by ETSI's Technical Committee on Securing Artificial Intelligence.

What it is

The specification is a baseline document, not guidance for academic research, aimed at stakeholders across the AI supply chain who build or operate deployed AI systems, including generative AI built on deep neural networks. It treats AI security as a subset of cyber security and offers testable shall/should provisions rather than research guidance.

What it requires

The document separates principles and requirements into five phases: secure design, secure development, secure deployment, secure maintenance and secure end of life. Within those phases the standard sets out thirteen core principles that expand into roughly seventy-two detailed provisions covering areas such as threat modeling, asset protection, supply chain security, testing, logging, monitoring and disposal. Provisions call for role-based security training, documented audit trails for models, datasets and prompts, least-privilege training environments, vulnerability disclosure policies, incident and recovery plans, and secure software supply chain practices.

What security leaders should do

CISOs can use the five lifecycle phases as a structure for mapping existing ISMS and SDLC controls onto AI-specific risks such as data poisoning, model inversion and prompt-based manipulation, since the specification defines these threats explicitly. Teams evaluating AI vendors or building internal AI platforms should treat the standard's stakeholder roles for developers, system operators and data custodians as a starting point for assigning security ownership across the AI supply chain.