Introduction to the New ETSI AI Security Standard
The European Telecommunications Standards Institute (ETSI) has introduced the ETSI EN 304 223 standard, which sets baseline security requirements for artificial intelligence (AI) that enterprises must incorporate into their governance frameworks. This new standard responds to the growing integration of machine learning and AI models into the core operations of organizations worldwide.
Scope and Global Significance
Recognized as the first globally applicable European Standard for AI cybersecurity, ETSI EN 304 223 has received formal approval from National Standards Organisations, which reinforces its authority across international markets. It complements existing regulations such as the EU AI Act by addressing the unique security challenges posed by AI systems—challenges that traditional software security often fails to cover.
The standard applies to a broad range of AI technologies, including deep neural networks, generative AI, and basic predictive systems, while explicitly excluding AI systems used solely for academic research.
Addressing AI-Specific Security Risks
AI systems face distinctive threats like data poisoning, model obfuscation, and indirect prompt injection. The ETSI standard mandates that these risks be considered during the design and deployment phases, ensuring that security is integrated from the outset rather than treated as an afterthought.
Defining Clear Roles and Responsibilities
A common obstacle in enterprise AI adoption has been ambiguity around accountability for AI security. ETSI addresses this by defining three key technical roles:
- Developers: Those who create or modify AI models.
- System Operators: Entities responsible for deploying and managing AI systems.
- Data Custodians: Individuals or teams overseeing data permissions and integrity.
For example, a financial services firm fine-tuning an open-source fraud detection model may act as both Developer and System Operator, thus incurring responsibilities such as securing deployment infrastructure and meticulously documenting training data provenance and model audits.
Data Custodians, often Chief Data and Analytics Officers (CDAOs), now have clearly defined security duties. They must ensure that AI system usage aligns with the sensitivity of the underlying training data, effectively becoming security gatekeepers within data management workflows.
Security Measures Throughout the AI Lifecycle
The ETSI standard requires organizations to conduct threat modeling during AI system design, specifically targeting AI-native attacks such as membership inference and model obfuscation. Developers are also tasked with minimizing the attack surface by restricting functionality to necessary features only. For instance, if a multi-modal AI model is employed but only text processing is needed, unused inputs like images or audio must be disabled to reduce vulnerabilities.
Asset management is emphasized; enterprises must maintain detailed inventories of AI assets, their interdependencies, and connectivity to facilitate the discovery and governance of shadow AI.
Supply chain security is another critical focus. Enterprises using third-party or open-source AI components must justify the selection of poorly documented models and document associated risks. This requirement effectively bans procurement of “black box” AI solutions without transparency.
Verification and Audit Trails
Developers must provide cryptographic hashes for AI model components to ensure authenticity. When sourcing training data publicly, the source URL and acquisition timestamp must be recorded to support post-incident investigations, particularly to detect data poisoning during model training.
Operational Controls and Monitoring
If enterprises expose AI services via APIs, they must implement controls such as rate limiting to defend against adversarial attacks aimed at reverse engineering or poisoning the model.
The standard treats major AI updates—like retraining on new datasets—as new deployments, triggering renewed security evaluations. Continuous monitoring is mandated, requiring operators to analyze logs for data drift or behavioral changes that may signal security breaches, thus elevating AI monitoring to a security discipline.
End-of-Life Management
Upon decommissioning or transferring AI models, organizations must involve Data Custodians to securely dispose of data and configuration details, preventing leaks of sensitive intellectual property or training information through discarded resources.
Governance and Training
Compliance with ETSI EN 304 223 demands tailored cybersecurity training programs reflecting specific roles. Developers receive instruction in secure AI coding practices, while general staff are educated on threats such as social engineering via AI outputs.
Scott Cadzow, Chair of ETSI’s Technical Committee for Securing Artificial Intelligence, highlighted the standard’s importance: “ETSI EN 304 223 represents an important step forward in establishing a common, rigorous foundation for securing AI systems. As AI becomes integral to critical services, clear and practical guidance is essential to ensure these systems are resilient, trustworthy, and secure by design.”
Implications for Enterprise AI Adoption
By enforcing documented audit trails, clear role definitions, and supply chain transparency, the ETSI standard provides a robust framework for safer innovation. Organizations adopting AI can mitigate associated risks and establish defensible positions in anticipation of future regulatory audits.
An upcoming technical report, ETSI TR 104 159, will focus specifically on generative AI, addressing challenges such as deepfakes and disinformation.
Fonte: ver artigo original
Related Articles
OpenAI Acknowledges Persistent Security Risks in AI Browsers Amid Enhanced Cybersecurity Measures
DMS 2026 Seoul: Asia’s Premier Digital Marketing Summit Highlights AI’s Transformative Role
Rapid Data Center Expansion Poses Challenges to Microsoft’s Sustainability Ambitions
Pure Storage and Microsoft Azure Drive Enterprise Strategies for AI-Ready Data Infrastructure
