# EU AI Act Security Requirements
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for artificial intelligence, establishing risk-based requirements for AI systems sold or used within the European Union. From a security perspective, the Act mandates specific cybersecurity measures for high-risk AI systems, including robustness against adversarial attacks, data integrity protections, logging and traceability requirements, and human oversight mechanisms. The security provisions ensure that AI systems are not only effective but resilient against manipulation and failure.
The EU AI Act classifies AI systems into four risk tiers, each with escalating security requirements:
Unacceptable Risk (Prohibited): AI systems that pose unacceptable risks are banned entirely. This includes social scoring systems, real-time biometric identification in public spaces (with exceptions), and manipulative AI targeting vulnerable groups.
High Risk: AI systems in critical areas (healthcare, transportation, employment, law enforcement, critical infrastructure) face the most stringent security requirements:
Limited Risk: Systems like chatbots and deepfake generators face transparency obligations (users must be informed they are interacting with AI) but limited security mandates.
Minimal Risk: Most AI systems (spam filters, AI-enhanced games) face no specific requirements.
Security-specific requirements for high-risk systems (Article 15):
Timeline:
The EU AI Act has extraterritorial reach. Any organization that deploys AI systems affecting EU residents must comply, regardless of where the organization is headquartered. This mirrors GDPR's global impact and means that US, UK, and Asian companies selling into the EU must meet these requirements.
The security implications are substantial. Organizations must prove that their AI systems can withstand adversarial attacks, maintain data integrity, and provide audit trails. This requires new capabilities that most organizations have not built: adversarial robustness testing, AI-specific security monitoring, and formal documentation of AI security controls.
Non-compliance carries significant penalties: up to 35 million EUR or 7% of global annual turnover for prohibited AI practices, and up to 15 million EUR or 3% of turnover for other violations.
The EU AI Act maps directly to CDA's Risk Governance & Assurance (RGA) domain under the Perpetual Compliance Assurance (PCA) methodology. For organizations deploying AI that touches EU markets, compliance is not optional. It is a market access requirement.
CDA's operational approach:
CDA bridges the gap between the legal text and technical implementation. Most organizations understand the regulation but struggle to translate requirements like "resilience against adversarial attacks" into concrete technical controls. That translation is our mission.