top of page

Explaining ETSI EN 304 223 

AI security is no longer a niche or future concern. For organisations using AI in production — particularly generative AI — customers, regulators, and partners are increasingly asking the same question:

​

How do you know your AI systems are secure?

​

ETSI EN 304 223 is a new European standard that defines baseline cyber security requirements for AI systems across their full lifecycle. Crucially, it provides a practical bridge between AI-specific risks and the controls organisations already rely on through ISO/IEC 27001 and SOC 2.​

WHAT ETSI EN 304 223 IS (AND ISN’T)

ETSI EN 304 223 focuses specifically on AI security, not general application or infrastructure security. It addresses risks that are either unique to AI systems or significantly amplified by them, including:

  • data poisoning and training data integrity

  • prompt injection and indirect misuse

  • opaque third-party model dependencies

  • lack of visibility once AI systems are live

  • unclear ownership across design, build, and operations

 

The standard is explicitly intended for real-world, deployed AI systems, including those using deep neural networks and generative AI. It is not aimed at purely academic or experimental research.

Rather than prescribing specific technologies, EN 304 223 establishes a baseline set of lifecycle security expectations that organisations can apply proportionately.

​

HOW THE STANDARD IS STRUCTURED

EN 304 223 organises its requirements around five lifecycle phases:

  • Secure design

  • Secure development

  • Secure deployment

  • Secure maintenance

  • Secure end-of-life

 

Within these phases, the standard defines principles covering areas such as supply-chain security, documentation of data and models, testing and evaluation, monitoring of AI behaviour, incident management, and secure disposal.

 

A key strength of the standard is its emphasis on stakeholder responsibility. Many AI security failures occur between teams — for example, between product, engineering, security, and suppliers. EN 304 223 explicitly addresses this by clarifying who is expected to do what at each stage of the lifecycle.

bottom of page