ENISA's Multilayer Framework for Good Cybersecurity Practices for AI (the "FAICP"), published in June 2023 by the European Union Agency for Cybersecurity, is a three-layer catalogue of existing good practices for securing AI systems — built because, per its own executive summary, AI-specific harmonised technical standards under the then-proposed EU AI Act were "most likely" not going to be ready before the regulation took effect. Layer I covers the conventional ICT-security foundations any organisation running AI needs regardless of the AI itself; Layer II adds practices specific to AI and machine learning; Layer III adds sector-specific guidance, including a section on the energy sector's industrial automation and control systems. The report also summarizes a survey of EU national competent authorities (NCAs) and found their AI-security monitoring and enforcement readiness generally low.
Key takeaways
- Evasion — crafting small input perturbations ("adversarial examples") that exploit a trained model's output without altering the model itself.
- Alongside the framework, ENISA ran a survey of national competent authorities built on the FAICP's own structure and the proposed AI Act's principles.
- Treat Layer I as non-negotiable before adding AI-specific controls.
Why did ENISA build a three-layer framework instead of a single checklist?
The report's stated problem is sequencing: the EU AI Act, first proposed in April 2021, requires "high-risk" AI systems to meet "adequate levels for robustness, accuracy and cybersecurity" through technical standards — but those standards "most likely will not be ready before the regulation enters into force." ENISA had already published two narrower studies — AI Cybersecurity Challenges: Threat Landscape for Artificial Intelligence (2020) and Securing Machine Learning Algorithms (2021) — but both stopped short of covering "the entire AI life cycle (from concept to decommissioning), the associated infrastructure and all the elements of the AI supply chain." The Commission then asked ENISA to assess the state of national AI-cybersecurity requirements and enforcement, which the report answers through both the FAICP framework and an accompanying NCA survey.
The three layers are explicitly cumulative, not alternatives:
| Layer | Name | Scope |
|---|---|---|
| I | Cybersecurity Foundations | Basic ICT security — risk management, access control, existing legislation (NIS2, GDPR) — for any environment that hosts, operates, develops, integrates, maintains or supplies AI systems, independent of the AI itself |
| II | AI Fundamentals and Cybersecurity | Practices specific to AI/ML components — their life cycle, properties, threats and controls — applicable regardless of industry sector |
| III | Sector-Specific Cybersecurity Good Practices | Best practices tailored to energy, health, automotive and telecommunications, reflecting that "the operational environment... and usage... of the AI system need to be considered for the realistic and accurate mitigation of sectoral threats" |
Layer I frames any ICT infrastructure as a six-block pyramid — physical infrastructure, telecom networks, IT applications (where AI components sit), domain/sectoral services, data, and users/procedures — and ties its risk-management guidance directly to the NIS and NIS 2 directives' requirement that essential entities "assess and mitigate their risks." The framework treats this as a prerequisite: an organisation that has not secured the ICT environment hosting its AI has not yet done the work Layer II and III assume is already in place.
What specific threats does Layer II say are unique to AI and machine learning?
Layer II draws its ML-specific threat list directly from ENISA's own 2021 Securing Machine Learning Algorithms report, naming five high-level ML threats:
Evasion— crafting small input perturbations ("adversarial examples") that exploit a trained model's output without altering the model itself. Poisoning— altering training data or the model to change its behaviour in a chosen direction, including inserting a backdoor. Model or data disclosure— leaking a model's configuration, parameters or training data. Compromise of ML application components— exploiting vulnerabilities in the open-source libraries an ML pipeline is built on. Failure or malfunction of an ML application— denial of service triggered by bad input or an unhandled error condition.
The report is careful to size these against real-world incidence rather than treat them as hypothetical: citing a quantitative study of 139 industrial ML practitioners, it notes that "the number of reported AI threats was marginal, with 2.1% of evasion attacks and 1.4% of poisoning attacks recognised by the organisations" — most incidents still traced back to conventional ICT infrastructure, not the ML layer itself. Layer II also folds in AI Act-specific risk categories that sit outside classic confidentiality/integrity/availability thinking — loss of transparency, interpretability, fairness and accountability — and points to the NIST AI Risk Management Framework and ETSI's Securing Artificial Intelligence (SAI) AI threat ontology as complementary references for structuring that assessment.
What does the framework say about AI running in energy and industrial environments?
Layer III's energy-sector section is the closest the framework comes to OT-specific guidance, and it does not soften the conclusion: "the emergence of industrial automation and control systems, AI, smart grids and autonomous devices have made the energy sector a target for cyberattacks, while the existing interconnectivity and the rapidly complexity of the underlying infrastructures increase the security threats and their cascading effects." It lists the AI-adjacent components already in use — miniaturised sensors monitoring transmission pipelines, inspection and repair robots, AI-managed virtual power plants and microgrids, and demand-response systems — and names recurring root causes: outdated control systems, a "limited cybersecurity culture among vendors, suppliers and contractors," and remote access used for operations and maintenance.
Rather than prescribing a bespoke OT control baseline, the section points practitioners to existing sector guidance: ENISA's own 2019 Industry 4.0 Cybersecurity: Challenges and Recommendations, the 2022 EU Cybersecurity Market Analysis — IoT in Distribution Grids, and the US National Renewable Energy Laboratory's Artificial Intelligence for Energy Systems Cybersecurity report. The report treats energy as one of only four sectors (alongside health, automotive and telecommunications) where it found enough existing sector-specific AI-cybersecurity guidance to summarise — a deliberate limitation the report states outright: "while almost every economic sector already relies on AI systems, we have identified below only those sectors for which we managed to find relevant cybersecurity guidelines."
How ready were EU national regulators, according to ENISA's own survey?
Alongside the framework, ENISA ran a survey of national competent authorities built on the FAICP's own structure and the proposed AI Act's principles. Its conclusion was direct: member states were aware of AI's new risks to critical infrastructure, but "up to now, [member states] essentially expect to follow the same mechanisms as for other cybersecurity threats or incidents" rather than AI-specific ones — with the report noting that only two member states reported having AI-specific guidance or self-assessment tools in place at the time. The survey's strongest response areas were human capital (collaboration with universities), market-readiness guidance, and networking (one member state running an AI ethics committee, another maintaining a registry of AI-system safety measures). The report's own framing of this finding is that the readiness level of NCAs was low and that further measures were needed — a conclusion directly relevant to any vendor assuming a mature regulatory AI-security baseline already exists.
A practical reading order for device, firmware and OT teams
Treat Layer I as non-negotiable before adding AI-specific controlsIf the ICT infrastructure that will host or operate an AI feature is not already covered by conventional risk management and access control, the AI-specific layers assume a foundation that is not actually there. Map the five ML threats against your actual pipeline, not a generic listA product with no on-device training loop has little poisoning exposure at the edge but may still face evasion attacks against an inference-only model, or component compromise through a vulnerable open-source inference library. Read the energy-sector section even if you are not in energyIts root causes — outdated control systems, inconsistent vendor cybersecurity culture, and remote maintenance access — generalize to most OT environments adding AI-driven monitoring or predictive maintenance, not just utilities. Don't assume a regulator-approved AI-security baseline exists yetThe report's own NCA survey found readiness low as of 2023; teams selling into the EU should still track the AI Act's evolving harmonised standards rather than treat this framework as a finished compliance target. Use the framework to organize existing references, not replace themThe FAICP is explicitly a catalogue — ISO/IEC 27000-series, the NIST AI RMF, ENISA's own prior reports — rather than a new control set; the practical value is in the three-layer structure for deciding which existing guidance applies at which layer.
SoftWSP's device and firmware security work increasingly covers products that add AI-driven monitoring, predictive maintenance or inference components to OT and industrial environments — only where a capability is actually built and verifiable, not claimed. See device & firmware security for an assessment that can be scoped against the FAICP's layers alongside conventional firmware and OT vulnerability classes.
This guide summarizes ENISA's Multilayer Framework for Good Cybersecurity Practices for AI (June 2023); it is not a substitute for the full text and does not constitute compliance or legal advice.
Sources
- ENISA: Multilayer Framework for Good Cybersecurity Practices for AI — publication page
- ENISA Multilayer Framework for Good Cybersecurity Practices for AI, full-text PDF (June 2023, ISBN 978-92-9204-619-4)
- ENISA: Securing Machine Learning Algorithms (December 2021) — source of the five ML-threat definitions
- ENISA: Industry 4.0 Cybersecurity — Challenges and Recommendations (2019) — cited for the energy-sector attack surface
- NIST AI Risk Management Framework (AI RMF 1.0) — framework the report cites for AI trustworthiness characteristics
Frequently asked questions
What is ENISA's Multilayer Framework for Good Cybersecurity Practices for AI?
A June 2023 report from the European Union Agency for Cybersecurity (ENISA), authored by Nineta Polemi and Isabel Praça and edited by Monika Adamczyk and Konstantinos Moulinos (ISBN 978-92-9204-619-4, doi 10.2824/588830, published under CC BY 4.0). It proposes what it calls the FAICP (Framework for AI good Cybersecurity Practices): a "scalable framework to guide [national competent authorities] and AI stakeholders on the steps they need to follow to secure their AI systems, operations and processes." Per its executive summary, it was produced because the European Commission asked ENISA to gather "information on the current state of cybersecurity requirements for AI on the EU and national levels" while the proposed AI Act's own harmonised technical standards were still years from being ready.
What are the framework's three layers?
Section 2 defines three layers, each built on the one before it. Layer I ("Cybersecurity Foundations") covers "basic cybersecurity knowledge and practices that need to be applied to all ICT environments that host/operate/develop/integrate/maintain/supply/provide AI systems" — risk management, access control and existing legislation (NIS2, GDPR), independent of whether AI is involved at all. Layer II ("AI Fundamentals and Cybersecurity") addresses "cybersecurity practices needed for addressing the specificities of the AI components... which would be applicable regardless of the industry sector," including an AI/ML-specific threat taxonomy and AI trustworthiness properties. Layer III ("Sector-Specific Cybersecurity Good Practices") gives best practices tailored to energy, health, automotive and telecommunications, since — as the report puts it — "the operational environment... and usage... of the AI system need to be considered for the realistic and accurate mitigation of sectoral threats."
What ML-specific threats does the framework name, and how common were they in practice?
Section 2.2 lists five high-level machine-learning threats, drawing on ENISA's own 2021 Securing Machine Learning Algorithms report: Evasion (adversarial input perturbations that exploit a trained model's output), Poisoning (altering training data or the model itself to change its behaviour, e.g. to insert a backdoor), Model or data disclosure (leaking a model's configuration, parameters or training data), Compromise of ML application components (exploiting vulnerabilities in the open-source libraries an ML pipeline depends on), and Failure or malfunction of an ML application (denial of service from a bad input or an unhandled error). Citing a quantitative study of 139 industrial ML practitioners, the report notes that despite most reported attacks targeting conventional ICT infrastructure, organisations did recognise some ML-specific incidents — 2.1% evasion attacks and 1.4% poisoning attacks — a small but non-zero share that the report uses to argue AI-specific threat assessment can no longer be skipped.
What does the framework say about AI in energy and other critical-infrastructure sectors?
Layer III's energy-sector section states plainly that "the emergence of industrial automation and control systems, AI, smart grids and autonomous devices have made the energy sector a target for cyberattacks," pointing to AI-driven monitoring sensors, inspection robots, virtual power plants and demand-response systems as components that widen the attack surface — citing ENISA's own 2019 Industry 4.0 Cybersecurity report. It lists outdated control systems, limited vendor/supplier cybersecurity culture, and remote operations and maintenance access as recurring root causes. The section points readers to ENISA's EU Cybersecurity Market Analysis – IoT in distribution grids and to the US National Renewable Energy Laboratory's Artificial Intelligence for Energy Systems Cybersecurity report as further sector-specific guidance, rather than prescribing a single OT-specific control list of its own.
Is this framework a standard, a certification scheme, or a legal requirement?
None of the three. ENISA describes the FAICP as a "scalable framework" and catalogue of existing good practices and standards (ISO/IEC 27000-series, the NIST AI Risk Management Framework, ENISA's own prior reports), not a new technical standard, a conformity-assessment scheme or a mandatory control baseline. The report's own stated motivation is to fill the gap until AI-specific harmonised standards under the EU AI Act are finished, since "standards development takes a long time, so they most likely will not be ready before the regulation enters into force." Its legal notice states it "does not endorse a regulatory obligation of ENISA," and its conclusions section explicitly calls for further research and additional practices rather than claiming the framework is complete.
In this cluster
Questions about this page?