EU AI Act cybersecurity requirements, explained

The EU AI Act, Regulation (EU) 2024/1689, sets a dedicated cybersecurity duty for AI systems the Regulation classifies as "high-risk" and a parallel one for the largest general-purpose AI (GPAI) models. Per the Regulation's own Article 15, high-risk AI systems must "achieve an appropriate level of accuracy, robustness, and cybersecurity" and stay resilient "throughout their lifecycle" against named AI-specific attacks — data poisoning, model poisoning, adversarial examples and confidentiality attacks. Providers of GPAI models with "systemic risk" get a separate, narrower duty under Article 55(1)(d): "ensure an adequate level of cybersecurity protection" for the model itself and its physical infrastructure. This guide covers both duties, who they apply to, when they bite after a mid-2026 amendment reshuffled the dates, and how two existing certification routes — Cyber Resilience Act compliance and EUCC certification — can carry over.

Article 15: accuracy, robustness and cybersecurity for high-risk AI systems

Article 15 is structured as a lifecycle obligation, not a one-time check:

• Para. 1 sets the top-level standard: an "appropriate level" of accuracy, robustness and cybersecurity, maintained consistently "throughout their lifecycle" — not just at the point of CE marking.
• Para. 3 requires accuracy levels and the metrics used to measure them to be declared in the system's instructions for use.
• Para. 4 covers robustness against errors, faults and inconsistencies, including — for systems that keep learning after deployment — measures against biased-output feedback loops.
• Para. 5 is the cybersecurity paragraph proper: high-risk systems must be "resilient against attempts by unauthorised third parties to alter their use, outputs or performance," with technical measures that address, "as appropriate," data poisoning, model poisoning, adversarial examples and attacks that try to extract confidential model or training data.

Which systems this applies to is answered by Article 6 and Annex III. Annex III lists eight high-risk areas — biometrics; critical-infrastructure safety components; education; employment/worker management; access to essential private and public services; law enforcement; migration, asylum and border control; and administration of justice and democratic processes. A separate track, Article 6(1) with Annex I, covers AI that is a safety component of a product already regulated elsewhere in EU product law (machinery, medical devices, toys, lifts); this track runs on a slower compliance clock, covered below.

Article 55: cybersecurity for systemic-risk GPAI models

A second, narrower cybersecurity duty sits in Chapter V, aimed at providers of general-purpose AI models the Act treats as carrying "systemic risk" (broadly, the most capable foundation models, assessed partly against a compute threshold). Article 55(1) layers four extra obligations on top of the baseline GPAI duties in Articles 53-54: standardised adversarial-testing model evaluation, Union-level systemic-risk assessment and mitigation, serious-incident reporting to the AI Office, and — in Article 55(1)(d) — a duty to "ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model." Article 55(2) lets providers demonstrate compliance through an AI Office-endorsed code of practice until harmonised standards exist.

The deadline that moved: 2026 became 2027/2028

Article 113, as originally enacted, set a single general application date of 2 August 2026 for Chapter III's high-risk rules (which carry Article 15). That changed: Regulation (EU) 2026/1744, the "Digital Omnibus on AI," published in the Official Journal on 24 July 2026 and in force from 27 July 2026, amended Article 113(c) to split and delay that date — reportedly because harmonised standards supporting Article 15 and the rest of Chapter III were not ready in time. The amended timeline, as reported consistently by the European Commission's own AI Act policy page and multiple law-firm trackers following the Official Journal text:

Date	What applies
1 August 2024	AI Act enters into force (20 days after 12 July 2024 OJ publication)
2 February 2025	Chapters I-II: Article 5 prohibited practices (most) and AI-literacy duties
2 August 2025	Chapter III Section 4, Chapter V (incl. Article 55 GPAI cybersecurity), Chapter VII, Chapter XII, Article 78
27 July 2026	Articles 102-110 (AI Office governance)
2 December 2026	The two Article 5 prohibited-practice points added by the Digital Omnibus
2 December 2027	Chapter III Sections 1-3 (incl. Article 15) for Annex III high-risk systems
2 August 2028	Chapter III Sections 1-3 (incl. Article 15) for Annex I high-risk (product-embedded) systems

What the Digital Omnibus left untouched: the Article 5 prohibitions already in force since 2 February 2025, and the GPAI provider obligations under Chapter V — meaning Article 55's cybersecurity duty for systemic-risk models has already applied since 2 August 2025, well ahead of the delayed Article 15 dates for high-risk systems generally.

Two certification routes that can carry over: Article 42

A provider does not necessarily have to build an Article 15 cybersecurity case from scratch. Article 42 gives two presumption-of-conformity routes:

1. Article 42(2) — Cybersecurity Act certification. A high-risk AI system certified, or covered by a statement of conformity, under an EU cybersecurity certification scheme adopted under Regulation (EU) 2019/881 (the Cybersecurity Act) — such as the EUCC scheme — is presumed to meet Article 15's cybersecurity requirements, to the extent the certificate's scope covers them. See our EUCC / Common Criteria guide.
2. Article 42(3) with CRA Article 12 — Cyber Resilience Act compliance. Where a product with digital elements is both in scope of the Cyber Resilience Act (Regulation (EU) 2024/2847) and classified as a high-risk AI system, CRA Article 12(1) deems it compliant with AI Act Article 15 once the manufacturer (a) meets the CRA's Annex I Part I essential cybersecurity requirements, (b) runs the Annex I Part II vulnerability-handling processes, and (c) records that achievement in the CRA's EU declaration of conformity. CRA Article 12(2) then substitutes the AI Act's own Article 43 conformity-assessment procedure for the CRA's standard one. CRA Article 12(3) carves out an exception: products also listed as "important" (Annex III) or "critical" (Annex IV) under the CRA keep the CRA's stricter, CRA-specific conformity-assessment route even when otherwise eligible for the bridge. See our Cyber Resilience Act guide for the Annex I baseline this depends on.

For a device or firmware maker already building to CRA Annex I, this is the practical takeaway: the cybersecurity engineering work largely overlaps, and the CRA declaration of conformity — not a separate AI-specific cybersecurity dossier — is what Article 12 asks for.

A workable starting point

1. Classify first. Determine whether your system is in scope of Annex III (stand-alone high-risk use case) or Article 6(1)/Annex I (embedded in an already-regulated product) — the compliance clock differs by two years between the two.
2. Treat Article 15(5)'s named attacks as a checklist, not an afterthought. Data poisoning, model poisoning, adversarial examples and confidentiality attacks are the specific technical scope the article names; general IT security controls alone will not demonstrate compliance.
3. Check for an existing bridge before building new paperwork. If the product is also a CRA-scope product with digital elements, or already holds an EUCC-type certificate, map what Article 42 and CRA Article 12 let you reuse before starting an AI Act-specific cybersecurity assessment.
4. Track the amended dates, not the original ones. 2 August 2026 is no longer the operative date for Article 15 obligations on most high-risk systems — 2 December 2027 (Annex III) and 2 August 2028 (Annex I) are, following Regulation (EU) 2026/1744.
5. If you provide a GPAI model, don't wait for the high-risk dates. Article 55's cybersecurity duty for systemic-risk models has applied since 2 August 2025 regardless of the Digital Omnibus delay to Chapter III.

SoftWSP's firmware and device security work produces the kind of vulnerability-handling evidence and conformity documentation that both the CRA's Annex I and the AI Act's Article 42/Article 12 bridge expect: see Device & Firmware Security.

This guide summarises Regulation (EU) 2024/1689 and its amending Regulation (EU) 2026/1744 as published in the Official Journal, cross-checked against the European Commission's own AI Act policy page; it is not legal advice.