Attacking Your AI: New Cyber Security Obligations Under The EU's AI Act

With the EU's AI Act expected to be published in the Official Journal imminently (20 days after which, the Act will come into force), those designing, developing, and/or deploying AI will need to start getting to grips with the myriad of new obligations - even if some may not apply for another 3 years!

We've previously set out a comprehensive overview of the AI Act but whilst some obligations will look familiar (e.g. broad transparency obligations) there are others which in addition to being somewhat novel are far more explicit. One such group of obligation includes the requirements of Article 15 relating to accuracy, robustness, and cybersecurity. Among other cyber security requirements, Article 15(5) also introduces a requirement for High Risk systems to be "resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities". There is some element of proportionality in the obligation, which