EU AI Act Article 15 — Accuracy, Robustness and Cybersecurity

What Article 15 actually requires

Article 15 of Regulation (EU) 2024/1689 sets three intertwined requirements for high-risk AI systems: accuracy, robustness and cybersecurity. The system must be designed and developed to achieve appropriate levels of all three throughout its lifecycle, and these levels (with the relevant accuracy metrics) must be declared in the Article 13 instructions for use.

Reg text — Article 15(1): "High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness and cybersecurity, and that they perform consistently in those respects throughout their lifecycle."

The three pillars

• Accuracy. Article 15(3) requires accuracy levels and metrics to be declared. Annex IV(2)(b) requires metrics disaggregated across the persons or groups in relation to whom the system is intended to be used. Single-number accuracy is insufficient.
• Robustness. Article 15(4) requires resilience against errors, faults or inconsistencies that may occur in the system or the environment, including with regard to feedback loops where the system continues to learn after being placed on the market.
• Cybersecurity. Article 15(5) requires resilience against attempts by unauthorised third parties to alter behaviour or performance — data poisoning, model poisoning, model evasion, confidentiality attacks, prompt injection where applicable.

The Commission, in cooperation with relevant stakeholders and organisations such as ENISA, may develop benchmarks and measurement methodologies (Article 15(2)).

Who is covered

Providers design these properties into the system. Deployers exercise them through input-data quality (Article 26(4)) and operational monitoring (Article 26(5)).

What to do

• Run a validation suite that produces disaggregated metrics by demographic group on the validation and test sets.
• Run adversarial test campaigns before each release, covering at minimum data poisoning, model evasion, model extraction, membership inference, and (for LLM-based features) prompt injection. Document results in Annex IV §2(g).
• Implement drift monitoring in production tied to the Article 9 post-market loop.
• Document feedback-loop guards: continuous learning systems must be analysed for amplification of bias or drift.
• Cite the harmonised standards you align with — ISO/IEC 24029-2:2023 (robustness), ISO/IEC 27001 + sector-specific cybersecurity standards.

Inline crosswalk

• ISO/IEC 42001:2023 Annex A.6.2.4 — Verification and validation.
• ISO/IEC 42001:2023 Annex A.6.2.5 — Security of AI systems.
• NIST AI RMF MEASURE 2.5 — System is demonstrated to be valid and reliable.
• NIST AI RMF MEASURE 2.7 — System security and resilience are evaluated and documented.

Common mistakes

• Single-number accuracy. Article 15(3) + Annex IV(2)(b) require disaggregated metrics.
• Cybersecurity testing limited to web-app penetration testing. Article 15(5) wants ML-specific attack vectors.
• No drift monitoring after launch.
• Continuous-learning loops without bias amplification analysis.

Penalties

Article 99(4) — up to €15 million or 3% of worldwide annual turnover.

---

Disclaimer. Reference; not legal advice. Verify with counsel. Reg text from Regulation (EU) 2024/1689.