EU AI Act Art.15: Accuracy, robustness and cybersecurity
EU AI Act Article 15 (Accuracy, robustness and cybersecurity) binds the providers. This page states what the article requires, who it binds, the evidence to keep and the NIST AI RMF and ISO/IEC 42001 controls behind it, cited to the article. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.15 |
| Binds | Providers |
| Group | High-Risk Classification and Requirements |
| Evidence items | 3 |
| Linked NIST AI RMF controls | 4 |
| Linked ISO/IEC 42001 controls | 0 |
| Last updated |
Who does Art.15 bind?
The article binds the providers. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.15 require?
High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and shall perform consistently in those respects throughout their lifecycle. Resilience to errors, faults and inconsistencies; protection against attempts by unauthorised third parties to alter use, output or performance (incl data poisoning, model poisoning, adversarial examples and confidentiality attacks).
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.15 (the consolidated Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.15?
| Category | Evidence to keep |
|---|---|
| Accuracy | Accuracy/robustness measurements relevant to the intended purpose |
| Accuracy | Adversarial/data-poisoning threat modelling and mitigation |
| Accuracy | Cybersecurity controls aligned with state-of-the-art |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.15?
4 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-MS-1.1 | Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks, and the risks or trustworthiness characteristics that will not or cannot be measured are properly documented Declared accuracy metrics are selected metrics but unmeasurable characteristics are not recorded. | medium |
AIRMF-MS-2.5 | The AI system to be deployed is demonstrated to be valid and reliable, and limitations of the generalizability beyond the conditions under which the technology was developed are documented Achieving and consistently performing at an appropriate level of accuracy is the validity and reliability limb. | high |
AIRMF-MS-2.6 | AI system is evaluated regularly for safety risks as identified in the MAP function, is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits Resilience to errors, faults and inconsistencies is the safe-failure and robustness evaluation. | high |
AIRMF-MS-2.7 | AI system security and resilience as identified in the MAP function are evaluated and documented Protection against data poisoning, model poisoning, adversarial examples and confidentiality attacks. | high |
Which ISO/IEC 42001 controls line up with Art.15?
No ISO/IEC 42001 control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
What does the conformance kit add for Art.15?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.