Security

AI-related objective: The AI system, its data and models are protected against AI-specific threats such as data poisoning, adversarial input, model extraction and inference attacks, as well as conventional threats. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). Read security against the objective the use threatens most.

What it asks

AI-related objective: The AI system, its data and models are protected against AI-specific threats such as data poisoning, adversarial input, model extraction and inference attacks, as well as conventional threats. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).

Where generative AI changes the answer

Security for generative AI has to cover the prompt as an attack surface and the tool integration as a path out of the system.

Reading it in practice

Security for a generative AI system has to treat the prompt as an input from an untrusted source and every connected tool as a route out. The evidence an auditor samples is a threat model that includes prompt injection, data exfiltration through tool calls and model or corpus supply chain compromise, with the test results that show what the system actually resisted.

Who it binds

The AI risk owner, with the objective owner named in the risk treatment plan. For A.11 the named role is the owner of AI-specific threat assessment and security controls.

Evidence an auditor normally samples

• AI-specific threat assessment and security controls

The test you can run

Ask for AI-specific threat assessment and security controls and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Threat model limited to conventional application security

Before the draft publishes

For A.11, pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published. The first artefact to produce is AI-specific threat assessment and security controls.

Where this sits against the draft

A.11 carries the annex a: ai-related objectives part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on A.11 (security) with this record and note the change in the register.