On 14 January 2026, the European Telecommunications Standards Institute (ETSI) announced ETSI EN 304 223, a European Standard (EN) that sets baseline cybersecurity requirements for AI models and systems.[1] ETSI's Technical Committee on Securing Artificial Intelligence produced the standard, which was adopted on 8 December 2025. It began as a technical specification, ETSI TS 104 223, published in April 2025.[2] ETSI names two UK bodies among the main contributors: the National Cyber Security Centre and the Department for Science, Innovation and Technology.[3]
The standard sets out 13 principles across five lifecycle phases, from secure design to secure end of life. For each principle, it names the stakeholders mainly responsible, such as developers, system operators and data custodians. It covers AI systems that incorporate deep neural networks, such as generative AI.[1, 2]
Several provisions concern the integrity and origin of models and data. Developers must release cryptographic hashes, or file fingerprints, for model components they make available to other stakeholders, so that recipients can verify that the components are authentic. Attackers plant poisoned training data to change a model's behavior. Such data is likely to be found only after training, if at all. So developers must document where any public training data came from and how they obtained it. The standard recommends recording at least the source, such as the URL of a scraped page, and the date and time of collection. The aim is to let a developer tell whether a reported poisoning attack reached its datasets. Developers should share their documentation, including training-data sources, with downstream system operators and data custodians.[2]
The standard's foreword set 30 September 2026 as the deadline for adopting or endorsing the EN nationally and for withdrawing conflicting national standards. The standard points to a separate specification, ETSI TS 104 216, for assessing conformance with its provisions.[2]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
aaad3dbe4c70d219ea499edc4f4fdf81052db8622d86970cdd08a6ad8d2cab01
