AI Security Standards & Regulations
Global frameworks and legal requirements for AI system security
Compliance Landscape
These standards form the basis for lawful and ethical AI security testing practices
NIST AI RMF
GlobalRisk Management
Risk management framework for trustworthy AI
- Governance, mapping, measurement, and management
- Voluntary but widely adopted
Pentesting Implications:
- Align tests with framework mappings
- Document risk measurement approaches
EU AI Act
EuropeRegulation Enforcement: Aug 2, 2026
First comprehensive AI law - fines up to €35M
- Risk-based classification (4 tiers)
- High-risk AI obligations: August 2, 2026
Pentesting Implications:
- Conformity assessments required
- Technical documentation mandatory
ISO/IEC 23053
GlobalStandard
Standard for ML engineering
- Development and deployment processes
- System documentation requirements
Pentesting Implications:
- Verify development process compliance
- Check documentation completeness
OWASP LLM Top 10
GlobalGuidelines
Top LLM security risks
- Prompt injection (#1 risk)
- Training data poisoning
Pentesting Implications:
- Prioritize testing for Top 10 vulnerabilities
- Use provided mitigation guidance
NIST AI RMF Documentation Requirements
What documentation does NIST AI RMF 1.1 require for AI risk management compliance?
Govern Documentation
- AI risk management policy
- Roles, responsibilities & accountability matrix
- AI ethics and transparency commitments
- Third-party AI vendor risk policy
Map Documentation
- AI system inventory & use case registry
- Business context & impact assessments
- Data lineage & model provenance records
- Stakeholder mapping & engagement logs
Measure Documentation
- AI risk assessment reports
- Model testing & validation results
- Bias evaluation & fairness metrics
- Security penetration test findings
Manage Documentation
- Risk treatment plans & risk register
- Incident response & recovery procedures
- Continuous monitoring dashboards
- Audit trail & compliance evidence
Organizations seeking NIST AI RMF compliance should maintain these documents as living artifacts, updated throughout the AI system lifecycle. Proper documentation is also a mitigating factor under the EU AI Act (up to €35M fines).
Compliance Framework Mapping
| Requirement | NIST | EU AI Act | ISO 23053 |
|---|---|---|---|
| Risk Assessment | Core | Required | Recommended |
| Data Governance | Core | Required | Required |
| Security Testing | Core | High-Risk | Recommended |
| Documentation | Core | Required | Required |
EU AI Act: Enforcement Timeline 2026
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI legal framework.
February 2025
Prohibited AI practices banned
August 2025
GPAI obligations live
August 2, 2026
High-risk AI obligations enforceable
August 2027
Annex I HRAI systems deadline
Key Compliance Requirements
Fines
- Up to €35M or 7% of global turnover
- Documented compliance = mitigating factor
High-Risk AI Systems
- Conformity assessments required
- Technical documentation mandatory
- Risk management systems
Source: EU AI Act Compliance Guide 2026
AI Security Training
Explore certifications and training programs to build your AI security skills.
View Certifications →Legal Considerations
- Jurisdictional requirements
- Data protection laws
- Intellectual property rights
- Liability frameworks
Legal Considerations
- Jurisdictional requirements
- Data protection laws
- Intellectual property rights
- Liability frameworks