Overview
Severity: MEDIUM | Affected: European Union | Category: policy
The European Commission has officially adopted the final technical standards for Article 15 of the EU AI Act, establishing a mandatory red teaming and adversarial testing framework for all 'high-risk' AI systems deployed within the Union. Effective immediately, providers of such systems, including those in critical infrastructure, medical devices, and law enforcement, must conduct continuous, documented security assessments. The mandate specifies requirements for testing against a range of threats, including data poisoning, model evasion, prompt injection, and the extraction of sensitive training data. Companies must submit regular, audited reports of their red teaming findings to national supervisory authorities. Non-compliance carries severe penalties, with fines up to €20 million or 4% of a company's global annual turnover. This move is seen as a landmark step in shifting AI safety from a theoretical best practice to a legally enforceable requirement, setting a new global standard for AI security assurance and governance.