Governing Artificial Intelligence in a High-Risk Digital Environment
The EU Artificial Intelligence Act (AI Act) is the European Union’s first comprehensive legal framework regulating the development, deployment, and use of artificial intelligence systems.
It introduces a risk-based regulatory approach, meaning that obligations depend on the level of risk an AI system poses to health, safety, and fundamental rights.
While the AI Act is primarily focused on governance, transparency, and accountability, it has direct and growing implications for cybersecurity. AI systems can both introduce new attack surfaces and become tools used by cybercriminals to increase the scale and sophistication of attacks.
As organizations increasingly integrate AI into business processes, cybersecurity and AI governance are becoming deeply interconnected.
What Is the EU AI Act?
The EU AI Act entered into force in 2024 and is being implemented progressively across Member States.
It applies to:
- Providers of AI systems
- Deployers of AI systems
- Importers and distributors of AI-enabled products
- Providers of foundation models and general-purpose AI systems
The regulation categorizes AI systems into four risk levels:
- Unacceptable risk (prohibited systems)
- High-risk systems
- Limited-risk systems
- Minimal-risk systems
Higher-risk systems are subject to stricter obligations, including risk management, data governance, transparency, and human oversight requirements.
Why AI Creates New Cybersecurity Risks
AI introduces new cybersecurity challenges that differ from traditional IT risks. These risks arise not only from the AI models themselves but also from their integration into broader digital ecosystems.
Key risk drivers include:
- Increased automation of decision-making processes
- Large-scale data processing and dependency on data quality
- Integration with cloud and API-based systems
- Rapid adoption without mature governance structures
- Limited visibility into model behavior and training data
As AI becomes embedded in critical business functions, it expands the potential attack surface of organizations.
AI as a Target for Cyberattacks
AI systems themselves can be targeted by attackers in several ways:
Data Poisoning
Attackers manipulate training data to influence model outputs, potentially introducing bias or malicious behavior.
Model Evasion Attacks
Adversarial inputs are designed to mislead AI models, causing incorrect classifications or decisions.
Model Extraction
Attackers attempt to reconstruct or replicate proprietary AI models by querying them repeatedly.
Prompt Injection (Generative AI Systems)
Malicious inputs manipulate generative AI systems into producing unintended or harmful outputs.
Supply Chain Vulnerabilities
AI systems often rely on third-party datasets, models, and APIs, increasing exposure to external risks.
AI as a Tool for Cybercrime
Cybercriminals are increasingly leveraging AI to enhance the effectiveness and scale of attacks.
Common uses include:
- Automated phishing campaigns with highly personalized content
- AI-generated social engineering messages
- Rapid identification of system vulnerabilities
- Malware development and obfuscation
- Deepfake-based fraud and impersonation
- Automated reconnaissance of target systems
These capabilities reduce the technical barriers for attackers and increase the speed and sophistication of cyber threats.
Cybersecurity Implications of the AI Act
While the AI Act is not a cybersecurity regulation in the traditional sense, it introduces several security-relevant obligations.
Risk Management Requirements
Providers of high-risk AI systems must implement a continuous risk management system that includes:
- Identification of foreseeable risks
- Evaluation of system performance and safety
- Mitigation measures for known vulnerabilities
- Monitoring throughout the system lifecycle
Data Governance and Quality
AI systems must be trained on datasets that are:
- Relevant and representative
- Free from bias where possible
- Securely managed and controlled
- Properly documented
Poor data governance can introduce both security and compliance risks.
Technical Robustness and Security
AI systems must be designed to ensure:
- Resistance to manipulation and attacks
- Accuracy and reliability under expected conditions
- Secure handling of inputs and outputs
- Protection against unauthorized access
Human Oversight
High-risk systems must include mechanisms that allow human intervention where necessary, particularly in critical decision-making processes.
Intersection Between AI and Cybersecurity Regulations
The AI Act interacts with several existing EU cybersecurity frameworks:
- NIS2 Directive: organizational cybersecurity and incident management
- DORA: operational resilience in financial services
- CRA: secure-by-design requirements for AI-enabled products
- GDPR: data protection and privacy governance
Together, these regulations create a multi-layered compliance environment where AI systems must be both secure and legally governed across multiple dimensions.
Common Challenges in AI Security Governance
Organizations adopting AI often face challenges such as:
- Lack of AI-specific cybersecurity controls
- Limited visibility into model behavior and dependencies
- Insufficient governance frameworks for generative AI
- Shadow AI usage across business units
- Weak integration between AI development and security teams
- Inadequate monitoring of third-party AI services
A common misconception is that AI tools provided by major vendors are inherently secure and compliant. In reality, organizations remain responsible for how AI systems are used, integrated, and governed.
ISO Standards Supporting AI Governance
Several ISO standards support AI governance and cybersecurity alignment:
ISO/IEC 42001
Provides a structured AI management system framework covering:
- AI governance structures
- Risk management processes
- Lifecycle controls
- Continuous monitoring and improvement
ISO/IEC 27001
Supports underlying information security governance and control frameworks.
ISO/IEC 23894
Provides guidance on AI risk management practices.
Together, these standards help organizations operationalize AI governance in alignment with regulatory expectations.
Managing AI-Related Cyber Risks
Organizations can reduce AI-related cybersecurity risks through structured controls, including:
- AI usage policies and governance frameworks
- Approved AI tool catalogs and access restrictions
- Strong identity and access management (IAM)
- Multi-factor authentication for critical systems
- Data classification and protection policies
- Continuous monitoring of AI system behavior
- Employee awareness and training programs
Security must be integrated into AI adoption from the outset rather than added after deployment.
How Intertek Can Help
Intertek supports organizations in managing AI-related cybersecurity and regulatory risks through structured assessment, advisory, and governance services.
AI Act Readiness Assessments
Evaluate AI systems against EU AI Act requirements and identify compliance gaps.
AI Governance Framework Development
Support the design of structured AI management systems aligned with ISO/IEC 42001 and regulatory expectations.
AI Cybersecurity Risk Assessments
Identify vulnerabilities in AI systems, including data, model, and integration risks.
AI Usage Policy Development
Assist organizations in defining safe and compliant AI usage across business functions.
ISO/IEC 42001 Implementation Support
Help organizations establish formal AI management systems with governance, risk management, and monitoring processes.
Integrated Cybersecurity Advisory
Align AI governance with broader cybersecurity frameworks including NIS2, DORA, CRA, and ISO/IEC 27001.
Building Secure and Trustworthy AI Systems
The adoption of artificial intelligence presents both significant opportunities and emerging risks. Organizations that implement strong governance, cybersecurity controls, and regulatory alignment will be better positioned to leverage AI safely and responsibly.
The EU AI Act marks a shift toward accountable AI systems, where security, transparency, and human oversight are central to system design and operation.
Talk to Intertek
Intertek helps organizations navigate the evolving AI regulatory landscape through practical cybersecurity assessments, governance frameworks, and ISO-aligned advisory services.
Contact our specialists to assess your AI risk exposure and strengthen your AI governance and cybersecurity posture.
