EU AI Act Article 15 — Accuracy, robustness, and cybersecurity
High-risk AI systems must achieve appropriate accuracy, robustness against errors, and cybersecurity resilience against adversarial attacks throughout their lifecycle
Where this comes from
Provision: Article 15 — Accuracy, robustness, and cybersecurity
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 15, Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Who it applies to
High-risk AI provider in scope — all of these:
- Service deploys AI systems in a professional capacity
- AI Act role is Provider or we provide some AI systems and deploy others
Annex III high-risk area (Art. 6(2)) — any one of these:
- Annex III high-risk areas includes Biometrics
- Annex III high-risk areas includes Critical infrastructure
- Annex III high-risk areas includes Education and vocational training
- Annex III high-risk areas includes Employment and worker management
- Annex III high-risk areas includes Essential public services
- Annex III high-risk areas includes Creditworthiness
- Annex III high-risk areas includes Insurance
- Annex III high-risk areas includes Law enforcement
- Annex III high-risk areas includes Migration, asylum and border control
- Annex III high-risk areas includes Administration of justice and democratic processes
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 6(2): the AI system falls within an area listed in Annex III and is therefore high-risk, no documented Art. 6(3) derogation applying (and it is ALWAYS high-risk where it performs profiling of natural persons)
- Art. 16(a) ('Providers of high-risk AI systems shall …'), read with Art. 3(3): the actor develops the system or has it developed and places it on the market or puts it into service under its own name or trade mark — or is its authorised representative under Art. 22
What engineering work it implies
- AI Risk Management File (Living Register with Release Thresholds)Covers part of it
A continuously-updated risk register under Article 9, with accuracy and robustness thresholds recorded per release under Article 15 and post-market monitoring hooks...
Sample acceptance criteria Landfall generates for this obligation:
- Accuracy metrics are defined per intended purpose and measured on a held-out set that is not the training set
- Measured accuracy is reported per relevant subgroup, not only in aggregate — an aggregate hides the group that fails
- The declared accuracy in the instructions for use equals the last measured value for the shipped version (Art. 15(3))
- Behaviour on out-of-distribution and adversarial input is tested, and the system degrades to a defined fail-safe rather than to a confident wrong answer (Art. 15(4))
- Feedback loops from outputs re-entering training are identified and broken or bounded (Art. 15(4), second subparagraph)
Evidence an auditor expects
- Test resultsTechnical auditReviewed before placing on the market, and on each substantial modification or retraining
Accuracy and robustness test results, with the metrics declared in the instructions for use (Art. 15(2)-(4))
Test report stating the accuracy metrics and levels achieved, the test population and its representativeness, performance consistency across the lifecycle, resilience to errors, faults and inconsistencies (including feedback-loop mitigation for systems that continue to learn after deployment), and any technical redundancy, backup or fail-safe measures. The declared levels and metrics must match those given in the Art. 13 instructions for use. Art. 15(2) leaves the measurement methodology to Commission-encouraged benchmarks and measurement methodologies — cite the benchmark used rather than asserting a bare number
- Test resultsThird-party audit
Cybersecurity resilience testing against AI-specific attacks (Art. 15(5))
Evidence of measures to prevent, detect, respond to, resolve and control attacks trying to manipulate the training data set (data poisoning), pre-trained components (model poisoning), inputs designed to cause the model to make a mistake (adversarial examples or model evasion), confidentiality attacks, and model flaws. Where a harmonised standard under Art. 40 is relied on, cite it
- Test resultsThird-party audit
Third-party adversarial test report (red-team / jailbreak / robustness), dated, with scope and findings
A dated report from a party independent of the build team stating: the scope tested (models, versions, endpoints, guardrails in place), the attack classes attempted (jailbreak and prompt injection, data and model poisoning, adversarial examples and evasion, confidentiality and extraction attacks), the method and the number of attempts, the findings with severity, and what was remediated or accepted with the person who accepted it. An undated report, or one with no stated scope, does not satisfy this requirement
Questions people ask
- Does EU AI Act Article 15 — Accuracy, robustness, and cybersecurity apply to my service?
- It applies when Service deploys AI systems in a professional capacity; AI Act role is Provider or we provide some AI systems and deploy others; and at least one of: Annex III high-risk areas includes Biometrics; Annex III high-risk areas includes Critical infrastructure; Annex III high-risk areas includes Education and vocational training; Annex III high-risk areas includes Employment and worker management; Annex III high-risk areas includes Essential public services; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance; Annex III high-risk areas includes Law enforcement; Annex III high-risk areas includes Migration, asylum and border control; Annex III high-risk areas includes Administration of justice and democratic processes. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 15 — Accuracy, robustness, and cybersecurity is enforceable from 2 August 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Accuracy and robustness test results, with the metrics declared in the instructions for use (Art. 15(2)-(4)); Cybersecurity resilience testing against AI-specific attacks (Art. 15(5)); Third-party adversarial test report (red-team / jailbreak / robustness), dated, with scope and findings.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.