ETSI EN 304 223 baseline cyber security for AI¶

This page covers ETSI_EN_304_223, a pack of 72 requirements taken from the provision numbers of ETSI EN 304 223 V2.1.1 (2025-12), clause 5. The standard is a voluntary baseline with no legal application dates. Nothing here is an audit, a certification or a legal assessment.

What it is¶

A native pack. Each row has the provision number as printed, a short heading and a one-line note in this project's own words, starting Evidence that. The standard's text is not reproduced; buy the standard for it. Links to the EU AI Act and ISO/IEC 27001 are the project's own judgement at low confidence.

Does it apply to you¶

The pack asks two questions in the manifest under framework_inputs.ETSI_EN_304_223: whether the organisation builds or operates an AI system rather than only buying a finished service, and whether a customer contract or internal policy commits it to this baseline. An answer of no to the first reads not applicable. A yes to the second reads applies. With no answers the pack reads voluntary. Confirm with your adviser.

How rows are decided¶

Every row takes a provider attestation. 49 of 72 requirements are checked from evidence as well: files and conventions in the repository corroborate the attestation. 23 of 72 are attestation only. The target is 38 of 72; the pack is above it. A scaffold left unfilled does not count as evidence. A row reads Met, Partial, Missing or Unverified.

Requirements¶

Scaffolds¶

Four starting documents are written into the repository on request: an AI threat model, a red-team report, an AI asset inventory and an end-of-life note. They have _fill in_ placeholders. Control templates cover secure design, development and operation. They are drafts, not legal advice.

Timeline¶

This pack has no timeline: a standard without legal application dates.

Gate in CI¶

opencomplai check --target ETSI_EN_304_223 --gate ETSI_EN_304_223 --gate-fail-on missing --repo-root .

The command exits 1 and lists the requirement ids when a row at the chosen level is found.

What stays attested and why¶

23 rows have no evidence a tool can read, and only a person can vouch for them. They cover:

• Awareness: staff stay current on AI threats, through several channels (5.1.1-2, 5.1.1-2.1).
• Design decisions and roles: the data owner joins requirements talks, use fits data sensitivity, staff are encouraged to flag risks, least privilege on connected systems (5.1.2-1.1, 5.1.2-5, 5.1.2-5.1, 5.1.2-6).
• Risk handed on or received: surplus model capability, unresolved threats passed down the chain, assurance from external risk owners (5.1.3-1.2, 5.1.3-2, 5.1.3-3).
• Human responsibility: outputs easy to judge, the data owner's controls checked (5.1.4-2, 5.1.4-4).
• Assets and infrastructure: sensitive data protected, data and inputs checked, access control (5.2.1-4, 5.2.1-4.1, 5.2.2-1).
• Supply chain and testing: mitigations and justification shared, advance notice of model updates, test findings shared (5.2.3-2.1, 5.2.3-2.2, 5.2.3-4, 5.2.5-3).
• Communication, updates and monitoring: security-relevant updates announced, users supported after an incident, fallbacks, help evaluating model changes, monitoring internal states (5.3.1-2.2, 5.3.1-3, 5.4.1-1.1, 5.4.1-3, 5.4.2-3).

Review status¶

Every row is flagged mapping not yet reviewed. No flag has been cleared.

Disclaimer¶

Evidence found gives Met, Partial or Missing, not a legal conclusion. This pack is not an audit, a certification or legal advice; ask a qualified lawyer about your own duties.