New ETSI standard sets AI security baseline for businesses

As AI becomes ever more embedded in business processes, security has become a critical concern. A new European standard, ETSI EN 304 223, aims to address it by setting baseline security requirements for AI systems. Developed by the European Telecommunications Standards Institute (ETSI), it is the first global standard of its kind for AI cybersecurity, and it marks an important step toward the responsible and secure use of machine learning technologies.

ETSI EN 304 223 lays out specific provisions for protecting AI models and systems against a range of threats, including unauthorized access, data manipulation, and other types of attacks. It is designed to plug into existing corporate governance and security compliance frameworks across the entire AI lifecycle, from development through deployment and operation. The standard's importance is hard to overstate, given businesses' growing reliance on AI and the potential risks of its misuse or malicious use. Without clear security standards, companies can face leaks of confidential data, financial losses, and reputational damage.

The new standard covers a broad range of AI security areas, including identification and authentication, access control, data protection, monitoring, and incident response. It also sets requirements for staff training and awareness of AI security risks. It pays particular attention to protecting machine learning models, a core component of any AI system. Attackers may try to compromise models to gain unauthorized access to data, alter a system's behavior, or make it fail. ETSI EN 304 223 offers guidance on defending models against such attacks, including cryptographic methods, differential privacy techniques, and other advanced technologies.

Adopting ETSI EN 304 223 will require companies to rethink how they develop and operate AI. They will need to run risk assessments, design and implement appropriate security measures, and ensure ongoing monitoring and auditing of their AI systems. This may require significant investment, but that investment is justified given the potential benefits of more secure and reliable AI systems. Compliance with ETSI EN 304 223 could become a meaningful competitive advantage, showing that a company is committed to responsible and secure AI use.

ETSI EN 304 223 also has important implications for AI regulation. The standard could serve as the basis for new laws and rules aimed at ensuring the security and reliability of AI systems. The European Union is already considering using ETSI EN 304 223 as one of the key standards for assessing compliance with the security requirements set out in the AI Act. As a result, companies operating in the European market could be required to comply with ETSI EN 304 223 in order to get approval to use their AI systems.

In short, the new ETSI EN 304 223 standard is an important step toward secure and reliable AI. It gives companies concrete guidance on protecting their AI systems against a range of threats and could become the foundation for new laws and regulations. Implementing it will take considerable effort, but that effort is justified given the potential benefits of more secure and reliable AI systems. Going forward, other countries and regions can be expected to start developing and adopting their own AI security standards, drawing on best practices from ETSI and other organizations.