AI presents a dilemma  to cybersecurity as it can be applied both by attackers to exploit vulnerabilities  faster than ever and by defenders to enhance security, making it both a formidable threat and a powerful cure. The AI Act requires companies to strengthen their cybersecurity posture while in adapting and operating the technology safely.

The AI Act, introduced by the European Union (EU), is a landmark legislative framework designed to regulate the development and deployment of artificial intelligence (AI) technologies. Officially entering into force on 1 August 2024 with full applicability expected by 2 August 2026, the AI Act aims to ensure that AI systems are safe, transparent, and accountable. This comprehensive legislation addresses various aspects of AI, with a significant emphasis on enhancing cybersecurity measures for companies that build and operate high-risk AI technologies.   

The primary objectives of the AI Act are to: 

  • Ensure AI systems are safe and respect existing laws and fundamental rights. 
  • Enhance transparency and accountability in AI use. 
  • Promote trustworthy AI systems for businesses and consumers. 
  • Require robust cybersecurity measures to protect data and mitigate associated risks. 

The AI Act underscores the importance of cybersecurity by mandating rigorous standards to protect data integrity and prevent misuse.  

DNV Cyber supports organisations in the secure and compliant development, implementation and operation of AI systems. We aid in understanding and interpretation of the requirements of the AI Act and provide practical advise and guidance how this translates into business adaptation and technology implementation. Whether your organization is developing or acquiring AI systems, our cybersecurity experts ensure they meet the expected standards. Additionally, our experts provide technical security testing and assessments for all organizations utilizing AI solutions.

Cybersecurity opportunities and challenges introduced by AI systems 

AI technology can support cybersecurity measures by identifying and mitigating threats more effectively, while it simultaneously introduces new vulnerabilities. Organizations must navigate this duality, leveraging AI’s benefits for enhanced security while addressing the associated risks through stringent protocols and continuous monitoring. 

AI systems can introduce new and complex cybersecurity challenges. These include: 

  • Data breaches to systems operating AI: AI systems often process large volumes of sensitive data, making their supporting systems attractive targets for cyberattacks. Unauthorized access to this data can lead to significant breaches of privacy and security, and could compromise the functionality of AI system.
  • Manipulation of AI algorithms and its sensors: Malicious actors can exploit vulnerabilities in AI algorithms and poison the input data to manipulate their behaviour, leading to biased or erroneous outcomes. This can have serious implications, especially in sectors dealing with critical infrastructures such as healthcare, energy and finance. 
  • Jailbreaking: Malicious actors may try to bypass the guardrails of AI systems, causing them to leak confidential data, like credentials or Personally Identifiable Information (PII), or to manipulate their decision-making, for example in case of AI agents.
  • Enabling effective frauds and phishing: Adversaries can use generative AI to create deepfake phishing attacks, intelligent access abuse, and other sophisticated frauds. 

Essential measures to enhance cybersecurity with AI systems 

  • Risk Assessments and mitigation: Companies must conduct comprehensive risk assessments to identify potential cybersecurity threats associated with their AI systems. Based on these assessments, they must implement appropriate mitigation measures to safeguard against these risks.
  • Robust Data Protection: The Act mandates stringent data protection protocols to ensure the integrity and confidentiality of the data processed by AI systems. This includes encryption, access controls, and regular security audits.
  • Incident monitoring and response: Organizations are required to establish continuous monitoring mechanisms to detect and respond to cybersecurity incidents promptly. This involves setting up dedicated teams for incident management and response.
  • Accountability and transparency: The AI Act emphasizes the need for transparency in AI operations. Companies must document and report the security measures they have implemented, making this information available to regulators and stakeholders.
  • Third-party audits: To ensure compliance with the AI Act, companies must undergo regular third-party audits of their AI systems. These audits assess the effectiveness of the implemented cybersecurity measures and identify areas for improvement.
  • Supply chain security: The Act also extends its cybersecurity requirements to the supply chain, requiring companies to ensure that their suppliers and partners adhere to the same standards of data protection and security. 

By mandating these comprehensive cybersecurity measures, the AI Act aims to create a secure and trustworthy environment for the deployment and use of AI technologies within the EU. These requirements not only protect data integrity and prevent misuse but also foster confidence in AI systems among businesses and consumers alike. 

By adhering to the AI Act, organizations can confidently leverage AI technologies while ensuring robust cybersecurity measures. For expert guidance and support in navigating AI adaption, contact DNV Cyber to secure your AI systems and achieve compliance.