ETSI EN 304 223: The New Global Standard for AI Cybersecurity and Supply Chain Risk Management

Executive Summary

Publication Date: January 19, 2026 The release of ETSI EN 304 223 marks a pivotal advancement in the field of AI cybersecurity, establishing the first globally applicable European Standard for securing AI models and systems. This standard introduces a comprehensive, lifecycle-based approach to AI security, addressing the unique risks and challenges posed by modern AI technologies, including deep neural networks and generative AI. By setting baseline security requirements for all stakeholders in the AI supply chain, ETSI EN 304 223 aims to fortify AI systems against increasingly sophisticated cyber threats and to harmonize security practices across international markets.

Introduction

The rapid proliferation of AI technologies has introduced new vectors for cyber threats, necessitating robust and standardized security measures. ETSI EN 304 223 responds to this need by providing a structured framework for AI security that spans the entire lifecycle of AI systems. This report delves into the technical and practical aspects of the standard, its implications for industry stakeholders, and its role in shaping the future of AI cybersecurity.

Technical Details and Core Functionality

ETSI EN 304 223 establishes a robust framework that integrates established cybersecurity best practices with innovative, AI-specific security measures. The standard defines thirteen principles and requirements distributed across five key phases of the AI lifecycle: secure design, secure development, secure deployment, secure maintenance, and secure end-of-life. Each phase is aligned with internationally recognized AI lifecycle models, ensuring consistency and interoperability with existing standards and guidance. The standard is applicable to a wide range of AI systems, including those utilizing deep neural networks and generative AI, and is designed for real-world deployments.

Key Innovations and Differentiators

A defining feature of ETSI EN 304 223 is its lifecycle-based approach, which sets minimum security requirements for all stakeholders in the AI supply chain, not just those managing high-risk systems. This comprehensive scope ensures that security is embedded at every stage of the AI lifecycle, from initial design to decommissioning. The standard references relevant international standards and publications, supporting harmonization and interoperability within the broader AI ecosystem. Its approval by National Standards Organisations further extends its authority and applicability across global markets.

Security Implications and Potential Risks

The standard recognizes that AI systems introduce distinct cybersecurity challenges not present in traditional software. Among the risks addressed are data poisoning, model obfuscation, indirect prompt injection, and vulnerabilities arising from complex data management and operational practices. By mandating baseline security controls for these risks, ETSI EN 304 223 aims to reduce the attack surface and enhance the resilience of AI systems against both known and emerging threats.

Supply Chain and Third-Party Dependencies

ETSI EN 304 223 is designed to support all participants in the AI supply chain, including vendors, integrators, and operators. The standard provides a clear and logical baseline for AI security, ensuring that every party involved in the development, deployment, and operation of AI systems considers security as a fundamental requirement. This approach is instrumental in mitigating risks introduced by third-party components, data sources, and operational dependencies, thereby strengthening the overall security posture of the AI ecosystem.

Security Controls and Compliance Requirements

The standard sets out minimum-security measures that must be implemented across the entire AI lifecycle. These measures address high-risk threats such as data poisoning, model manipulation, indirect prompt injections, and operational differences associated with data management. ETSI EN 304 223 builds on previous technical specifications and guidance, with a conformity assessment currently in development to support consistent and verifiable implementation.

Industry Adoption and Integration Challenges

The formal approval of ETSI EN 304 223 by National Standards Organisations has given it a global scope, reinforcing its authority and encouraging widespread adoption. Efforts by organizations such as the Department for Science, Innovation and Technology (DSIT) are underway to raise awareness and promote good cyber practices across industry sectors. However, integration challenges remain, particularly for organizations with complex supply chains or legacy AI systems that may require significant adaptation to meet the new requirements.

Vendor Security Practices and Track Record

The standard mandates that all parties in the AI supply chain, including vendors, adopt a lifecycle approach to security. By referencing established best practices and requiring continuous security consideration from design through end-of-life, ETSI EN 304 223 ensures that AI systems are resilient, trustworthy, and secure by design. This approach not only enhances the security of individual systems but also contributes to the overall trustworthiness of the AI ecosystem.

Technical Specifications and Requirements

Each principle within ETSI EN 304 223 is supported by references to relevant international standards and publications, facilitating implementation and harmonization. The standard is applicable to AI systems incorporating advanced technologies such as deep neural networks and generative AI, and is specifically developed for systems intended for real-world deployment. This ensures that the requirements are both practical and effective in addressing the unique challenges of modern AI.

Cyber Perspective

From a cyber perspective, ETSI EN 304 223 represents a significant advancement in the standardization of AI security. For defenders, the standard provides a clear and actionable framework to secure AI systems against a spectrum of sophisticated threats, including data poisoning and prompt injection. The lifecycle and supply chain focus ensures that both direct and indirect risks, such as those introduced by third-party components or data sources, are addressed, reducing the likelihood of successful supply chain attacks. For attackers, the standard raises the bar, making it more challenging to exploit AI-specific vulnerabilities, though it may also highlight new attack surfaces as organizations work to achieve compliance. In the marketplace, adoption of ETSI EN 304 223 is poised to become a competitive differentiator, with customers and regulators increasingly expecting compliance as a baseline for trust in AI systems.

About Rescana

Rescana empowers organizations to navigate the complexities of third-party risk management in the context of AI and supply chain security. Our platform delivers continuous monitoring, risk assessment, and compliance tracking for your vendors and third-party technologies, ensuring that your supply chain aligns with the latest security standards. With Rescana, you gain comprehensive visibility into your extended ecosystem, enabling you to identify, assess, and mitigate risks before they impact your business.

We are happy to answer any questions at ops@rescana.com.