EU AI Act's Robustness Rules Need Clearer Standards, Research Shows

A new paper from researchers examining the EU Artificial Intelligence Act (AIA) has identified significant shortcomings in how the regulation addresses robustness and cybersecurity for AI systems.

The Regulatory Gap#

The EU's landmark AI legislation sets out different legal obligations depending on the riskiness of an AI system. However, most policy scrutiny has focused on transparency and accountability rules. The provisions dealing with robustness and cybersecurity—particularly for high-risk systems and general-purpose AI models—have received far less attention, despite their importance to safe AI deployment.

The researchers found that the current legal language in Articles 15 and 55 of the AIA lacks sufficient clarity and specificity when it comes to what robustness and cybersecurity actually mean in practice, and how organizations should demonstrate compliance.

What Robustness Really Requires#

Both robustness and cybersecurity, the paper argues, ultimately demand that AI systems remain reliable and performant even when under stress or attack. This goes beyond simply preventing data breaches—it means ensuring the AI itself doesn't degrade dangerously when faced with unexpected inputs, malicious actors, or system disruptions.

Bridge Between Law and Technology#

The analysis draws on recent advances in machine learning research to assess how feasible it is to implement these regulatory provisions. The authors highlight a critical disconnect: legal terminology doesn't always align neatly with what ML researchers can actually measure and test.

The findings have direct implications for three key implementation efforts: the development of harmonized standards, guidelines from the European Commission, and the creation of benchmarks and measurement methodologies mandated by the regulation.

By clarifying the link between legal requirements and technical reality, the researchers hope to ensure that both regulators and AI developers can better understand—and fulfill—the Act's safety objectives.