By Panagiota Lagou, GRC Director of ADACOM, Published in IT Security Pro no96
The rapid adoption of Artificial Intelligence creates significant opportunities for businesses, while simultaneously introducing new requirements in terms of security, governance and risk management.
Artificial Intelligence systems are now being integrated into business applications, products and services that process data, interact with other information systems and, in many cases, influence critical business decisions. As a result, cybersecurity can no longer be treated as a separate technical issue to be addressed at the end of a product’s development lifecycle. Instead, Security by Design (SbD) must be implemented.
From Security as a Function to Security as a Product Feature
It is therefore clear that security must be integrated from the earliest stages of product development and form part of architectural and business decisions.
For an organisation, this means that issues such as threat modelling, identity and access management, data protection, dependency identification and the ability to perform secure updates must not be treated as supplementary activities, but rather as integral parts of product design.
This approach becomes even more important for products that use Artificial Intelligence, which face specific risks such as training data poisoning, model poisoning, adversarial examples/model evasion, confidentiality attacks and model defects.
Where the CRA Meets the AI Act
When a product falls within the scope of the Cyber Resilience Act (CRA) and also constitutes a high-risk Artificial Intelligence system under the Artificial Intelligence Act (AI Act), an important regulatory link emerges.
The CRA includes specific provisions (Article 12) addressing the relationship between cybersecurity requirements and the requirements of the AI Act. Under the conditions set out in the legislation, compliance with the relevant CRA requirements must be linked to compliance with the corresponding cybersecurity requirements of the AI Act.
The principle of Security by Design takes on particular importance in the context of artificial intelligence, as security concerns not only the software and infrastructure, but also the model itself, the data and the behaviour of the system.
For high-risk artificial intelligence systems, the AI Act requires, among other things, appropriate levels of accuracy, robustness and cybersecurity, as well as consistent operation throughout their lifecycle. Therefore, risk assessment cannot be limited to traditional cybersecurity threats. It must also take into account risks relating to training data, model operation and behaviour, the manipulation of inputs and data, and potential deviations from expected behaviour.
Similarly, the CRA introduces a holistic approach to the security of products with digital elements, requiring cybersecurity risk assessment to be integrated into their design, development, production and maintenance. For products incorporating artificial intelligence systems, this means that model security must be addressed alongside the security of the product, its data, interfaces and dependencies.
In this context, Article 12 of the CRA establishes an important link with the AI Act, providing, under specific conditions, for a connection between compliance with the CRA’s cybersecurity requirements and the corresponding requirements of Article 15 of the AI Act. The result is an integrated approach: security by design, continuous risk management and compliance throughout the entire lifecycle of artificial intelligence technology.
The effective implementation of Security by Design in Artificial Intelligence systems requires an integrated approach combining consulting services and technical assessments, embedded from the earliest stages of design. In this context, organisations should implement threat assessment and modelling, risk assessment, security architecture design and software supply chain security services. At the same time, specialised technical assessments are required, including penetration testing, application and application programming interface (API) security testing, infrastructure and dependency vulnerability assessments, as well as model resilience testing against adversarial attacks, data poisoning and information leakage. In addition, access control mechanisms, logging, human oversight, secure updates and vulnerability management must be evaluated. In this way, Security by Design becomes a measurable process for preventing, assessing and continuously improving security and compliance.
From Compliance to Strategy
It is therefore clear that the effective implementation of Security by Design in artificial intelligence requires a clear and consistent methodology, tailored to the specific characteristics of AI systems rather than simply transferring traditional cybersecurity practices. This methodology must account for the particular characteristics of models, data, behaviour and associated risks, from the design stage throughout the entire lifecycle. At the same time, it must be aligned with the requirements of the CRA and the AI Act, so that technical security and regulatory compliance are designed together from the outset.
In this way, Security by Design becomes a strategic practice rather than merely a regulatory obligation.
Read also the full article in Greek here: IT Professional Security - ΤΕΥΧΟΣ 96