Article 15: Accuracy, Robustness and Cybersecurity for High-Risk AI
Article 15 demands declared accuracy metrics, resilience to faults, and cybersecurity against data poisoning and adversarial attacks. A guide.
Article 15 of Regulation (EU) 2024/1689 is the requirement that turns "our model performs well" into something you have to prove, declare, and defend. It bundles three obligations that high-risk AI must meet across its whole lifecycle: an appropriate level of accuracy, robustness against errors and a changing environment, and cybersecurity against deliberate attempts to manipulate the system. None of the three is a one-time test — each is a design property the provider builds in and maintains. This page sets out what each one demands in practice.
Article 15 applies to high-risk systems from 2 December 2027 for stand-alone Annex III (Digital Omnibus deferral, now adopted — see caveat), and it does not stand alone: it works with the risk management system (Article 9) and data governance (Article 10).
Accuracy — and you must declare the metric
Article 15 requires high-risk systems to achieve an appropriate level of accuracy for their intended purpose. "Appropriate" is contextual — what is acceptable for a spam filter is not acceptable for a credit decision — but the requirement comes with teeth: the accuracy levels and the relevant accuracy metrics must be declared in the instructions for use provided under Article 13.
That declaration is what makes accuracy auditable. You cannot satisfy Article 15 by asserting the system is "highly accurate"; you state which metric (precision, recall, F1, error rate, calibration — whatever fits the task) and what level it reaches, in the Article 13 instructions, so a deployer knows the system's real performance envelope and where it degrades. A system that performs well for one population and poorly for another must say so.
Robustness — resilience to error, fault, and the world changing
Robustness, in Article 15's sense, is the system's ability to keep performing acceptably when things go wrong or conditions shift. The Article names several dimensions:
- Resilience to errors, faults and inconsistencies that may occur within the system or its operating environment — including interactions with people and other systems.
- Technical redundancy and fail-safe measures where appropriate, so a fault degrades gracefully rather than producing a confident wrong answer.
- Control of feedback loops. A high-risk system that learns from its own outputs after deployment must be designed so that biased outputs do not feed back in and compound — a "feedback loop" that quietly amplifies error or discrimination over time. Article 15 names this risk explicitly and requires it be addressed.
Robustness is where the statutory term carries real engineering weight (this is the one place "robustness" is the right word — not fluff). It is also where systems already in production tend to be weakest, because they were built for the happy path, not for the fault and drift that Article 15 demands they survive.
Cybersecurity — resilience to deliberate manipulation
The cybersecurity limb of Article 15 is specifically about attempts by third parties to alter the system's use, behaviour or performance by exploiting vulnerabilities. It is AI-specific threat modelling, not generic IT security, and the Article points to the attack classes that matter:
| Attack class | What it does |
|---|---|
| Data poisoning | Corrupting the training data so the model learns the attacker's intended behaviour |
| Model poisoning | Tampering with the model or its components directly |
| Adversarial examples / model evasion | Crafting inputs that fool the model at inference time into a wrong output |
| Confidentiality attacks | Extracting the model, its parameters, or training data (e.g. model-inversion, membership-inference) |
Article 15 requires technical solutions appropriate to the circumstances and the risks to prevent, detect, respond to, resolve and control for these attacks. The measures must be proportionate — a fraud-flagging tool faces a more determined adversary than an internal forecasting model — but the threat model has to be done, and the controls have to match it.
How Article 15 connects to Articles 9 and 10
Article 15 is not an island. The risk management system (Article 9) is where you identify which accuracy, robustness and cybersecurity risks are relevant and decide on mitigations — Article 15's properties are, in large part, the output of running Article 9 properly. And data governance (Article 10) underpins accuracy and the bias dimension of robustness: training, validation and testing data that is relevant, representative and as error-free as possible is what makes the declared accuracy meaningful and the feedback-loop control achievable. Treat the three as one connected obligation, not three checkboxes.
All of this lands in the Article 11 / Annex IV technical documentation, where the accuracy metrics, robustness measures and cybersecurity controls are evidenced for conformity assessment.
The deadline caveat
The deferral of the stand-alone high-risk regime to 2 December 2027 is now adopted — the European Parliament passed it on 16 June 2026 and the Council adopted it on 29 June 2026. Only Official Journal publication remains, expected before 2 August 2026 — a formality that does not change the date. Stand-alone high-risk Annex III obligations apply from 2 December 2027.
Worked example: a fintech provider meets Article 15
KreditFluss GmbH — a fictional 60-person German fintech (~€11M turnover) — provides a creditworthiness-scoring system, high-risk under Annex III point 5(b).
- Accuracy. KreditFluss declares its model's metrics — area under the ROC curve and the false-positive/false-negative rates broken down by applicant segment — in the Article 13 instructions for use, and flags that performance is weaker for thin-file self-employed applicants so deployers apply extra scrutiny there.
- Robustness. It builds a fallback rule for cases the model is uncertain on, and — because scores can influence future training data — it isolates post-deployment feedback so that declined applicants do not silently skew the next model version.
- Cybersecurity. Its threat model covers data poisoning of the training pipeline (signed, access-controlled data sources), adversarial evasion (input validation and anomaly monitoring), and confidentiality attacks (rate-limiting and output controls against model extraction).
- The connection. All three flow from the Article 9 risk management system and rest on Article 10 data governance, and all three are documented in the Article 11 / Annex IV file. As an SME, KreditFluss's penalty exposure is capped at the lower figure under Article 99(6).
The verdict: Article 15 compliance here is not a security audit bolted on at the end — it is three design properties evidenced from the risk assessment forward.
How Confir helps
Confir's Data & Technical Robustness assessment area walks a provider through Article 15 alongside Articles 10 and 11: which accuracy metrics you declare in the Article 13 instructions, what robustness and fail-safe measures apply, and which cybersecurity threats — data poisoning, model poisoning, adversarial examples, confidentiality attacks — your threat model must address. The findings feed the Article 11 / Annex IV technical pack. The engine is deterministic and rule-based: the same intake yields the same finding, each cited to its Article.
Related guides
- Article 15 — accuracy, robustness, cybersecurity
- Article 9 — risk management system
- Article 10 — data and data governance
- Risk management system in practice
- Data governance for high-risk AI
- Article 11 documentation requirements
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →