AI changes how attacks happen and how fast they spread. What is appropriate today may not be appropriate next month. AxiLayer AI works hand in hand with your cybersecurity team to test, monitor and evidence that your AI stays secure, so your customers stay protected. We build AI-powered assurance tools that test, monitor and secure AI, and a qualified AxiLayer AI auditor signs every finding.
Last verified: 28 October 2026
Attackers use AI to write better phishing, clone voices, find vulnerabilities faster and probe the AI systems you deploy. Regulators in Europe, the United States and Asia now expect AI-specific security controls, tested plans and assurance from the providers you rely on.
A source-linked view of the laws, supervisory expectations and standards that shape AI cybersecurity worldwide, as they stand on 28 October 2026. Status labels show what is binding law, what is supervisory guidance and what is voluntary.
| Jurisdiction | Instrument | Date | Status | What it expects for AI cybersecurity |
|---|---|---|---|---|
| European Union | EU AI Act, Article 15: accuracy, robustness and cybersecurity | High-risk obligations apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I), under Regulation (EU) 2026/1744 | Law | High-risk AI must resist attempts to alter its use, outputs or performance, with measures against data poisoning, model poisoning, adversarial examples and confidentiality attacks. |
| European Union | Digital Operational Resilience Act (DORA) | Applies since 17 Jan 2025 | Law | ICT risk management, resilience testing, major incident reporting and ICT third-party risk for financial entities, now applied to AI-assisted threats. |
| European Union | Joint statement of the European Supervisory Authorities on AI-assisted cyber risk | July 2026 | Supervisory | Set up governance for AI-assisted cyber incidents without delay, update risk appetite, patch faster, widen vulnerability discovery, test continuity plans and enforce standards across the supply chain. |
| Euro area | ECB letter to significant banks on AI-enabled cyber threats | 7 Jul 2026; action plans due 31 Oct 2026 | Supervisory | Action plans covering the threat landscape, patch management for exposed assets, longer-term cyber hygiene and assurance from ICT third-party providers. |
| European Union | Cyber Resilience Act | Reporting since 11 Sep 2026; main obligations from 11 Dec 2027 | Law | Manufacturers of products with digital elements, including AI-enabled products, report actively exploited vulnerabilities and severe incidents: 24-hour early warning, 72-hour notification. |
| United States, New York | NYDFS industry letters on cybersecurity risks of frontier AI models, under 23 NYCRR Part 500 | 21 May 2026 | Supervisory | Updated risk assessments, faster vulnerability remediation, testing and human review of AI-generated code, dependency maps, stronger logging and more frequent incident response testing. |
| United States | NIST Cybersecurity Framework Profile for AI (NIST IR 8596) | Preliminary draft Dec 2025; revised draft expected | Draft | Three focus areas mapped to NIST CSF 2.0: secure AI system components, use AI for cyber defense, and thwart AI-enabled attacks. |
| United States and partners | NSA, CISA, FBI and international partners: AI Data Security | May 2025 | Voluntary | Protect the data that trains and runs AI across its lifecycle: provenance, integrity, access control and defenses against poisoning. |
| United States and partners | CISA and partners: Principles for the Secure Integration of AI in Operational Technology | Dec 2025 | Voluntary | Understand AI risks, evaluate AI use in OT, set up AI governance and testing, and keep human oversight and AI in incident response plans. |
| United States | FinCEN alert on fraud schemes using deepfake media | Nov 2024 | Supervisory | Red flags and suspicious activity reporting for deepfake identity documents, voice and video used against financial institutions and their customers. |
| United Kingdom | AI Cyber Security Code of Practice | Jan 2025 | Voluntary | Thirteen security principles across the AI lifecycle, the basis for the ETSI standard below. |
| Europe and international | ETSI EN 304 223: baseline cyber security requirements for AI models and systems | Jan 2026 | Standard | Thirteen principles and requirements across five phases: secure design, development, deployment, maintenance and end of life. |
| International | ISO/IEC 27090:2026, addressing security threats and compromises to AI systems | Oct 2026 | Standard | Guidance on understanding, detecting and mitigating deliberate attacks on AI, such as data poisoning, evasion and model theft. |
| International | ISO/IEC 42001:2023 AI management systems and ISO/IEC 42006:2025 | 2023 and Jul 2025 | Standard | An AI management system that includes security controls. ISO/IEC 42001 certificates are issued by certification bodies assessed under ISO/IEC 42006. |
| Singapore | MAS Guidelines on Artificial Intelligence Risk Management | Issued 7 Oct 2026; take effect 7 Oct 2027 | Supervisory | Board accountability, an AI inventory, lifecycle controls including cybersecurity, and assurance over third-party AI. Firms remain accountable for AI in their services. |
| Singapore | CSA Guidelines on Securing AI Systems, with the addendum on securing agentic AI | Addendum 17 Jun 2026 | Voluntary | A lifecycle approach starting from risk assessment, with added steps for agent autonomy, rogue actions and sensitive data disclosure. |
| China | Amended Cybersecurity Law, with its first AI clause | In force 1 Jan 2026 | Law | AI risk assessment and security governance written into the foundational cybersecurity law, with higher penalties. |
| Industry | OWASP Top 10 for LLM Applications (2025) and OWASP Top 10 for Agentic Applications (2026) | Nov 2024 and Dec 2025 | Voluntary | Peer-reviewed lists of the most critical security risks for generative AI applications and autonomous agents. |
| Industry | MITRE ATLAS | Maintained continuously | Voluntary | A knowledge base of real adversary tactics and techniques against AI systems. |
| Financial sector | FS-ISAC guidance on AI risk for financial services | 2024 to 2026 | Voluntary | Sector guidance on AI threats, AI cybersecurity controls and generative AI governance for financial institutions. |
Dates and status change often. AxiLayer AI rechecks this table against primary sources. For the full picture of AI audit rules and dates, see the Audit Mandates Map and the Compliance Calendar.
We organize AI cybersecurity work around the three focus areas of the draft NIST Cyber AI Profile, which line up with what European and Asian supervisors now ask for.
Models, training and retrieval data, prompts, plug-ins, agents and the connections between AI and your business systems. We test how well they resist manipulation, leakage and misuse.
AI used in your own security operations, such as alert triage or log analysis, must work as intended. We check its accuracy, its oversight and what happens when it fails silently.
AI-written phishing, voice cloning, deepfake video and synthetic identities aimed at your staff and customers. We assess the procedures that stop them before money or data moves.
Each assessment is scoped to the AI systems you actually run. These are the threats we look for, with the public references we map them to.
| Threat | What it looks like | Reference |
|---|---|---|
| Prompt injection | Hidden or crafted instructions make an AI system ignore its rules or act for an attacker. | OWASP LLM Top 10: Prompt Injection |
| Sensitive data leakage | The AI reveals customer data, secrets or its own system instructions. | OWASP: Sensitive Information Disclosure; System Prompt Leakage |
| Data and model poisoning | Tampered training, fine-tuning or retrieval data changes how the model behaves. | EU AI Act Art. 15(5); ISO/IEC 27090; MITRE ATLAS |
| Adversarial evasion | Inputs designed to make the model get it wrong, such as fraud that slips past detection. | EU AI Act Art. 15(5); MITRE ATLAS |
| Model theft and extraction | Attackers copy model behavior or extract training data through repeated queries. | ISO/IEC 27090; MITRE ATLAS |
| Agents acting beyond their remit | AI agents with broad tool access or permissions are steered into unintended actions. | OWASP Agentic Top 10 (2026); CSA agentic AI addendum |
| Third-party model and supply chain risk | A vendor model, library or plug-in changes, is compromised or fails without notice. | DORA ICT third-party risk; MAS guidelines; OWASP: Supply Chain |
| AI-generated code | Code written by AI tools reaches production with weaknesses no one reviewed. | NYDFS letters, May 2026 |
| Shadow AI | Staff use AI tools no one approved, outside your controls and contracts. | IBM 2025 breach findings; MAS AI inventory |
| Deepfake and voice-clone fraud | Synthetic voices, faces and documents used to approve payments or open accounts. | FinCEN alert, Nov 2024 |
| AI-written phishing | Personalized, error-free phishing at scale, aimed at staff and customers. | NIST Cyber AI Profile: Thwart |
| Unbounded use and denial of service | Runaway queries or abuse that exhaust capacity or budgets. | OWASP: Unbounded Consumption |
AI makes phishing emails, cloned voices and deepfake video convincing. The defense is a set of procedures your people follow every time, especially when money, credentials or customer data are involved.
AI cybersecurity is not a one-time test. We look at the controls before an AI system goes live and at the controls that keep it secure every day after.
How much risk is normal to accept depends on your risk appetite, your customers and your regulators. Our role is to make the risk visible, measurable and owned, so every decision is a real decision.
| For every AI risk we record | Why it matters |
|---|---|
| What could go wrong | A plain description of the failure or attack and who it would affect. |
| Exposure | How many customers, how much data or money, and which markets are in reach. |
| Trigger | The event or condition that would set it off, and how likely it is. |
| Owner | The named person accountable for the risk and its controls. |
| Time to know | How fast your monitoring would detect it, and how fast you could stop it. |
| Decision | Fix, reduce, transfer or accept, by documented decision within your risk appetite. |
| Review date | When the decision is looked at again, or sooner if something changes. |
Risk is accepted only by documented decision, never by default. Supervisors in Europe and Singapore now ask firms to update their risk appetite for AI, and this record is how you show it.
Security conditions can change in milliseconds. Changes to your AI should never slip through unnoticed, and each one should lead to the right level of re-testing.
Every engagement starts from your own governance, your data, your vendors and the rules of the markets you serve, so the controls we test are the ones that matter to you.
AxiLayer AI does not replace your cybersecurity tools or your people. We give each team third-party evidence in a form it already uses.
| Your team | What it receives |
|---|---|
| CISO and security operations | AI threat findings, test results and monitoring evidence mapped to your security framework. |
| Risk management | The AI risk record with exposure, triggers, owners and decisions. |
| Compliance | A control and framework matrix for each market, with gaps and dates. |
| Internal audit | Signed, re-verifiable findings they can rely on and re-perform. |
| Procurement and third-party risk | Vendor and model assessments and the questions to ask providers. |
| Board and senior management | A short summary of AI cybersecurity posture, top risks and decisions needed. |
Every engagement ends with clear, signed deliverables.
AI auditing must stay inside the law in every market. These are the boundaries we work within, so you always know what our findings are and what they are not.
AxiLayer AI is not a notified body and is not designated under the Machinery Regulation, the AI Act, or the Cyber Resilience Act. Its ISO/IEC 17020:2026 and ISO/IEC 42001 accreditation applications are in process.
Financial institutions face the most detailed AI cybersecurity expectations today, and the same threats reach every sector that uses AI with customers.
Tell us which AI systems matter most and which markets you serve. We will scope a review with your cybersecurity team and show you where you stand. Every finding is reviewed and signed by a qualified AxiLayer AI auditor.
Request a review Explore Assurance IntelligenceThis page is general information about AI cybersecurity rules and practices as of 28 October 2026, not legal advice. AxiLayer AI does not promise regulatory outcomes, and accountability for AI systems remains with the organization that uses them.
No. AxiLayer AI works alongside your CISO, security operations, risk, compliance and internal audit teams. We do not replace your tools or your people. We give you third-party evidence that the controls around your AI work, and we tell you plainly where they do not.
At least on a set schedule, and every time something important changes: a new model or model version, new training or retrieval data, new prompts or system instructions, a new vendor, a new regulation or an incident. What is appropriate today may not be appropriate next month.
The EU AI Act (Article 15), DORA, the Cyber Resilience Act, NYDFS Part 500, the NIST Cybersecurity Framework 2.0 and the draft NIST Cyber AI Profile, ISO/IEC 27001, ISO/IEC 27090, ISO/IEC 42001, ETSI EN 304 223, the UK AI Cyber Security Code of Practice, the MAS AI Risk Management Guidelines, OWASP and MITRE ATLAS, chosen for the markets you operate in.
Yes. We review your awareness program, payment approval and call-back procedures, voice and video verification steps and reporting paths against AI-generated phishing, voice cloning and deepfake requests. Staff phishing simulations stay with your cybersecurity team or the provider you appoint, under your own authorization.
No. AxiLayer AI is a third-party AI audit and assurance firm. It is not a notified body and is not designated under the Machinery Regulation, the AI Act or the Cyber Resilience Act. We do not issue CE marking, ISO/IEC 27001 or ISO/IEC 42001 certificates, or SOC reports. Our signed findings support the work of the bodies that do.
Never. Every test runs under a written authorization signed by someone entitled to give it, with an agreed scope, rules of engagement, test windows and stop conditions. We only test systems you own or are authorized to have tested, including your vendors' systems where their permission is in place.
Findings reviewed and signed by a qualified AxiLayer AI auditor, a control and framework matrix, a board summary, a prioritized remediation plan, a risk register with owners and triggers, and a re-test confirmation once fixes are in place.
Last verified: 28 October 2026
