From a UK code to a European standard
In January 2025 the UK government published a voluntary Code of Practice for the Cyber Security of AI. It drew on the NCSC's guidelines for secure AI system development and set out baseline security principles for AI systems. That code fed into work at ETSI, the European standards body for telecoms and digital technology, which published EN 304 223 as a European Standard. ETSI announced it in January 2026.
EN 304 223 sets out 13 principles and requirements across five lifecycle phases: secure design, secure development, secure deployment, secure maintenance and secure end of life. It addresses threats that are specific to AI, including data poisoning, model obfuscation and indirect prompt injection.
Why lifecycle framing matters
Security reviews of AI products tend to happen once, near launch, and focus on the application around the model. The lifecycle framing makes two things harder to skip. The first is what happens before code: threat modelling the AI component, deciding what data it can reach, and deciding what a model is allowed to do with tools. The second is what happens after launch: updates to the model or its prompts, new data sources, monitoring for abuse, and a plan for retiring the system and its data cleanly.
Questions we ask at each stage
- Design: what is the worst thing this system could do if its inputs were hostile, and have we limited its access accordingly?
- Development: do we know where every model, dataset and third-party component came from, and is that record kept?
- Deployment: are prompts, system instructions and retrieval sources treated as configuration under change control?
- Maintenance: who is told when the model provider changes the underlying model, and what is retested when that happens?
- End of life: when the system is switched off, what happens to its logs, embeddings, fine-tuning data and credentials?
How this connects to governance
Security is often treated as a separate track from AI governance. In practice the evidence overlaps: an asset inventory, a threat assessment, test results and change records are useful to a security reviewer, a risk committee and an external assurance provider alike. Keeping one set of records saves producing three.
If you are deploying AI into a product and need a clear view of where the security and governance gaps are, the AI Opportunity and Governance Sprint is designed for that first review.