For Heads-of · Practitioner
AI Cyber Security Code of Practice
Also known as: UK AI Cyber Security Code
The UK government's voluntary code, published in January 2025, setting 13 principles for securing AI systems across five lifecycle phases. It became the basis of a European standard, ETSI EN 304 223, released in January 2026.
- DSIT
- AI security
- ETSI EN 304 223
- secure by design
- code of practice
What it covers
The 13 principles run across secure design, development, deployment, maintenance and end of life. They include raising staff awareness of AI threats, designing for security as well as function, assessing threats, securing the supply chain, documenting data, models and prompts, testing, communicating with end users, keeping security updates and monitoring going, and disposing of data and models properly. Each principle says who it applies to, such as developers, system operators or data custodians.
Why it matters
It is the UK's baseline for AI security and maps closely to the attacks covered in this glossary, from data poisoning to prompt injection. Because it is now also a European standard, it is a reasonable benchmark to ask suppliers about.
Where it sits in the register
Its themes map to the adversarial testing coverage gap and LLM application supply chain vulnerabilities, and to the controls adversarial robustness testing and model artefact signing and integrity verification.
Sources
Related Terms
AI Red Teaming
Structured adversarial testing in which testers try to make an AI system fail, either by producing harmful or prohibited output (safety red teaming) or by being subverted to act against its owner (security red teaming). It finds failures an ordinary test suite cannot, because the tester's job is to imagine what the designers did not.
AI Supply Chain Security
Assuring the integrity and provenance of everything an AI system is built from and depends on: pre-trained models and weights, adapters, datasets, libraries, serving infrastructure, plug-ins and tools. AI adds components that ordinary software supply-chain controls were not built to check.
MITRE ATLAS
MITRE's knowledge base of the tactics and techniques adversaries use against AI systems, modelled on the MITRE ATT&CK framework for conventional cyber attacks and built from real-world case studies and red-team findings.
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.
Related risks and controls
Adversarial testing coverage gap
The testing principle in register form.
LLM application supply chain vulnerabilities
The supply-chain principle in register form.
Adversarial robustness testing
Testing and evaluation.
Model artifact signing and integrity verification
Supply-chain and asset protection.