EU AI Act Cybersecurity: CBOM Evidence for Article 15 Compliance
Article 15 makes cybersecurity a legal requirement for high-risk AI. A cryptographic bill of materials shows what protects your models, data and pipelines, and finds what is too weak to rely on.
- Article 15 of the AI Act requires high-risk systems to be accurate, robust and cybersecure, resilient against attacks that alter their behaviour.
- The confidentiality and integrity of models and data rest on cryptography, which a CBOM inventories.
- A CBOM finds deprecated primitives and weak keys that would undermine an Article 15 security claim.
- It complements the AI BOM and SBOM in documenting a high-risk AI system.
Article 15 and cryptography
Article 15 of the EU AI Act, Regulation (EU) 2024/1689, requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity, and to be resilient against unauthorised attempts to alter their use, outputs or performance by exploiting vulnerabilities [1][2]. Protecting the confidentiality and integrity of model weights, training data and inference traffic depends on sound cryptography, so a provider has to know what cryptography the system uses.
Why a CBOM for AI
A cryptographic bill of materials (CBOM) inventories the algorithms, keys, certificates and protocols across an AI system and where each is used [3]. For high-risk AI that typically includes model-signing keys, storage encryption for datasets, and the TLS protecting inference APIs. The CBOM makes these visible so you can show they are current and strong.
Finding what fails Article 15
| CBOM finding | Article 15 risk |
|---|---|
| Weak hashing of model artifacts | Integrity of weights not assured; tampering harder to detect |
| Deprecated TLS or weak keys on inference APIs | Confidentiality and resilience of the system weakened |
| Unmanaged or expiring certificates | Operational failures and trust gaps |
Integrity of models and data
Model and data integrity is central to Article 15: a poisoned dataset or a tampered weight file changes system behaviour. Cryptographic hashing and signing, inventoried in the CBOM and cross-checked against the AI BOM, is how you evidence that integrity.
How IntelliXBOM helps
IntelliXBOM generates CBOMs during scanning, scores cryptographic strength and quantum readiness, flags deprecated primitives and expiring certificates, and keeps the CBOM alongside the AI BOM and SBOM for the same system. See finding weak cryptography with a CBOM. The platform provides evidence; conformity remains the provider's responsibility.
Frequently asked questions
Does Article 15 require specific cryptography?
No. It requires an appropriate level of cybersecurity and resilience against attacks. A CBOM lets you demonstrate that the cryptography protecting your models and data is strong and current rather than deprecated.
What cryptography does an AI system actually use?
Commonly: hashing or signing of model artifacts, encryption of datasets at rest, and TLS for inference APIs. A CBOM inventories all of it and flags anything weak.
How does a CBOM relate to the AI BOM?
The AI BOM documents models and datasets; the CBOM documents the cryptography that protects them. Both are generated from the same scan and support Article 15 and Annex IV.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj
- AI Act Article 15: Accuracy, robustness and cybersecurityEU AI Act explorerartificialintelligenceact.eu/article/15/
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.