EU AI Act (Regulation 2024/1689): Why Articles 9 and 15 Make Continuous LLM Testing a Legal Obligation
Regulation · 2024-10-02 · 12 min read · FilterPrompt Compliance Team
Article 9 requires iterative risk management across the AI lifecycle and Article 15 demands resilience against unauthorized behaviour changes — in practice, that means recurring prompt-injection and adversarial testing.
The EU AI Act is the world's first comprehensive, horizontal AI law with real financial penalties. Unlike voluntary frameworks, several of its articles create direct, enforceable obligations on providers and deployers of high-risk AI systems and on providers of General-Purpose AI (GPAI) models. For security teams the most operationally consequential articles are 9, 15 and 72 — the ones that turn 'good AI hygiene' into a legal duty.
Article 9 — continuous risk management, not one-time paperwork
Article 9 requires providers of high-risk AI systems to establish, implement, document and maintain a risk-management system that runs across the entire lifecycle. Regulators have been clear in guidance: 'lifecycle' means before deployment, at deployment, after every substantial modification, and continuously in production. In practice that means recurring adversarial prompt runs — not a single sign-off document.
Article 15 — accuracy, robustness and cybersecurity
Article 15(5) requires high-risk AI systems to be resilient against attempts by unauthorized third parties to alter their use, outputs or performance by exploiting system vulnerabilities. Practitioners and national supervisory authorities increasingly read this as the closest thing in EU law to an explicit prompt-injection mandate — because prompt injection, indirect prompt injection and jailbreaks are precisely the mechanism by which an unauthorized third party alters model behaviour.
GPAI obligations — for anyone shipping a foundation model into Europe
Providers of GPAI models face additional obligations under Articles 53–55, including publishing a sufficiently detailed summary of training content, documenting model capabilities and limitations, and — for models with systemic risk — performing model evaluations including adversarial testing, tracking and reporting serious incidents, and ensuring an adequate level of cybersecurity protection. Continuous adversarial probing against OWASP LLM Top 10 and MITRE ATLAS techniques is the operational form this takes.
The vulnerability categories EU regulators keep returning to
How to build an EU AI Act-aligned testing program
- Classify every AI system: prohibited, high-risk, limited-risk or minimal-risk. High-risk gets the full Article 9 treatment.
- Point an LLM vulnerability scanner at each system and run the OWASP LLM Top 10 + MITRE ATLAS baseline.
- Wire scans into CI so any model, prompt, RAG or tool change re-triggers the baseline before release.
- Enable continuous per-request scanning in production to satisfy Article 15 and Article 72.
- Retain structured JSON audit logs per Article 12; keep them for the retention window your notified body requires.