France’s ANSSI and international partners advocate risk-based approach for secure AI systems

The French National Cybersecurity Agency (ANSSI) has released new guidance on securing AI systems, emphasising a risk-based approach to AI deployment. Several international partners, including Canada, Singapore, Germany, Italy, Norway, the United Kingdom, Estonia and others, have co-signed the document.

The publication highlights the growing integration of AI across sectors and the need for organisations to assess and mitigate associated risks, particularly as they adopt large language models (LLMs).

ANSSI outlines key security challenges specific to AI, including vulnerabilities in data integrity, supply chain risks, and the potential for AI systems to be exploited as attack vectors. The report identifies major risks such as:

• Compromises in AI hosting and management infrastructure
• Supply chain attacks targeting AI components
• Interconnections between AI and IT systems increasing attack surfaces
• Long-term loss of control over AI-driven processes
• Malfunctions affecting AI system reliability

To address these challenges, the document advocates for a structured approach to AI security, recommending that organisations:

• Align AI system autonomy with risk assessments and operational criticality
• Map AI supply chains and monitor interconnections with IT infrastructure
• Implement continuous monitoring and maintenance of AI systems
• Anticipate regulatory and technological developments impacting AI security
• Strengthen training and awareness on AI-related risks

The publication also advises against using AI for automating critical actions without safeguards, urging organisations to conduct dedicated risk analyses and assess security measures at every stage of the AI system lifecycle.

For more information on these topics, visit diplomacy.edu.