Global AI Monitor
Preview

United Kingdom (UK) · Module Detail

United Kingdom: Standards & Conformity

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

AI Cyber Security Code of Practice (Published 2025-01-31): Voluntary government code setting baseline cyber security principles for securing AI systems.

3 instruments · 0 obligations · 8 claims

3 instruments (3 current) · 0 obligations · 8 claims · 0 milestones

Instruments

  • AI Cyber Security Code of Practice Published 2025-01-31

    Voluntary government code setting baseline cyber security principles for securing AI systems. DSIT said it would submit the Code to ETSI as the basis for a global standard.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
  • BS EN ISO/IEC 42001:2026 Artificial intelligence management system Published 2026-03-31

    UK and European adoption of ISO/IEC 42001 AI management system standard, published by BSI on 31 March 2026 with no technical differences from BS ISO/IEC 42001:2023.

    Non-binding · Authority: BSI Group (British Standards Institution) · Verified · Official text
  • ETSI EN 304 223 V2.1.1: Baseline Cyber Security Requirements for AI Models and Systems Date not recorded

    European standard defining baseline security requirements for AI models and systems, including generative AI. It is voluntary unless adopted or referenced by a regulator.

    Non-binding · Authority: European Telecommunications Standards Institute · Verified · Official text
Claims and evidence (8)

  • ETSI published EN 304 223, defining baseline cyber security requirements for AI models and systems, based on DSIT's AI Cyber Security Code of Practice.

    Confidence: Probable · evidenced
    Evidence and sources

  • BSI published BS EN ISO/IEC 42001:2026 on 31 March 2026 as the UK/European adoption of ISO/IEC 42001:2023 for AI management systems, with no change to requirements.

    Confidence: Confirmed · As of 31 Mar 2026 · evidenced
    Evidence and sources

  • ETSI EN 304 223 defines baseline cyber security requirements for AI models and systems, developed from DSIT's AI Cyber Security Code of Practice in collaboration with NCSC.

    Confidence: Probable · evidenced
    Evidence and sources

  • BSI published BS EN ISO/IEC 42001:2026, the UK adoption of the AI management system standard, on 31 March 2026, with no technical changes from the 2023 edition.

    Confidence: Probable · As of 31 Mar 2026 · evidenced
    Evidence and sources

  • The AI Cyber Security Code of Practice sets baseline cyber security principles for AI systems and is a voluntary government code.

    Confidence: Probable · As of 31 Jan 2025 · evidenced
    Evidence and sources
    • AI Cyber Security Code of Practice T1 · retrieved · retrieved 8 Oct 2026 · Code of Practice, introductionThis Code of Practice sets out baseline cyber security principles to help secure AI systems and the organisations which develop and deploy them. Addressing the cyber risks to AI will protect our citizens and our digital economy while ensuring the man

  • DSIT said it would submit the UK AI Cyber Security Code to ETSI as the basis for a global standard; ETSI later published EN 304 223.

    Confidence: Uncertain · As of 1 Dec 2025 · evidenced
    Evidence and sources

  • DSIT published a Copper Horse mapping of 2,182 AI security requirements onto the 13 principles of ETSI EN 304 223 and states the UK Code mirrors that standard.

    Confidence: Probable · As of 10 Jul 2026 · evidenced
    Evidence and sources
    • Mapping global AI security standards, regulations and guidance (DSIT) T1 · retrieved · retrieved 8 Oct 2026 · Page bodyCopper Horse then undertook a mapping of the 2,182 requirements against the 13 principles set out in the European Telecommunications Standards Institute’s AI security global standard, EN 304 223. The government’s AI Cyber Security Code of Practice mirrors EN 304 223.

  • BSI published BS EN ISO/IEC 42001:2026 on 31 March 2026 as the UK and European adoption of ISO/IEC 42001 with no technical differences.

    Confidence: Probable · As of 31 Mar 2026 · evidenced
    Evidence and sources