← HomeBlog

2026-10-23 · Compliance

EU AI Act Article 15: what adversarial testing evidence looks like

Regulation (EU) 2024/1689 sets cybersecurity and accuracy expectations for high-risk AI systems. Article 15 covers accuracy, resilience, and cybersecurity, including resistance to attempts that alter use or performance. Article 9 requires a risk-management system, and that system is supposed to include testing. For many SaaS teams shipping LLM features, the practical question is not the legal text alone. It is what evidence you can hand to a customer, investor, or internal compliance lead when they ask how you tested against adversarial abuse.

The Digital Omnibus on AI moved several application dates. A timeline maintained by the Future of Life Institute, updated 31 August 2026 from the amended text, puts Chapter III (including Articles 9 and 15) for Annex III high-risk systems at 2 December 2027, and for Annex I product systems at 2 August 2028. Article 50 transparency obligations applied on 2 August 2026. Annex III rules are not in force yet. Planning still matters because technical documentation and testing habits take time to build.

TL;DR
Articles 9 and 15 for Annex III high-risk AI apply from 2 December 2027 under the amended EU AI Act timeline. Adversarial testing should produce reproducible findings you can place in Annex IV technical documentation. Faultline delivers a human-led report (OWASP LLM Top 10, MITRE ATLAS); Scale adds mapping for Articles 15 and 9 and ISO/IEC 42001. That is evidence, not a notified-body conformity assessment and not legal advice. Core EUR 1,500, Scale EUR 2,500, monthly or once.

What Article 15 actually asks for

Article 15 is often summarized as accuracy, resilience, and cybersecurity. For providers, the cybersecurity slice is the one that overlaps with offensive testing: can someone prompt, tool, or data-poison your way into behavior you did not intend?

Article 9 sits upstream. It expects a risk-management system that identifies hazards, evaluates likelihood and severity, and includes testing before and after deployment. Auditors and enterprise buyers increasingly treat adversarial test results as part of that story, even when your lawyer still owns the formal conformity path.

Faultline does not replace legal counsel or a notified body. We produce technical evidence: named attack classes, reproduction steps, severity, and transcripts where they help your engineers fix issues.

What “adversarial testing evidence” looks like in practice

Buyers and compliance teams rarely want a slide that says “we red teamed.” They want artifacts they can file or attach:

Test scope and methodology
Which features were in scope (chat, RAG, agents, tools), which standards you followed, and what was explicitly out of scope.

Findings with reproduction
Each issue should say how it was triggered, what data or tenant boundary was affected, and how to verify a fix. Prompt injection and tool abuse findings should include enough detail that engineering can retest without guessing.

Mapping to your obligations
For Annex III high-risk systems, evidence that ties findings to Article 15 cybersecurity expectations and to Article 9 testing within the risk-management system helps reviewers navigate Annex IV technical documentation. Scale includes a mapping pack for Articles 15 and 9 plus ISO/IEC 42001 alignment. Core delivers the same testing report; add the evidence pack for EUR 500 if you need the mapping on a one-time engagement.

Attestation and narrative
A short letter confirming the assessment ran, plus an attack narrative that shows chained impact, gives non-specialists a path through the report without reading every finding.

That bundle is what Faultline ships. It is designed to sit in the cybersecurity section of Annex IV documentation. It is not a CE mark, not a conformity assessment certificate, and not a substitute for your provider obligations under the AI Act.

How Faultline tests (and what you get)

We run EU AI Act adversarial testing as human-led engagements against your production-like environment:

  • Direct and indirect prompt injection, jailbreaks, and policy bypass attempts
  • Tool and API abuse where agents can call backends on a user’s behalf
  • Data leakage and cross-tenant isolation checks where RAG or memory is in scope
  • Coverage framed against OWASP LLM Top 10 and MITRE ATLAS

Core (EUR 1,500 per month, or the same once) fits one LLM feature (one chatbot, RAG search, or single agent). Active testing typically runs 3 to 5 business days for a one-time assessment.

Scale (EUR 2,500 per month, or the same once) covers up to three AI features or one multi-step agent, adds NIST AI RMF mapping per finding, and includes the EU AI Act Articles 15 and 9 plus ISO/IEC 42001 evidence pack.

Prepay 3, 4, or 12 months for 10%, 15%, or 25% off the monthly rate. Monthly plans include retests of remediated findings; one-time clients can add retest for EUR 400.

Timeline you should plan around

If you deploy or substantially modify an Annex III high-risk system, treat 2 December 2027 as the date Chapter III obligations (Articles 9 and 15 among them) apply under the FLI timeline derived from the Digital Omnibus amendments. Article 50 transparency rules are already live from August 2026, so customer-facing disclosure questions may arrive before high-risk conformity deadlines.

Use the lead time to run at least one full adversarial pass, remediate critical issues, and retain reports that show what you tested and what you fixed. A second pass before the deadline closes the loop auditors expect from Article 9-style testing.

Frequently asked questions

Does a Faultline report mean we are EU AI Act compliant?
No. It is technical testing evidence. Conformity assessment, classification, and legal interpretation stay with you and your advisors.

We only have one chatbot. Is that enough scope?
Often yes for a first pass. Core is built for a single surface. If agents call payment APIs or customer data stores, say so in scoping so trust boundaries are in scope.

Can we reuse pentest evidence for AI features?
Web app pentests and AI adversarial tests answer different questions. A clean API pentest does not show jailbreak resistance. Plan AI-specific testing where LLMs or agents touch user data or tools.

Is Scale required for Article 15 mapping?
Scale includes the Articles 15 and 9 and ISO/IEC 42001 mapping pack. On Core you can add the same pack for EUR 500 on a one-time assessment.

Faultline Security runs EU AI Act adversarial testing for European B2B SaaS teams. Scope an AI red team assessment