Evidence robustness / resilience

Design the system to be as resilient as possible to errors, faults and inconsistencies, and to attempts at manipulation (adversarial examples, data/model poisoning); maintain a defensible robustness test plan and results.

Applies to

Provider

Scope

High-risk (Annex III use case), High-risk (Annex I regulated product)

Applies from

2027-12-02 — Stand-alone high-risk (Annex III) obligations apply

Derives from

Article 15

Primary source

Art. 15 AIA

Evidence an auditor expects

• Robustness test plan & results — A defensible plan and dated results showing resilience to errors, edge cases and adversarial manipulation.
• Annex IV technical file — The full technical documentation package; primary evidence at conformity assessment; must be a living, versioned document.

Audit red flags

FAQ

What evidence do I need for Article 15?
Robustness test plan & results, Annex IV technical file. Each should be contemporaneous, versioned, and traceable to the system version.

When does “Evidence robustness / resilience” apply?
From 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply. It applies to: Provider.

What fails an audit here?
Documentation created after the fact rather than contemporaneously with the decision — national competent authorities apply the contemporaneous standard.; No clear version control / traceability between document versions and system versions.

Legal source

Art. 15 AIA

Explained in the newsletter

• Article 15: measuring accuracy, testing robustness, evidencing cybersecurity

Not legal advice. This is a practitioner reference generated from a cited knowledge base built on the primary legal text and official Commission guidance. Verify against the cited primary sources before relying on it for a compliance decision. See editorial standards & methodology.