High-risk AI systems must reach an appropriate level of accuracy, robustness and cybersecurity, and keep it throughout their lifecycle. That is Article 15 of the EU AI Act. An AI agent with tools and live connections widens all three: an inaccurate answer can become an action, and an attacker can reach it through any document it reads.
What does Article 15 require?
Article 15 sets three performance duties for high-risk systems, all to be maintained for as long as the system is in use.
Accuracy. The system must be accurate enough for its intended purpose, and the levels and metrics must be declared in the instructions for use. The Act encourages common benchmarks and measurement methods, but the provider must state what it measured.
Robustness. The system must be resilient to errors, faults and inconsistencies, whether they arise inside it or in its environment, including from interaction with people or other systems. Technical redundancy and fail-safe plans are named as ways to achieve this. Systems that keep learning after deployment must be designed so that biased outputs do not feed back into future inputs.
Cybersecurity. The system must resist attempts by unauthorised parties to change its use, outputs or performance by exploiting vulnerabilities. The Act names AI-specific attacks: poisoning of training data or of pre-trained components, inputs designed to make the model err, attacks on confidentiality, and exploitation of model flaws.
Who must meet it?
Article 15 is a provider duty. If you build your own agent, or modify a bought one substantially enough to become its provider, it is yours. Our explainer on what a provider is under the EU AI Act sets out where that line falls.
Deployers carry the operational half. They use the system as instructed, monitor it, and feed back what they see. A deployer who connects an agent to new tools or sources changes its attack surface, and a provider's security claims rarely survive contact with connections they never tested.
What changes when the AI system is an agent with tools?
For a model that scores, accuracy is a number on a test set. For an agent, accuracy has at least three layers:
- Answer accuracy. Are the facts it states correct and grounded in its sources?
- Action accuracy. Did it call the right tool with the right parameters: the right payee, the right amount, the right record?
- Judgement accuracy. Did it refuse or escalate when it should have, and act when it should have?
The third is the one most test sets miss. An agent that answers correctly but never escalates is not accurate for a regulated purpose. Our guide to how to measure an AI agent's accuracy treats the three as separate scores.
Robustness also changes. An agent's output varies with wording, with the order of sources and with the state of the systems it reads. A fail-safe for an agent means a defined behaviour when a source is down, a tool returns an error or the agent's confidence is low: hold for a person, do not guess.
Cybersecurity changes most. The named attack of inputs designed to make the model err becomes, for an agent, prompt injection: an instruction hidden in an email, a web page or an uploaded document that tells the agent to send data or move money. Every source an agent reads is an input an attacker may control.
How do you meet Article 15 for an agent?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Declared accuracy levels | Separate scores for answers, actions and escalation, tested on cases from your own operation | Evaluation report per capability with the floor each must clear |
| Consistent over lifecycle | Re-test on each change of model, brief or source; scheduled re-certification | Dated test runs; expiry dates on each certification |
| Resilience to errors and faults | Defined fallback when a tool or source fails: hold, not guess | Records of held actions with the failure reason |
| No harmful feedback loops | Agent output is never written back as a trusted source without review | Source register showing which content is agent-generated |
| Resistance to manipulated inputs | Content from outside is marked as external and cannot authorise an action | Records showing the provenance of each fact behind an action |
| Limit damage if compromised | Each capability bounded by amount, counterparty and scope; irreversible actions need a person | Bound configuration and records of refusals |
| Redundancy | Agent can be stopped and work handed back to people without loss | Stop procedure, tested, with drill records |
Two controls do most of the security work. Marking where each fact came from means injected text cannot pass as an instruction from the business. Bounding what each capability can do means that even a manipulated agent cannot exceed a limit enforced outside the model.
Accuracy and security both depend on data quality, which Article 10 on data governance addresses, and the failure modes you find should feed the risk management system under Article 9.
What will a supervisor or auditor ask?
- What accuracy did you declare, how was it measured, and does production match it?
- How do you test whether the agent escalates when it should?
- What happens when a connected system is unavailable?
- Show us your testing against injected instructions in documents and emails.
- If the agent were manipulated, what is the most it could do?
- When was it last re-tested, and what triggered the test?
What does Article 15 not cover?
It does not set numeric thresholds; the provider declares levels appropriate to the purpose. It does not replace ISO/IEC 27001 or your general information security programme, and in financial services DORA still governs ICT risk, incident reporting and resilience testing for the systems agents run on. It does not apply as a legal duty to agents that are not high-risk. And it is silent on the firm's limits for each action, which are a business choice the Act expects you to make, not one it makes for you. For each agent, record which of these duties applies in your AI agent register for the EU AI Act, and see AI agent regulation, mapped to controls for the wider picture.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Attest certifies each agent by replaying it against real cases from the customer's operation, through seven gates scored separately, including grounded, escalates, scope and adversarial. A run that clears no depth drops the agent to depth 1 the same day, and certificates lapse after 90 days. That gives Article 15's lifecycle duty a schedule and a consequence.
Questions people ask
Is prompt injection covered by Article 15?
The Act does not use the term, but it names inputs designed to cause a model to make mistakes as an attack systems must resist. For an agent that reads outside content, prompt injection is the most direct form of that attack.
Can a deployer rely on the model provider's security testing?
Only for the model. Your agent's attack surface includes the sources and tools you connected, which the model provider never saw. Test the assembled agent, not the component.
How often should accuracy be re-tested?
On every material change to the model, brief, sources or connections, and on a fixed cycle otherwise. A fixed expiry on certification stops an agent running on old evidence.