Prompt injection and the EU AI Act: the robustness duty in Article 15
The AI Act does not name prompt injection. Article 15 asks high-risk AI systems to be "resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities". For agents that read untrusted content, injected instructions may be such an attempt. The duty applies to Annex III systems from 2 December 2027.
The text
- Article 15(1): "High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle."
- Article 15(5), first subparagraph: "High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities."
- Article 15(5), third subparagraph, names "inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion)" among the attacks to prevent, detect, respond to, resolve and control for.
When it applies: Article 15 sits in Chapter III, Section 2. That section applies from 2 December 2027 for Annex III uses such as hiring and staff monitoring, and from 2 August 2028 for Annex I products (Art. 113, point (c)).
What injection looks like in an agent: instructions hidden in content the agent reads, such as a web page, an email or a tool result, that try to change what the agent does next. One example: a page telling an assistant to download and run a file.
Controls teams use. The Act names the outcome, not these controls.
| Control | What it does |
|---|---|
| Treat tool output as data | Content the agent reads is never followed as an instruction |
| Check actions before they run | Each tool call or message is checked before it executes |
| Least privilege | The agent gets only the tools and data the task needs |
| Human approval for high-impact actions | Payments, deletions and messages to many people wait for a person |
| Logs | A record of what the agent read, decided and did |
| Adversarial testing | Test runs with injected content before each release |
If your agent is not high-risk: Article 15 does not apply to it, but the Article 5 bans still apply, and Article 50 may.
Sources:
- Regulation (EU) 2024/1689, Article 15, and Article 113 for the dates: http://data.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 for the dates: http://data.europa.eu/eli/reg/2026/1744/oj
As of 28 October 2026. This page explains the text of the Act. It is not legal advice.