AI security 2026: complete framework (5 layers, AI Act, ISO 42001)

In one sentence

Securing AI in 2026 isn't limited to protecting the API or adding filters: you need to govern the entire chain : training data, infrastructure, model, deployment, continuous monitoring, according to a structured framework aligned with the AI Act, NIST AI RMF, ISO 42001. Without this framework, your AI project is both technically vulnerable AND legally exposed.

🛡️

The analogy that works

An AI project is like a food supply chain. A steak that arrives contaminated on your plate could have been corrupted at any stage: the farm (data), the slaughterhouse (training), transport (deployment), the restaurant (inference), or the server (end user). Each stage has its own risks and its own controls. You can't trust your steak by looking only at the plate : you need to validate the entire chain. Same for your AI: defense-in-depth + complete governance.

🎯 First understand the main attacks

Our complete guide on prompt injection (#1 OWASP).

Prompt injection: complete guide

The trust chain of an AI project

AI trust chain: 5 links to secure

Each link has its own risks. The weakest link defines overall security.

STRIDE-AI model: analyzing threats by category

STRIDE-AI: threat modeling adapted for AI

Adaptation of Microsoft's STRIDE model (1999) to AI specifics. For each category: examples and mitigations.

The 60-point AI security checklist

📚Exhaustive checklist (by layer) : to integrate into your governance

📊 Layer 1: DATA SECURITY (12 points)

Training data

[ ] Complete inventory of training sources
[ ] Verification of no PII (DLP scanning)
[ ] Copyright detection (LAION-5B style filters)
[ ] Hash + signature of each versioned dataset
[ ] Documented provenance (data lineage)
[ ] Poisoning tests (statistical anomalies)

RAG corpus

[ ] Explicitly whitelisted sources
[ ] Chunks tagged with confidence level
[ ] Periodic re-indexing with validation
[ ] Injection detection during ingestion
[ ] Versioning + rollback possibility
[ ] Encryption at rest (vector DBs)

🏗️ Layer 2: INFRASTRUCTURE SECURITY (12 points)

Compute

[ ] GPU isolation (secure multi-tenant if cloud)
[ ] Hardware attestation (TPM, SGX if available)
[ ] Secret management (Vault, AWS KMS, Azure Key Vault)
[ ] Network segmentation (private VPC, no public IP on GPUs)

Supply chain

[ ] Verification of downloaded model signatures
[ ] ML SBOM (Software Bill of Materials)
[ ] Pin dependency versions (HF datasets, transformers)
[ ] Regular vulnerability scans (Snyk, Dependabot)
[ ] CodeQL / SAST on ML code

Storage

[ ] Encryption at rest (models, datasets)
[ ] Encryption in transit (mTLS everywhere)
[ ] Encrypted backup + 3-2-1 rule
[ ] S3/Blob audit logs

🧠 Layer 3: MODEL SECURITY (12 points)

Weights protection

[ ] Proprietary models: encryption + scoped access
[ ] Watermarking (for model stealing detection)
[ ] API rate limiting to prevent extraction
[ ] Model serving in TEE (Trusted Execution Environment) if critical

Fine-tuning

[ ] Validated fine-tune data (no PII, no copyright)
[ ] Regression tests after fine-tuning
[ ] Safety evaluation (refusal rates, bias)
[ ] Versioning + rollback

System prompts

[ ] Audit by minimum 2 people
[ ] Robustness tests (prompt injection)
[ ] Git versioning
[ ] No secrets in system prompt

🚀 Layer 4: DEPLOYMENT SECURITY (12 points)

API

[ ] Strong authentication (OAuth, scoped API keys)
[ ] Rate limiting (per user, per IP, per endpoint)
[ ] Input validation + sanitization
[ ] Output filtering (DLP, PII redaction)
[ ] mTLS for server-to-server calls
[ ] WAF with LLM-aware rules

Agents

[ ] Whitelist of authorized tools (allowlist, not blocklist)
[ ] Strict sandboxing of actions
[ ] Per-session quotas (max emails/transactions)
[ ] Human-in-the-loop for critical actions
[ ] Exhaustive logging (every tool call)
[ ] Validation of tool outputs before returning to LLM

👁️ Layer 5: OPERATIONAL SECURITY (12 points)

Monitoring

[ ] Centralized logs (AI-aware SIEM)
[ ] Anomaly detection (volume, patterns, costs)
[ ] Real-time alerts (jailbreak attempts, data leaks)
[ ] AI security dashboard (coverage, MTTR, MTTD)

Incident response

[ ] AI-specific playbook (different from classic IR)
[ ] AI crisis communication (GDPR 72h, AI Act)
[ ] AI forensics (can we reproduce the incident?)
[ ] AI post-mortem template

Continuous

[ ] Monthly red-teaming
[ ] Annual third-party pen-test
[ ] AI threat intel (new jailbreaks, vulnerabilities)
[ ] Annual team training (10h+ per dev)

The 90-day AI security programme

🚀 Roadmap starting from zero (90 days)

Month 1 : Inventory & Threat Modeling Weeks 1-2: Inventory of all AI usage in the company (shadow AI included) Week 3: STRIDE-AI threat modeling for the 3 most critical use cases Week 4: Gap analysis vs AI Act / NIST AI RMF / ISO 42001 Month 1 deliverables: inventory doc, threat model, gap analysis, remediation plan Month 2 : Quick Wins & Foundations Week 5: Deploy exhaustive logging (all prompts/responses logged) Week 6: Input classifier (Lakera Guard or equivalent) Week 7: System prompt hardening + audit Week 8: Agent tool allowlist + sandboxing Month 2 deliverables: monitoring deployed, classifier in place, agents sandboxed Month 3 : Red-team & Compliance Week 9: 1st internal red-team (based on OWASP LLM Top 10) Week 10: Patch critical findings + retesting Week 11: Compliance documentation (AI Act registers if applicable) Week 12: EXEC presentation + year N+1 investment plan Month 3 deliverables: red-team report, patches, compliance doc, approved budget Total 90-day budget: ~£50K for SMEs, ~£150K for mid-market (including tools, partial team salaries, external consulting).

The 7 fatal mistakes that sink a programme

🚫 What you must NOT do

1. Treat AI like traditional software AI has unique risks (hallucinations, bias, prompt injection). Blindly reusing ISO 27001 controls = missing 60% of real risks. 2. Rely entirely on the "right model" "We use GPT-5, it's secure" = dangerous naivety. No model is inherently secure. Security comes from the layers around it. 3. Confuse safety and security Safety = avoid harmful outputs (toxic, biased). Security = prevent attacks. Both are necessary but different. 4. No executive governance Without an engaged CISO or board, the programme stagnates after 6 months. AI security = C-level topic. 5. Total outsourcing to a provider An annual consultant audit does NOT replace an internal team. Knowledge stays in-house. 6. Skip red-teaming "We have a classifier, we're OK." Wrong. Without regular red-teaming, you don't know if your classifier actually works. 7. Ignore shadow AI Your employees are already using personal ChatGPT/Claude with corporate data. You don't control it, but it's your responsibility.

2026 tools by layer (recommendations)

Recommended 2026 AI security stack

	🛡️Layer / Need	🛠️Recommended tools
Input filtering / classifier	Detect prompt injections upstream	Lakera Guard, Protect AI, Azure prompt-shield, Rebuff (OSS)
Output filtering / DLP	Prevent PII/secret leaks in output	Microsoft Purview, Nightfall AI, Presidio (OSS)
Red-teaming / adversarial testing	Find vulnerabilities proactively	Garak (NVIDIA, OSS), PyRIT (MS, OSS), Lakera Red, Robust Intelligence
Monitoring / observability	Trace prompts, detect anomalies	LangSmith, Helicone, Datadog LLM, Splunk SOAR
Bias / fairness testing	Detect bias in outputs	AI Fairness 360 (IBM, OSS), Fairlearn (MS, OSS), Holistic AI
Model governance / lineage	Trace data → training → model → deployment	Weights & Biases, MLflow, ClearML, DVC
Compliance / audit	AI Act / ISO 42001 / NIST	Credo AI, Holistic AI, OneTrust AI Governance
Vector DB security	RAG corpus security	Pinecone (managed), Qdrant (OSS), pgvector + pg row-level security

The metaphor that sums it all up

🚢

Like a modern aircraft carrier

A modern aircraft carrier is NOT just the flight deck where aircraft land. It's a system with: - 🚢 The hull (infrastructure: compute, storage) - ⚓ Holds and fuel depots (data: training, RAG) - ✈️ The aircraft (models: weights, fine-tunes) - 🎯 Weapon systems (deployment: APIs, agents) - 📡 The CIC (Combat Information Center) = monitoring, IR - 👨‍✈️ The staff + protocols = governance No aircraft carrier survives at sea by focusing on just one aspect. Same for your AI in production: it's a system, you need to govern all layers. The companies succeeding with AI in 2026 = those who have understood this systemic nature. The others are vulnerable, not a question of if, but when.

Key takeaways

✅ 5 layers to secure: Data + Infrastructure + Model + Deployment + Operational
✅ STRIDE-AI = threat modeling framework (S, T, R, I, D, E)
✅ Frameworks: combine AI Act + NIST AI RMF + ISO 42001 + OWASP LLM Top 10 + MITRE ATLAS
✅ 90-day programme: Inventory → Quick Wins → Red-team → Compliance
✅ Budget: £50-250K/year for SMEs, £500K-3M/year for mid-market/large enterprises
✅ 2026 stack: Lakera Guard + Garak + LangSmith + Datadog + Credo AI = solid foundation
✅ NEVER: rely entirely on "the right model", confuse safety/security, ignore shadow AI, skip red-teaming, outsource 100%

If your company deploys AI in production without this framework, you're not taking a calculated risk, you're playing Russian roulette with your legal compliance, your reputation, and your data.

🧠 Quiz

Question 1 of 3

What are the 5 layers of a complete AI security framework?

To go further

🎯 Prompt injection: the critical flaw, the deployment layer
🔴 AI red-teaming, the operational layer
🛡️ Securing your enterprise, simplified version for managers

Securing an AI project end-to-end: complete 2026 framework