Guidelines for secure AI system development
Guidelines for providers of any systems that use artificial intelligence (AI), whether those systems have been created from scratch or built on top of tools and services provided by others.
Pages
Page 9 of 9
About this document
This document is published by the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), and the following international partners:
- National Security Agency (NSA)
- Federal Bureau of Investigation (FBI)
- Australian Signals Directorate’s Australian Cyber Security Centre (ACSC)
- Canadian Centre for Cyber Security (CCCS)
- New Zealand National Cyber Security Centre (NCSC-NZ)
- Chile's Government CSIRT
- National Cyber and Information Security Agency of the Czech Republic (NUKIB)
- Information System Authority of Estonia (RIA)
- National Cyber Security Centre of Estonia (NCSC-EE)
- French Cybersecurity Agency (ANSSI)
- Germany’s Federal Office for Information Security (BSI)
- Israeli National Cyber Directorate (INCD)
- Italian National Cybersecurity Agency (ACN)
- Japan’s National center of Incident readiness and Strategy For Cybersecurity (NISC)
- Japan’s Secretariat of Science, Technology and Innovation Policy, Cabinet Office (CSTI)
- Nigeria's National Information Technology Development Agency (NITDA)
- Norwegian National Cyber Security Centre (NCSC-NO)
- Poland Ministry of Digital Affairs
- Poland’s NASK National Research Institute (NASK)
- Republic of Korea National Intelligence Service (NIS)
- Cyber Security Agency of Singapore (CSA)
Contributing organisations
The following organisations contributed to the development of these guidelines:
- Alan Turing Institute
- Amazon
- Anthropic
- Databricks
- Georgetown University's Centre for Security and Emerging Technology
- Google DeepMind
- Hugging Face
- IBM
- ImBue
- Inflection
- Microsoft
- OpenAI
- Palantir
- RAND
- Scale AI
- Software Engineering Institute at Carnegie Mellon University
- Stanford Center for AI Safety
- Stanford Program on Geopolitics, Technology and Governance
Disclaimer
The information in this document is provided ‘as is’ by the NCSC and the authoring organisations who shall not be liable for any loss, injury or damage of any kind caused by its use save as may be required by law. The information in this document does not constitute or imply endorsement or recommendation of any third party organisation, product, or service by the NCSC and international partners. Links and references to websites and third party materials are provided for information only and do not represent endorsement or recommendation of such resources over others.
This document is made available on a TLP: CLEAR basis (https://www.first.org/tlp/).