Rule set sha256:8425ad0448a8
rego-art55-1d-001
One rule of the rule set with digest 8425ad0448a8b5d482b8dabfc7bdd33c8c32cbd5f3b9c1e36e71a8a905fbd467. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
rules/rego/complyedge/gpai/cybersecurity_gpai.rego
- Citation
- Regulation (EU) 2024/1689, Article 55(1)(d)
- Condition
- A general-purpose AI model with systemic risk, or its physical infrastructure, left without adequate cybersecurity protection.
- Layer 1 detects
- as adjacent words, "systemic risk" (also "systemic-risk"), then gpai or model, then without or no, then cybersecurity or "adequate security", optionally followed by protection, measure or control; and no, without or inadequate, then cybersecurity, then protection or measure (singular), optionally "for", optionally "the", then model, gpai or "physical infrastructure". It matches wording, not meaning: it misses a gap in protection told in other words or in the plural ("no cybersecurity measures for the model"), and it fires on text that only names the gap, such as a refusal or an audit finding with its fix. Whether a model with systemic risk lacks adequate cybersecurity protection is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- approved