Guidelines for Secure AI System Development
A secure-by-design guide for building, deploying, and maintaining AI systems, including applications built on third-party models.
Published by UK National Cyber Security Centre, CISA, and international partners
How to use it
Use this guide to assign security work before an AI system launches. It covers design choices, model and dependency supply chains, deployment infrastructure, and what the operations team needs to monitor after release.
For an application that uses an external model API, map what data crosses that boundary and who can change the integration. Put an owner on model updates and incident handling so the handoff from engineering to operations is explicit.
- Access
- Public guidance