--- title: The EU AI Act and the Need for Data-Centric Security description: "Navigating the European AI Act: How Data-Centric Security Enhances Compliance and AI Protection" image: https://insights.comforte.com/hubfs/comforte%20AG_The%20EU%20AI%20Act%20and%20the%20Need%20for%20Data-Centric%20Security%20_19.09.png --- [![Hubspot\_blog\_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe to comforte Insights](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![comforte AG - The EU AI Act and the Need for Data-Centric Security](https://insights.comforte.com/hubfs/comforte%20AG_The%20EU%20AI%20Act%20and%20the%20Need%20for%20Data-Centric%20Security%20_19.09.png)](https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security) [Erfan Shadabi](https://insights.comforte.com/author/erfan-shadabi) l Sep 19, 2024 l [Data Protection](https://insights.comforte.com/tag/data-protection), [AI](https://insights.comforte.com/tag/ai) # The EU AI Act and the Need for Data-Centric Security Artificial intelligence (AI) is already embedded deep into the economic and social fabric of the world. It does everything from operating website chatbots to authenticating users with their bank. It keeps planes in the sky and cars on the road. It identifies criminals and reviews mortgage and job applications. But as it becomes more important to our daily lives, regulators are getting nervous. In Europe, they have produced the world’s first comprehensive AI regulation: [the EU AI Act.](https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence) Among many other things, it will mandate providers of general-purpose AI (GPAI) and high-risk AI to maintain high levels of cybersecurity. Whatever the AI, these plans should begin with protecting the data it's trained on. ## What the AI Act says The EU AI Act classifies AI technology according to risk. Systems labelled as posing “unacceptable risks,” such as social scoring and real-time facial recognition, are prohibited. High-risk systems are subject to strict compliance requirements, as are certain GPAI systems. Limited-risk AI developers must only alert users to the presence of the tech in their systems. **High-risk systems** include those deployed in biometrics, critical infrastructure, public services, education and democratic processes. According to [legal experts](https://artificialintelligenceact.eu/high-level-summary/), the providers of such systems must deploy risk management processes, carry out data governance, and ensure they “achieve appropriate levels of accuracy, robustness, and cybersecurity.” **GPAI** models are thus named because they can perform a wide range of tasks in downstream systems and applications. Providers must draw up detailed technical documentation about training, testing, evaluation and more. However, GPAIs that pose “systemic” risks must also have measures in place to assess and mitigate these risks, track, document, and report serious incidents, as well as [ensure an](https://www.dechert.com/knowledge/onpoint/2024/5/the-eu-ai-act--an-overview.html) “adequate level” of cybersecurity protection. ## What could go wrong? Any cybersecurity measures such as these should begin with data protection. Why? Because it is data that makes AI models what they are. This data is also potentially valuable to threat actors. It might be financial or personal information that could be used to commit identity theft. It could be intellectual property, which can give rival organizations a competitive advantage. Or it could be corporate or personal data that malicious actors could use to extort victims with. Hackers could also look to access, delete and alter that data, or even insert new data into it, in order to manipulate or sabotage the model’s operation. These are known as “data poisoning” attacks. These scenarios could cause major financial and/or reputational damage to the AI provider and any downstream corporate users. In the case of data poisoning, there could even be a physical safety risk, depending on the context. There’s also a compliance risk from unauthorized third parties accessing sensitive training data. ## How data-centric security works That’s why mitigating AI risk should always begin with a data-centric security strategy. This starts with continuous, automated data discovery, classification, and protection that are in line with policy. It means that, wherever sensitive data resides in the organization, it is protected in a way (ie tokenization, encryption) that will render it useless to any third-party hacker. Next should come additional protections such as: - Robust role-based access controls and multi-factor authentication (MFA) - Data loss prevention (DLP) - Continuous monitoring and real-time auditing - Regular security training for employees - A comprehensive data governance framework The EU AI Act is a first-of-its-kind piece of regulation. But it certainly won’t be the last. Organizations with a presence inside the bloc, and those which want to meet the highest standards of AI safety and security, are already working hard to see how they can comply. Is your organization? --- | Share this: | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/the-eu-ai-act-and-the-need-for-data-centric-security&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Learn how to discover, classify, and protect all sensitive data. Click the button below to download the solution brief for our Data Security Platform: [![Download Solution Brief](https://no-cache.hubspot.com/cta/default/4026697/65e094b1-44ae-496e-be17-1678a1876675.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/65e094b1-44ae-496e-be17-1678a1876675) ### Related posts ![Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/hubfs/comforte%20AG_%20Reuse%20Reward_%20How%20Banks%20Can%20Safely%20Unlock%20the%20Value%20of%20Their%20Data_03.2025.png) Mar 12, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Payments Transformation](https://insights.comforte.com/tag/payments-transformation) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) The financial world is awash with data. But too few organizations are able to use it effectively. In [Bank Director’s *2025 Technology Survey*](https://www.bankdirector.com/wp-content/uploads/2025/09/2025TechReport-OpenVersion.pdf), one-third of US banking leaders cite an inability to harness data as a top technology challenge facing their... [Read more](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) ![Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/hubfs/comforte%20AG_Delivering%20a%20Secure%2c%20Trusted%20Foundation%20for%20Cloud%20Growth%20at%20LGT_01.2026.png) Jan 15, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) There’s a world of difference between retail and private banking. While the former is transactional and focused on the mass market, the latter is built on trust and personal relationships. That trust can be hard won, but is easily lost, especially... [Read more](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) ![Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/hubfs/comforte%20AG_Top%20Indicators%20You%20Have%20a%20Cybersecurity%20Problem_and%20What%20to%20Do%20About%20It.png) May 22, 2025 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Digital Enablement](https://insights.comforte.com/tag/digital-enablement) ### [Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) Data is both blessing and curse to the modern enterprise. Yes, when analyzed effectively it can surface intelligence to improve decision making, customer engagement, process efficiency and, ultimately, drive revenue. But it also represents a major... [Read more](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### EMEA comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Asia-Pacific comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### Americas comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Southeast Asia comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026