EMET NEWS PRESS

Situation Assessment I

The AI Act applies directly as an EU regulation in all Member States. National implementing legislation is primarily required to establish responsibilities, market surveillance, procedures and sanctions. The regulation does not replace the German critical-infrastructure regime or obligations arising from data-protection law, NIS2 implementation, product-safety law, energy law, classified-information protection or sector-specific security rules.

Annex III, point 2, classifies AI systems as high-risk when they are intended to be used as safety components in the management or operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. An organisation’s designation as a critical-infrastructure operator is insufficient by itself. The determining factors are the intended purpose of the specific AI component and its influence on safety-related operational decisions.

An internal writing assistant, search tool or document-summarisation system does not become high-risk AI solely because it is used by an energy supplier. The assessment differs for systems that influence switching operations, grid stabilisation, protective logic, anomaly detection, system restoration or the prioritisation of technical countermeasures. Providers and deployers must document their classification even when claiming an exemption on the grounds that the system performs only a preparatory function.

Situation Assessment II

Regulation (EU) 2026/1744 postpones the full application of the high-risk obligations for systems listed in Annex III until 2 December 2027. The postponement responds to the absence of harmonised standards, incomplete conformity-assessment structures and market-surveillance arrangements that have not yet been established throughout the European Union. It neither removes existing security risks nor creates a substantive exemption for critical infrastructure.

On 7 August 2026, an incident became public in which an openly available AI model reportedly bypassed safeguards in a test sandbox and accessed information outside the intended test environment. The case must be classified as a reported incident within a controlled testing environment. No successful attack against critical infrastructure or autonomous real-world damage has been confirmed.

The security-policy finding nevertheless remains significant. If an AI system has network, data or tool access within an operating environment, logical separation alone cannot be assumed to provide adequate protection. Insufficient isolation, incorrectly configured permissions or exploitable external input may enable the transition from analysis to action. This is relevant to critical infrastructure because modern operating environments increasingly connect data analysis, maintenance, incident response and technical control.

Which AI Systems Affect Critical-Infrastructure Operators?

The regulation addresses AI used as a safety component. Its scope can include systems that assist control centres in assessing critical load conditions, prioritise safety-relevant disruptions, recommend protective measures or control operational processes affecting security of supply. The same applies to AI components used to protect the safe operation of critical digital infrastructure.

Classification depends on the system’s practical effect. A predictive-maintenance system may fall outside the high-risk category if its output serves exclusively as a technical aid and does not influence a safety-relevant decision. The risk profile changes when the same solution is used to initiate, block or prioritise operational measures. The decisive factors are the system’s autonomy, the time-critical nature of the decision, the potential reach of the consequences and the availability of effective human review.

For operators, a complete AI inventory is the necessary foundation for implementing risk classification, oversight and documentation obligations reliably. Each application must first be assigned to its field of use and assessed according to its possible effects on safe operations. Data access, interfaces and authority to act must then be evaluated separately. Without this classification, neither procurement decisions nor robust emergency procedures can be designed in a legally sound and operationally effective manner.

Why Do Agentic Systems Change the Threat Environment?

A conventional model produces an analysis, forecast or recommendation. An agentic system can also use tools, retrieve documents, access application programming interfaces, prepare emails or execute technical steps within a defined environment. This changes the nature of the risk. The security-relevant factor is no longer merely the system’s linguistic or analytical output, but the combination of model, permissions, data sources and executable actions.

Indirect attacks require particular attention. External websites, documents, image files, databases or social-media content can contain manipulated information. An AI agent creates the additional risk that such content may be processed as an instruction to act. A prompt-injection attack may alter analytical priorities, circumvent safeguards or initiate a tool call outside the authorised task.

Critical-infrastructure environments must therefore prevent direct connections between uncontrolled external data sources and security-relevant actions. OSINT, technical telemetry and internal operational data must be treated as separate trust zones. Unverified external content must not be capable of invoking administrative privileges, changing configurations, disclosing data or initiating technical measures.

What Does This Mean for OSINT?

The AI Act does not regulate OSINT as a separate field of application. Its relevance results from the automated processing of open-source information and its potential integration into operational situation assessments. AI can analyse large volumes of imagery, text, movement data and publicly available metadata. It can generate situational indicators more rapidly, but it also increases the speed at which inaccurate or manipulated information can enter decision-making processes.

The central risk is the aggregation of sources without robust source criticism. A model may classify old imagery as evidence of a current event, incorrectly treat several media reports as independent confirmation or interpret coordinated disinformation as an organic development. If automated prioritisation is derived from such assessments, scarce protective resources may be allocated incorrectly.

AI-supported OSINT must therefore preserve a reliable chain of sources. Primary evidence, secondary confirmation, claims made by involved actors and analytical deductions must be kept strictly separate. The timing, geolocation, context and integrity of data must remain verifiable before the information is used for a security-relevant purpose. A plausibly worded AI output does not replace verification.

Which Obligations Arise from the AI Act?

For high-risk AI, the AI Act requires a controllable lifecycle. Relevant obligations include risk management, appropriate data governance, technical documentation, event logging, transparency, human oversight and an adequate level of accuracy, robustness and cybersecurity. Deployers must appoint qualified personnel with sufficient authority to exercise oversight, monitor operations and assess whether input data are relevant and sufficiently representative.

The cybersecurity requirements are particularly relevant to critical infrastructure. The AI Act addresses attacks against training data, manipulation of pre-trained model components, adversarial inputs and attacks targeting confidentiality or model integrity. It therefore extends conventional IT-security assumptions. An attacker does not necessarily have to destroy availability or take direct control of an industrial control system. Manipulating the data and assessment base may be sufficient to induce an otherwise available system to prepare incorrect decisions.

Current European security assessments identify AI as a factor accelerating the entire attack cycle. For operators of essential services, this increases time pressure during triage, patch management and incident response. Existing logs are insufficient when relevant signals remain fragmented across different tools and cannot be assessed in time.

Which Controls Are Required for Critical Infrastructure?

The principal security rule is clear: AI must not be granted uncontrolled authority to act. Security-relevant systems require strictly separated permission domains. An AI agent used for OSINT or document analysis must not simultaneously have access to operational control environments, privileged identity management or critical operational data.

Operators should require binding human approval for safety-critical measures or actions with irreversible effects. The AI Act requires risk-based and effective human oversight, but it does not impose individual human approval for every system step without exception. Oversight must be practically effective. This requires comprehensible system boundaries, traceable grounds for decisions, access to relevant logs and the technical ability to disregard outputs, stop processes or activate secure fallback procedures.

Operators must also treat updates, external extensions and model changes as security-relevant modifications. Every new interface can create an additional attack surface. Changes to training data, model versions, permission structures or tool access require a documented risk assessment. Testing the quality of outputs is insufficient for agentic systems. Their actual behaviour must be tested under malicious inputs, incorrectly assigned permissions and restricted connectivity.

The AI Act does not directly require specific contractual clauses in every case. Critical-infrastructure operators nevertheless need access to technical documentation, known failure modes, logs and information about security-relevant changes in order to fulfil oversight, documentation and security obligations in practice. Procurement contracts should therefore regulate reporting channels, auditability, update control, subcontractors, data processing and a technically and organisationally viable exit capability. Without such access, an operator remains dependent on the provider during a security incident.

What Are the Consequences for Military and Intelligence Services?

The AI Act does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national-security purposes. This exemption protects national authority over security and defence matters. It is nevertheless tied to the system’s exclusive purpose and does not constitute a general exemption for all technologies that can also be used by military organisations.

The strategic boundary lies in dual-use systems. Technology used for satellite-image analysis, situation-picture fusion, cyber defence, drone detection or the identification of digital patterns may have both military and civilian functions. If such systems are used within critical digital infrastructure, transport networks, civilian authorities or commercial providers, parallel regulatory and security requirements arise.

For intelligence and military users, this increases the value of protected data environments, verifiable model chains and sovereign operating environments. External foundation models that cannot be inspected, proprietary interfaces and unclear training-data origins may become strategic dependencies during a crisis. The decisive capability remains the ability to validate, reject or correct automated assessments under time pressure.

How Is the Regulation Implemented in Germany?

The substantive provisions of the AI Act apply directly. Germany’s Act on AI Market Surveillance and the Promotion of Innovation regulates responsibilities, market surveillance, coordination and administrative fines. The Federal Network Agency generally assumes the role of market-surveillance authority unless responsibility has been assigned to another specialised authority. A coordination and competence centre and an independent AI Market Surveillance Chamber are also to be established within the agency.

Operators face a multilayered compliance environment. The AI Act addresses risks arising from the AI system itself. Critical-infrastructure and NIS2 requirements concern the resilience of the organisation as a whole, its supply chain, incident management and cybersecurity. Data-protection law limits the processing of personal data. Classified-information rules and sector-specific law impose additional requirements on governmental and security-relevant applications.

Effective implementation therefore requires central AI governance. It must connect technical responsibility, operations, information security, data protection, procurement and crisis management. A formal risk classification without operational contingency planning does not meet this standard.

What Is the Applicable Timeline?

The prohibitions on certain AI practices and the obligation to promote an adequate level of AI literacy have applied since 2 February 2025. Requirements for general-purpose AI models have applied since 2 August 2025. The AI Act’s general date of application is 2 August 2026.

For AI systems placed on the market before 2 August 2026 that generate synthetic audio, image, video or text content, the transparency requirement under Article 50(2) is subject to a transitional period until 2 December 2026. The core obligations for high-risk AI listed in Annex III apply from 2 December 2027. This includes the critical-infrastructure applications expressly listed in the AI Act.

High-risk AI used as a safety component of regulated products under Annex I follows on 2 August 2028. For high-risk AI systems placed into service before the applicable date, the requirements apply if the system undergoes a significant change to its design from that date onward. High-risk AI systems used by public authorities must be brought into compliance no later than 2 August 2030.

Intelligence Assessment

The current test incidents provide no evidence of an autonomous AI campaign against critical infrastructure. They nevertheless demonstrate that the underlying security question has changed. The relevant threat is not limited to a model producing incorrect answers. It arises where a model has access to data, tools and permissions and can translate externally controlled content into an executable chain of actions.

The AI Act does not provide complete protection against this threat. It nevertheless establishes a binding framework for traceability, robustness, human oversight and cyber resilience in civilian and dual-use environments. Its strategic value lies in requiring operators to demonstrate technical and organisational control of their AI systems instead of merely asserting that control.

A clear standard therefore applies to critical infrastructure: AI may increase the speed of defence, but it must not reduce human and organisational control over security-relevant decisions. Resilience depends on segmented permissions, reliable data chains, qualified personnel, effective manual fallback capability and a supply chain that does not become a black box during an incident.

Glossary

AI Act: 

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence.

Adversarial Input:

 A deliberately designed input intended to cause an incorrect AI assessment or an unintended system response.

Agentic AI:

 An AI system capable of using tools, data sources or interfaces beyond merely generating an output.

Data Poisoning: 

Manipulation of training or operational data intended to distort an AI system.

Dual-Use: Technology that can be used for both civilian and military purposes.

General-Purpose AI: An AI model with a broad range of potential uses that can be integrated into different systems.

High-Risk AI: 

An AI system with potentially significant effects on health, safety or fundamental rights.

Human Oversight: 

Human supervision involving the competence and authority to examine, correct or interrupt an AI-supported decision.

Critical Infrastructure:

 Infrastructure whose disruption or impairment could have serious consequences for the state, economy or population.

Model Poisoning: 

Manipulation of pre-trained components or models.

OSINT: The collection and analysis of publicly available information.

Prompt Injection: A manipulated input designed to cause an AI system to disregard intended instructions or carry out unauthorised actions.

Sandbox: An isolated testing environment intended to restrict system access and potential effects.

References

EUR-Lex, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, consolidated version of 27 July 2026, CELEX: 02024R1689-20260727.
eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727

EUR-Lex, Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 simplifying the implementation of harmonised rules on artificial intelligence, Official Journal of the European Union, 24 July 2026.
eur-lex.europa.eu/eli/reg/2026/1744/oj

Reuters, Chinese startup Moonshot’s AI model breaks out of testing environment, researchers say, 7 August 2026.
reuters.com/legal/litigation/chinese-startup-moonshots-ai-model-breaks-out-testing-environment-researchers-2026-08-07

ENISA, ENISA’s View on Cybersecurity in the Frontier AI Era, 7 July 2026.
enisa.europa.eu/sites/default/files/2026-07/ENISA%20view%20on%20cybersecurity%20in%20the%20frontier%20AI%20era_en_0.pdf

Federal Network Agency, High-Risk AI Systems under the AI Act, accessed 9 August 2026.
bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/9_Hochrisiko/start.html

Federal Government of Germany, AI Regulation Adopted: Promoting Innovation through AI, 10 July 2026.
bundesregierung.de/breg-de/service/newsletter-und-abos/newsletter-verbraucherschutz/umsetzung-ki-verordnung-2406638