This document specifies the evaluation of natural language processing systems, in the sense of measuring the quality of a system’s results to assess its functional suitability. It provides a definition of evaluation methods for those systems, together with guidance on how to select, implement and interpret those evaluation methods. This document covers quantitative metrics as well as other evaluation methods. It includes requirements on the implementation of the described metrics, and further requirements on the technical resources involved in the evaluation process.

This document specifies methodologies for measuring the performance of AI models for classification, regression, clustering and recommendation tasks.

This document provides guidance and requirements for the creation and management of datasets in the context of AI, including design choices, data collection and preparation. It defines metrics and methodology to assess dataset quality characteristics such as representativeness, relevance, completeness and correctness. This encompasses consideration of any data, including training data, validation data and test data, and to be used in conjunction with any AI technology.

This document addresses organizational and technical solutions aimed at ensuring the cybersecurity of high-risk AI systems over the life cycle, appropriate to the relevant circumstances and the risks. The technical solutions to address AI-specific vulnerabilities include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training dataset (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws. This document provides objective criteria to enable decisions on whether a given technical or organizational solution adequately achieves a given vulnerability-related goal.

This document provides terminology, concepts, requirements, and guidance for robustness of AI systems. It is primarily intended for organizations placing on the market or putting into service AI systems and is not specific to any particular sector

This document provides terminology, concepts, requirements, and guidance for accuracy of AI systems. It is primarily intended for organizations placing on the market or putting into service AI systems and is not specific to any particular sector

This document provides terminology, concepts, requirements, and guidance for humanoversight of AI systems. It is primarily intended for organizations placing on the market or putting into service AI systems and is not specific to any particular sector;

This document provides terminology, concepts, requirements, and guidance for transparency of AI systems. It is primarily intended for organizations placing on the market or putting into service AI systems and is not specific to any particular sector

This document defines concepts, measures and requirements for assessment and treatment of bias in AI systems. This includes bias unwanted by the AI Provider and AI Deployer according to their specification of the AI system, in the context of the AI Act. This encompasses consideration of data bias including any data used to build or assess the AI system, but also system or model bias that can result from algorithmic factors, such as algorithm design choices.

This document specifies requirements and provides guidance for risk management of AI systems. It specifies terminology, principles and a process for risk management. The process described in this document intends to assist providers of AI systems to identify the hazards associated with the AI systems, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls. The process described in this document applies to risks to health, safety and fundamental rights associated with an AI system. The process described in this document is applied throughout the life cycle of the AI system. This document requires providers to establish objective criteria for risk acceptability but does not specify acceptable risk levels. This document is intended for use by organizations providing AI systems, regardless of their size, nature or location. This document is not intended for managing risk faced by organizations. This document is intended to support the organization in meeting applicable regulatory requirements.

This document aims to inform organizations for the application of the harmonised standards in support of the AI Act. This document provides information on the harmonised standards developed by CEN-CENELEC Joint Technical Committee 21, in response to the standardization request by the European Commission (C(2025) 3871). This includes the relationship of the harmonised standards to each other and the AI Act and provides an overview of key terms and definitions and related concepts. This document is informative and does not contain guidance or requirements. The document will not lead to presumption of conformity. This document will reference European Commission guidelines where appropriate. This document is aimed at all types of organisations providing high-risk AI systems and who are likely to use the harmonised standards when placing products or services on the EU market.

ISO/DIS 8102-20Electrical requirements for lifts, escalators and moving walks - Part 20: Cybersecurity

This document specifies cybersecurity requirements for new lifts, escalators and moving walks, referred to in this document as “equipment under control (EUC)”, designed in accordance with the ISO 8100 series. It is also applicable with other lift, escalator and moving walk standards that specify similar requirements, and to other lift-related equipment connected to the EUC.

This document specifies product and system requirements related to cybersecurity threats in the following lifecycle steps:

—    product development (process and product requirements);

—    manufacturing;

—    installation;

—    operation and maintenance;

—    decommissioning.

This document addresses the roles of product supplier and system integrator as shown in IEC 62443-4-1:2018, Figure 2, for the EUC.

This document does not address the role of asset owner as shown in IEC 62443-4-1:2018, Figure 2, but defines requirements for the product supplier and system integrator of the EUC to establish documentation allowing the asset owner, referred to as the “EUC owner” in this document, to achieve and maintain the security of the EUC.

This document specifies the minimum cybersecurity requirements for:

—    essential functions;

—    safety functions;

—    alarm functions.

This document is applicable to EUCs that are capable of connectivity to external systems such as building networks, cloud services, or service tools. The capability to connectivity can exist through equipment permanently available on site, or equipment temporarily brought to the location during the installation, operation and maintenance, or decommissioning steps.

EUC interfaces to external systems and services are in the scope of this document. External systems and services as such are out of the scope of this document.

This document does not apply to EUC that are installed before the date of its publication.