Aligned to the frameworks your board and regulators expect.

• Security testing

  OWASP Top 10 for LLM Applications

  What it is

  A community-maintained list, published by the OWASP GenAI Security Project, of the most critical security risks for applications built on large language models, such as prompt injection, sensitive information disclosure, excessive agency and system prompt leakage.

  How we use it

  Our LLM and RAG test cases and findings are mapped to the categories that apply to your deployment, so you can see which recognised risks were tested and what was found.

• Threat modelling

  MITRE ATLAS

  What it is

  A knowledge base of adversary tactics and techniques against AI-enabled systems, maintained by MITRE and modelled on the ATT&CK framework.

  How we use it

  We use ATLAS to structure threat modelling and to describe attack paths in a shared vocabulary your security team can relate to their existing threat intelligence.

• AI risk management

  NIST AI Risk Management Framework

  What it is

  A voluntary framework from the US National Institute of Standards and Technology for managing risks from AI systems, organised around four functions: Govern, Map, Measure and Manage.

  How we use it

  Assessment findings can serve as evidence for the Map and Measure functions and inform the risk treatment decisions you make under Manage.

• AI management system

  ISO/IEC 42001

  What it is

  The international standard specifying requirements for an AI management system: how an organisation governs, assesses and treats the risks of the AI it develops or uses.

  How we use it

  Findings are framed so they can feed the AI risk assessment and risk treatment processes in your management system. Quinine Cybersecurity does not certify clients against it; certification is a matter for accredited bodies.

• Information security management

  ISO/IEC 27001

  What it is

  The international standard for information security management systems, which many enterprise clients and suppliers already work within.

  How we use it

  We express AI-specific risks in terms that fit your existing information security risk register and controls, so AI deployments sit inside the governance structure you already run.

• Data protection

  UK GDPR and the Data Protection Act 2018

  What it is

  UK data protection law, which applies when an AI system processes personal data, including requirements for the security of processing and for data protection by design.

  How we use it

  Testing provides evidence about how personal data could be exposed through AI systems, for example through prompts, retrieval or output, to inform your data protection impact assessments and controls. It is not legal advice.

• Regulation

  EU AI Act

  What it is

  Regulation (EU) 2024/1689 sets risk-based rules for AI systems placed on the EU market or whose output is used in the EU, which can include UK organisations. High-risk systems carry requirements that include accuracy, robustness and cybersecurity.

  • 1 August 2024Entered into force.
  • 2 February 2025Prohibited practices and AI literacy obligations apply.
  • 2 August 2025Obligations for general-purpose AI models and governance rules apply.
  • August 2026Most remaining provisions apply, including transparency obligations.
  • 2 December 2027High-risk requirements for systems listed in Annex III, as postponed by the Digital Omnibus on AI, Regulation (EU) 2026/1744.
  • 2 August 2028High-risk requirements for AI in products covered by EU product legislation (Annex I), as postponed by the same Regulation.
  How we use it

  Technical testing can provide evidence for readiness work on robustness and cybersecurity. Whether and how the Act applies to a system, and its risk classification, should be confirmed with your legal advisers.

Regulatory dates reflect the EU AI Act as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, as at October 2026. This page is general information, not legal advice.