OWASP Top 10 for LLM 2026, MITRE ATLAS and the AI Act: the checklist
Whoever secures your AI should be able to answer a few precise questions: which AI systems are in use (inventory and shadow AI), how prompts and responses are controlled, how data going to the models is protected, how agents and copilots are monitored, which assessment has been done against the OWASP Top 10 for LLM and MITRE ATLAS, and which AI Act obligations apply to you. This guide lines up the references and closes with a ten question checklist.
The ten OWASP Top 10 for LLM entries, 2026 edition
The 2026 edition of the Top 10 for LLM Applications was published on 3 August 2026. The reference is the document of this edition, not the project hub page, which still stops at the 2025 version. The ten entries, in short:
- Prompt Injection. Hostile instructions, direct or hidden in content the model reads, steer the behaviour of the application.
- Sensitive Information Disclosure. The model returns confidential data present in training, in the context or in the connected tools.
- Excessive Agency. The agent is given permissions, tools or autonomy beyond what it needs.
- Supply Chain. Compromised or unverified models, datasets, plugins and third-party components.
- Data and Model Poisoning. Data or weights manipulated to alter the behaviour of the model.
- Unbounded Consumption. Uncontrolled use of resources: runaway costs, denial of service, model extraction.
- Misinformation. Plausible but false answers on which the company bases decisions.
- Hidden Context Exposure. System instructions and hidden context that can be extracted.
- Vector and Embedding Weaknesses. Weaknesses in retrieval systems: shared indexes without access control, manipulated embeddings.
- Improper Output Handling. Model output used without validation by other systems, with effects downstream.
The official order and numbering should be checked on the OWASP document before citing them in an assessment, which is why the entries carry no number here.
One thread runs through all of them: the application treats instructions and data in the same channel. That is why our line is to detect and contain, not to promise elimination. The operating picture is on the AI Security page.
Top 10 for Agentic Applications 2026
In 2026 OWASP also published a Top 10 for agentic applications, with entries from ASI01 to ASI10. Agents add risks of their own: identity, permissions, tool chains and decisions taken with no human in between. It should be read alongside the Top 10 for LLM, not instead of it.
MITRE ATLAS
MITRE ATLAS is a knowledge base of tactics and techniques used against AI systems, built in the spirit of ATT&CK and grounded in observed cases. It is useful for two purposes: reasoning like the adversary during an assessment, and giving techniques a common name when writing a detection. Where a SOC already works with ATT&CK, ATLAS fits the same way of working.
AI Act: the timetable after the Digital Omnibus
Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026, rewrote the AI Act timetable (Regulation (EU) 2024/1689). The dates to keep in mind:
| Obligation | Date |
|---|---|
| General-purpose AI models (GPAI) | from 2 August 2025, with penalties from 2 August 2026 |
| Transparency, Article 50 | from 2 August 2026 |
| New prohibitions of Article 5 | from 2 December 2026 |
| High-risk systems of Annex III | from 2 December 2027 |
| High-risk systems of Annex I | from 2 August 2028 |
For security the reference is Article 15: accuracy, robustness and cybersecurity of high-risk systems throughout the lifecycle. Organisations that neither develop nor integrate high-risk systems have different obligations, but still need to know which role they hold, provider or deployer.
The financial sector
In credit, assessing the creditworthiness of natural persons (credit scoring) is a high-risk use under Annex III, point 5(b), of the AI Act itself, excluding systems used to detect financial fraud. The EBA note of 21 November 2025 maps the AI Act requirements against those already in force for banks, but does not classify systems. For what supervisors ask about AI in banks and insurers, see cybersecurity for banking and finance.
National authorities
Each Member State designates its own authorities for the AI Act, and for financial entities these are usually the existing supervisors. Check the designation in the country where you operate: the text of the national law prevails over any summary.
ISO/IEC 42001 and the NIST AI RMF
These are voluntary governance references. ISO/IEC 42001 defines an AI management system; the NIST AI RMF offers a structured way to map, measure and manage risk. Neither is an obligation, and neither replaces technical controls: they frame them. Fortgale does not attest compliance with either. The technical evidence produced by the service can feed the process that adopts them.
The checklist: what to ask whoever secures your AI
Ten questions for the provider, internal or external, to whom you entrust the security of AI systems:
- Is there an inventory of the AI systems in use, including applications adopted by individual departments (shadow AI)?
- How are prompts and responses controlled, and what happens when hostile content is detected?
- What permissions do agents and copilots have, and who approved them?
- How is the data sent to the models protected, and the data the models can return?
- Are agent identities and OAuth tokens monitored like human identities? See Identity Protection.
- Are permissions and data classification in order in the Microsoft 365 environment where Copilot works? See Microsoft 365 security.
- Have internal LLM applications been assessed against the OWASP Top 10 for LLM and MITRE ATLAS?
- Who watches the alerts of these systems, at what hours, and with what detection and containment times?
- Which AI Act obligations apply to you, in which role, and who answers for them inside the company?
- What are you handed: verifiable technical evidence, or a promise of compliance?
For how AI enters SOC and MDR work instead, read AI in cyber defence.
A framework is useful when it becomes a question someone can answer. Put these ten questions to whoever secures your AI: the answers tell you where you stand.
Frequently asked.
Does the AI Act apply to companies that use Copilot?
It depends on your role. An organisation using an AI system under its own authority is a deployer, with obligations of its own: for example transparency for the uses covered by Article 50 and, if the system is high-risk, the Annex III obligations. Using a general assistant in the office is not high-risk in itself, but it is worth listing what is used, and for what purpose, before concluding that the regulation does not concern you.
Is the OWASP Top 10 for LLM a mandatory standard?
No. It is an industry reference, not a rule: no law requires it. It works as a common language for the risks of applications built on language models and as a backbone for an assessment. Binding obligations come from the law, for example the AI Act.
What changes with the 2026 edition?
The 2026 edition of the Top 10 for LLM Applications, published on 3 August 2026, replaces the 2025 one. For an assessment, use the current version and check the list and the order of the entries on the official document, because they change from one edition to the next.
Are MITRE ATLAS and OWASP alternatives?
No, they complement each other. OWASP lists the risk categories of LLM applications; MITRE ATLAS describes tactics and techniques used against AI systems, in the style of ATT&CK. The first helps choose what to check, the second to reason about how an adversary acts.
Does Fortgale certify compliance with the AI Act?
No. Fortgale provides technical evidence on the security of AI systems, reported in the portal. The assessment of compliance and adequacy stays with your board and control functions.
From theory to a real operation.
What you read here, Fortgale runs every day with a European SOC 24·7·365: 287 tools and actors profiled, <30 min median containment. Explore the service: AI Security.
Related resources: AI in cyber defence · Microsoft 365 security · Why identity protection (ITDR)
A technical conversation, not a funnel.
Leave your details: an analyst calls you back within one business day. European SOC, same time zone, proprietary intelligence on the actors active across the EU.