Prompt injection: a security flaw is also a compliance duty

Prompt injection is an AI-specific security risk: attackers use crafted inputs to make a model leak data or take unintended actions. It is both a security and a potential compliance issue.

If weak defenses lead to a personal-data leak, they may trigger data-security duties and notification obligations.

Fold prompt injection into security testing and red-teaming, limit permissions for agent features, and keep defense and response records as evidence of diligence.