Prompt injection, OWASP's LLM01, is not written into any compliance framework by name in the sources we read, but it lines up with existing duties. NIST AI 600-1 treats it as an information security risk to test for, and EU AI Act Article 15 requires high-risk systems to resist attempts to alter their outputs. Map it through your risk assessment.
This is our mapping, labelled as such. It is not legal advice, and no framework prescribes a specific defence.
What is LLM01?
OWASP defines prompt injection as inputs that alter an LLM's behavior or output in unintended ways, including inputs a human cannot see as long as the model parses them. It separates direct injection, where a user's prompt changes behavior, from indirect injection, where the model ingests external content such as web pages or files containing instructions. Severity depends on the business context and the agency given to the model. OWASP states that no foolproof prevention is known, and lists mitigations such as constraining behavior, validating outputs with deterministic code, least privilege, human approval for high risk actions, segregating untrusted content and regular adversarial testing.
Importantly, the OWASP page does not reference compliance frameworks. Its only related references are MITRE ATLAS technique identifiers: AML.T0051.000 for direct prompt injection, AML.T0051.001 for indirect prompt injection and AML.T0054 for direct jailbreak injection. Those are threat taxonomy entries, not compliance mappings.
How does it map to NIST AI 600-1?
NIST's generative AI profile names prompt injection in its information security section, noting that generative AI expands the attack surface and is vulnerable to attacks like prompt injection or data poisoning. It describes direct and indirect forms. One suggested action says to perform AI red-teaming to assess resilience against generative AI attacks such as prompt injection, among others. So an auditor following NIST would expect to see red-teaming evidence for it.
How does it map to the EU AI Act?
Article 15(5) says high-risk AI systems must be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. Technical solutions are to include, where appropriate, measures to prevent, detect, respond to, resolve and control attacks. The article names data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws. Prompt injection is not named in the text we read, but an attack that changes a system's outputs through crafted input fits the intent. Whether your system is high-risk is a separate question to settle with counsel.
How does it map to security management frameworks?
General frameworks such as an information security management standard ask you to assess risks, apply controls and show they work. We did not review those texts for this post, so we do not claim specific clause numbers. The practical route is to add prompt injection to your risk register, link it to the OWASP mitigations as your controls, and keep test records as evidence.
What evidence does an auditor like?
A risk entry that names direct and indirect injection. A description of what the model can access and which actions need human approval. Red team results with dates and fixes. Logs showing which documents were retrieved and which tools were called. A regression test set run after each change.
What to do
- Add prompt injection, direct and indirect, to your risk register with an owner.
- Document the model's data and tool access and the approvals required.
- Run and record red-teaming with dates, findings and fixes.
- Validate model outputs in code before they trigger actions.
- Keep retrieval and tool logs for the period your policy requires.
- Ask counsel whether any system you run is high-risk under the AI Act.
Quick check
Does OWASP map LLM01 to compliance frameworks?
No. The page references only MITRE ATLAS technique identifiers, which are threat taxonomy entries rather than compliance mappings.
Does the EU AI Act name prompt injection?
Not in the Article 15 text we read. It names data poisoning, model poisoning, adversarial examples, confidentiality attacks and model flaws, and requires resilience to attempts to alter outputs.
Sources
Last reviewed: 18 October 2026.
