OWASP LLM10, unbounded consumption, is a resource control risk: users or attackers run excessive inferences, causing denial of service, runaway cost or model theft. It maps most directly to EU AI Act resilience, risk management and monitoring duties, and to NIST AI RMF Measure and Manage. These mappings are our reading, not an official crosswalk.
What is LLM10?
OWASP describes unbounded consumption as an LLM application allowing users to run excessive, uncontrolled inferences, leading to denial of service, economic losses, model theft and service degradation. Its examples include variable length input floods, denial of wallet through pay per use pricing, continuous input overflow, resource intensive queries, model extraction through the API, functional model replication and side channel attacks.
OWASP's mitigations: input size limits, rate limiting and per user quotas; timeouts and throttling; dynamic resource allocation and graceful degradation; restricting logit_bias and logprobs in responses; watermarking; sandboxing the model's network access; RBAC and least privilege on model repositories; a centralized model inventory with governance and approval workflows; and logging and anomaly detection on resource use.
How does it map to the EU AI Act?
The Act applies to high risk AI systems, with dates of 2 December 2027 for Annex III and 2 August 2028 for Annex I systems per the information site. If your system is not high risk, these map only as good practice.
Article 15, accuracy, resilience and cybersecurity. Systems must be resilient to errors and faults, which can use technical redundancy such as backup or fail safe plans, and must resist unauthorised third parties who try to alter use, outputs or performance by exploiting vulnerabilities. Measures should prevent, detect, respond to and control attacks including model flaws and confidentiality attacks. Rate limits, quotas, graceful degradation and extraction defenses are direct technical measures for this duty. Extraction maps to the confidentiality concern.
Article 9, risk management. A continuous, iterative process: identify and analyze risks, estimate and evaluate them including foreseeable misuse, use post market data and adopt targeted measures, with testing against predefined metrics. Resource abuse is a foreseeable misuse. Record it in the risk register with the controls above and test them.
Article 72, post market monitoring. Providers must systematically gather and analyse performance data over the lifetime. Usage and cost telemetry feed this. Anomaly alerts on consumption double as evidence that you monitor.
Article 17, quality management. Includes risk management, post market monitoring and record keeping as parts of the system. Treat the quota and monitoring configurations as controlled records with change history.
How does it map to NIST and ISO?
NIST's AI Risk Management Framework, released 26 January 2023, organizes work into Govern, Map, Measure and Manage. Governance covers who owns cost and capacity limits, Map covers identifying abuse scenarios, Measure covers tracking consumption and error metrics, and Manage covers throttles and incident response. NIST published a Generative AI Profile on 26 July 2024.
ISO/IEC 42001, an AI management system standard, asks for risk assessment, treatment and records inside a management system. Resource abuse belongs in that risk assessment. Other frameworks such as SOC 2 refer to availability among their categories; we did not fetch their criteria, so check them directly.
What evidence would an auditor want?
The configured limits and where they are enforced; load or abuse test results; alert rules and a sample of alerts handled; the model inventory with owners; and the incident or change record the last time a limit was raised.
What to do
- Add LLM10 scenarios to your AI risk register, with cost and availability impact.
- Enforce limits at the gateway: input size, rate, per user quota and timeouts.
- Set budget alerts and a hard stop for spend.
- Restrict model outputs that help extraction, such as logprobs, where you do not need them.
- Run a load test with synthetic abusive traffic in staging and keep the report.
- Log consumption per user and alert on anomalies.
- Keep a model inventory with owners and approvals.
Quick check
Is unbounded consumption only about cost?
No. OWASP also lists denial of service, service degradation and model theft.
Is there an official mapping from LLM10 to the EU AI Act?
Not one we found. The mapping here is our interpretation of the text of each Article.
Sources
- OWASP LLM10:2025 Unbounded Consumption
- EU AI Act: Article 9
- EU AI Act: Article 15
- EU AI Act: Article 17
- EU AI Act: Article 72
- EU AI Act implementation timeline
- NIST AI Risk Management Framework
- AFNOR: ISO/IEC 42001:2023 scope
Last reviewed: 18 October 2026.
