Every company that ships an AI model now has something new to protect. What AI security work involves, the attacks it stops, what the AI Act and NIS 2 require, the roles to aim for in France and how to train.
What does an AI security professional actually do?
The phrase covers two different jobs. The first is securing AI systems: making sure a model, its training data and the application around it cannot be manipulated, stolen or tricked. The second is using AI for security: machine learning that spots intrusions or ranks alerts in a security operations centre (SOC). Many roles need both.
| Securing AI systems | Using AI for security | |
|---|---|---|
| What you protect | Training data, models, prompts, the AI application and its users | The organisation’s networks, endpoints and cloud |
| Typical tasks | Threat-model an ML pipeline, test a model against adversarial inputs, lock down access to model endpoints, review a chatbot for prompt injection | Build or tune detection models, reduce false positives, automate triage of alerts |
| Legal anchor | AI Act Article 15 (high-risk AI), Article 55 (general-purpose AI with systemic risk) | NIS 2 incident handling and reporting |
A third strand is governance: deciding which AI uses are acceptable, documenting risks and proving compliance. It draws on law as much as on code.
Which attacks do AI security teams defend against?
The AI Act gives the clearest official list. Article 15(5) says technical solutions for high-risk AI systems shall include, where appropriate, measures to prevent, detect, respond to, resolve and control these attacks:
| Attack named in the AI Act | What it means | What a defender does |
|---|---|---|
| Data poisoning | Manipulating the training data set | Controls data sources, checks data integrity, monitors for drift |
| Model poisoning | Manipulating pre-trained components used in training | Vets third-party models and libraries, tracks their provenance |
| Adversarial examples or model evasion | Inputs designed to make the model make a mistake | Tests robustness, adds input checks, red-teams the model |
| Confidentiality attacks | Attacks on the confidentiality of the system, for example to extract its data or the model | Limits queries, controls access, protects training data |
| Model flaws | Weaknesses in the model itself | Evaluates the model before and after release |
Large language models add a family of attacks of their own, the best known being prompt injection: instructions hidden in a document, web page or message that push the model to ignore its rules or leak data. Article 15 also asks high-risk systems that keep learning after deployment to limit feedback loops, so that biased outputs do not flow back into future inputs.
ENISA, the EU cybersecurity agency, organises good practice in three layers in its Multilayer Framework for Good Cybersecurity Practices for AI (7 June 2023): cybersecurity foundations, AI-specific cybersecurity, and sector-specific cybersecurity for AI. The AI-specific layer sits on top of classic security, not instead of it.
What do the AI Act and NIS 2 require?
Regulation (EU) 2024/1689, the AI Act, applies in stages. The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk dates.
| Date | What applies |
|---|---|
| 1 August 2024 | AI Act enters into force |
| 2 February 2025 | Prohibited AI practices and AI literacy obligations |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models |
| 2 August 2026 | General application, including transparency rules |
| 2 December 2027 | High-risk rules for Annex III uses such as biometrics, education, employment and migration |
| 2 August 2028 | High-risk rules for AI built into regulated products (Annex I), such as lifts or toys |
Three provisions that create security work
Article 15: high-risk AI
Article 55: powerful general-purpose models
Article 4: AI literacy
NIS 2, Directive (EU) 2022/2555, covers the network and information systems of medium and large companies in 18 critical sectors, so an AI system run by a hospital or an energy operator sits inside its risk management and incident reporting duties: an early warning within 24 hours, a notification within 72 hours and a final report within one month (European Commission). In France, the transposition bill n° 1112 had passed the Senate on 12 March 2025 but, on 28 October 2026, still awaited a final vote at the Assemblée nationale. Our plain-language explainer, NIS 2 and the AI Act: the cyber skills employers now need, goes article by article.
Which careers does AI security lead to?
ENISA’s European Cybersecurity Skills Framework (ECSF, September 2022) has 12 role profiles and none dedicated to AI. In practice, AI security work is done inside existing profiles. Here is how each one changes when the system to protect is an AI.
| ECSF profile | The AI security version of the job | Where the demand comes from |
|---|---|---|
| Cybersecurity Architect | Designs secure ML pipelines: isolated training data, controlled model registries, protected inference endpoints | AI Act Article 15 |
| Penetration Tester (red teamer) | AI red teaming: adversarial testing of models and of chatbots or agents built on them | Article 55: documented adversarial testing |
| Cyber Incident Responder | Handles incidents that involve AI systems, and uses ML for detection in the SOC | Article 55 incident reporting; NIS 2 deadlines |
| Cyber Threat Intelligence Specialist | Tracks attacker tactics, techniques and procedures aimed at AI systems | ECSF mission: monitor threat actors’ TTPs |
| Cybersecurity Risk Manager | Assesses the risks of each AI use case and the controls it needs | NIS 2 risk management; AI Act risk categories |
| Cyber Legal, Policy & Compliance Officer | Runs AI Act and NIS 2 compliance, documentation and AI literacy programmes | AI Act Article 4 |
| Cybersecurity Researcher | Studies new attacks on models and new defences | Research and evaluation work |
Titles are not standardised yet, so read the task list rather than the title; AI2’s programme, for example, names the role “AI security engineer”. If you want the broader map of cyber roles and who hires them, start with cybersecurity jobs in France for international students; for the SOC route, see how to become a SOC analyst in France.
Who works on AI security in France?
At state level, France announced INESIA, its national institute for the evaluation and security of artificial intelligence, during the week for action on AI, 6 to 11 February 2025 (Campus France, 10 February 2025). It brings together existing national bodies, including ANSSI, the national agency for the security of information systems, Inria, the French institute for research in computer science and automation, the LNE, the national laboratory of metrology and testing, and PEReN, the expert centre for digital regulation, without creating a new legal structure, and lets France take part in the international network of AI Safety Institutes.
Providers of AI systems
Organisations deploying AI
Digital services and consulting firms
Research and evaluation
For the wider AI job market, salaries and visas, see AI jobs in France for international students.
Which skills should you build for AI security?
Machine learning foundations
Core security
Adversarial ML and LLM security
Cloud and MLOps
Governance
Coming from data science, focus on security fundamentals first. Coming from networks or security, add ML and deep learning. A generalist alternative is a master’s in computer science in France taught in English.
How do you start an AI security career as an international student?
- 1Choose a programme that teaches both sidesLook for ML modules and security modules in the same diploma, with a dedicated course on the security of AI systems.
- 2Build a portfolioWrite up adversarial tests on open models, a hardened ML pipeline, a prompt injection review. Show method and results.
- 3Target the right internshipTeams that run AI in production, a SOC that uses ML, or a compliance team preparing for the AI Act.
- 4Fund the visa yearThe French student visa requires resources of at least €877.50 a month (Service-Public F2231, verified 1 August 2026). Steps are in our student visa guidance.
- 5Plan your post-study permitA job related to your studies paid at least €2,800.53 gross a month opens the main routes. See working in France after graduation.
- 6Keep up with the rulesThe AI Act dates moved once already in 2026. Follow the European Commission’s AI Act page and the AI Act Service Desk.
How does AI2’s MSc Applied AI & Cybersecurity prepare you for AI security?
AI2’s MSc Applied AI & Cybersecurity is built on exactly this mix, 100% in English, at the Hub Nikola Tesla campus in Écouen, 22 minutes from Paris Gare du Nord. Year 1 is the shared applied AI core; Year 2 is the cybersecurity specialisation, followed by a six-month company internship.
| Where | AI security content | Hours |
|---|---|---|
| Year 1, AI core | Python for Data Science; Introduction to Machine Learning; Introduction to Deep Learning; NLP and Industrial Text Mining; Cloud Computing on AWS and Azure; AI Law and Ethics | 28 h; 28 h; 21 h; 21 h; 21 h; 21 h |
| Year 2, track module | Security of AI Systems: adversarial ML, LLM security, prompt injection, poisoning, AI governance | 42 h |
| Year 2, RNCP39978 block | AI for detection: AI-based intrusion detection | 56 h |
| Year 2, other track modules | Applied Cryptography; SOC, SIEM & Incident Response; Threat Intelligence | 3 × 42 h |
| Year 2, other RNCP39978 blocks | Cyber-risk analysis (EBIOS RM, NIS 2, GDPR); secure architecture (zero trust, IAM, PKI); attack simulation on cyber ranges and digital twins | 3 × 56 h |
“AI security engineer” is the first career direction the programme names, alongside detection and SOC analyst, IS and OT security architect, and NIS 2 compliance consultant. In 2025, five AI2 students worked on “Anticipating failures with AI” at the CND Hackathon for the French Ministry of the Armed Forces, and participation in a Defence Digital Commission cryptography hackathon is planned for November 2026. The final year awards the AI2 diploma and prepares RNCP39978 « Architecte des systèmes d’information dans les processus industriels », a level 7 professional certification (master’s level, EQF 7) recognised by the French State and certified by DATAKOO, AI2’s parent company; see RNCP level 7 explained.
| Format | Tuition 2027 | After AI2 scholarship |
|---|---|---|
| Full MSc, Year 1 | €12,500 | from €10,500 |
| Full MSc, Year 2 (cybersecurity) | €13,000 | Stated in your admission letter |
| 18-month direct entry into Year 2 | €13,000 | from €11,300 |
Intakes are planned in February, May and September 2027; the priority deadline for February is 30 November 2026. Details on AI2 tuition fees 2027 and AI2 scholarships. For a side-by-side view of cyber master’s options, read our guide to cybersecurity master’s programmes in France in English.
📘 Related guide: Machine learning engineer careers in France: from models to production.
Frequently asked questions
What is AI security?
AI security is the protection of AI systems, their training data, models and applications, against attacks such as data poisoning, model poisoning, adversarial examples, confidentiality attacks and prompt injection. The term is also used for applying machine learning to cyber defence, for example intrusion detection.
Which jobs exist in AI security in France?
AI security work sits inside existing cyber profiles: cybersecurity architect, penetration tester or AI red teamer, incident responder, threat intelligence specialist, risk manager, compliance officer and researcher. Titles vary; AI2’s programme, for example, names the role AI security engineer.
What does the AI Act require on cybersecurity?
Article 15 requires high-risk AI systems to reach an appropriate level of accuracy, robustness and cybersecurity and to resist attacks such as data poisoning and adversarial examples. Article 55 requires providers of general-purpose models with systemic risk to run adversarial testing and ensure adequate cybersecurity protection.
When do the AI Act high-risk rules apply?
After the Digital Omnibus on AI, in force since 27 July 2026, high-risk rules apply from 2 December 2027 for Annex III uses such as education and employment, and from 2 August 2028 for AI in regulated products. Rules for general-purpose AI models have applied since 2 August 2025.
Do I need a cybersecurity or a data science background?
Either can work. Data scientists need to add security fundamentals such as cryptography, access control and incident response; security profiles need to add machine learning and deep learning. A master’s that teaches both is the shortest route.
Is there a public body for AI security in France?
Yes. INESIA, the national institute for the evaluation and security of AI announced in February 2025, brings together ANSSI, Inria, the LNE and PEReN without creating a new legal structure.
Can I study AI security in English in France?
Yes. AI2’s MSc Applied AI and Cybersecurity is taught 100% in English near Paris, with a Security of AI Systems module and an AI for detection block. Year 1 costs €12,500, from €10,500 after scholarship, with intakes in February, May and September 2027.
Sources consulted on 28 October 2026: AI Act Service Desk: Article 15 (consolidated text at 27 July 2026) · AI Act Service Desk: Article 55 · AI Act Service Desk: Article 4, AI literacy · AI Act Service Desk: Article 113, application dates · European Commission: AI Act (updated 19 October 2026) · European Commission: NIS 2 Directive (updated 2 July 2026) · European Commission: NIS 2 FAQs · Assemblée nationale: legislative file, bill n° 1112 · ENISA: Multilayer Framework for Good Cybersecurity Practices for AI (7 June 2023) · ENISA: ECSF Role Profiles (September 2022) · Campus France: creation of INESIA (10 February 2025) · APEC: cybersecurity study (7 June 2022) · Service-Public F2231: student visa resources (verified 1 August 2026) · Service-Public F2229: work after studies (verified 1 June 2026) · AI2: MSc Applied AI & Cybersecurity · AI2: tuition fees 2027
Apply online: AI2’s admissions team reviews your file, holds an online interview and confirms your entry year, tuition and any scholarship in your admission letter. Priority deadline for February 2027: 30 November 2026.
