Capgemini has been picked to head up a European consortium aimed at supporting cyber threat modeling and risk assessment for advanced AI systems.
The consortium has been set up by the European Commission’s AI Office, part of the Directorate-General for Communications Networks, Content and Technology (DG CNECT).
Along with Capgemini, it includes digital and tech consulting firm Wavestone and France’s national metrology and testing laboratory, the Laboratoire National de Métrologie et d'Essais (LNE).
The consortium has been created to deal with the cyber risks of advanced AI systems, including automated vulnerability discovery, exploit generation, or the orchestration of large-scale cyber attacks. It aims to standardize adversarial testing, software vulnerability discovery, and offensive cyber capability evaluations.
Capgemini will be responsible for modeling emerging cyber offence risks, developing evaluation tools, designing technical compliance methodologies, and conducting on‑demand technical assessments.
The firm said it will support the AI Office to identify systemic risks and effectively enforce the AI Act’s obligations for advanced general purpose AI (GPAI) providers.
“As Europe deploys the world’s first comprehensive AI safety framework, this work with the European Commission reflects our shared commitment to ensuring AI technologies are developed and deployed responsibly,” said Andrea Falleni, CEO of Capgemini’s Southern Europe region and group executive board member.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
"By combining scientific rigor, operational expertise, and experience in operationalizing trusted AI, Capgemini is proud to help strengthen Europe’s digital resilience."
Increased alignment on AI risks
The move marks the first time that the EU has attempted to standardize adversarial testing, software vulnerability discovery, and offensive cyber capability evaluations for frontier models.
The idea is that using private firms alongside LNE will allow industrial-grade penetration testing and structured verification protocols to be created and updated more quickly than would be possible from state bodies alone.
"AI is transforming the cyber threat landscape as rapidly as it is creating new opportunities. Ensuring that advanced AI models remain safe and trustworthy requires the ability to anticipate, assess and mitigate emerging risks," said Alessandro Zamboni, partner at Wavestone.
"We are proud to contribute Wavestone’s cybersecurity and AI expertise to this European initiative, alongside Capgemini and LNE, to help turn the AI Act’s ambitions into operational reality."
The EU AI Act, which came into force in mid-2024, set out a legal classification for systemic-risk GPAI, which refers to models trained on cumulative computational thresholds over 10^25 floating-point operations (FLOPs).
It saw the creation of a General-Purpose AI (GPAI) code of practice - a voluntary tool, prepared by independent experts in a multi-stakeholder process. However, it didn't specify how systems were to be tested.
The creation of the consortium marks the beginning of a process that could see developers of frontier architectures facing mandatory technical audits before deploying high-capability models within the EU.
"Measurement is the prerequisite for enforcement; by seeking to quantify non-deterministic cyber risks, the European Union is attempting to establish the first empirical boundaries for frontier software systems," commented non-profit the AI For Developing Countries Forum.
"Whether this initiative succeeds will depend not on the legal rhetoric of the AI Act, but on whether these technical audit frameworks prove rigorous, transparent, and resilient to regulatory capture, offering a clear and predictable benchmark for both global powers and the developing world alike."